Ueberauth didn't handle the request and no failure was set

[stignarnia]

I tried setting up OIDC with authentik but it's not working.
relevant environment variables:

      - LOCAL_AUTH_ENABLED=false
      - OIDC_ENABLED=true
      - OIDC_ISSUER=https://---/application/o/media-manager-sidecar/
#      - OIDC_DISCOVERY_DOCUMENT_URI=https://---/application/o/media-manager-sidecar/.well-known/openid-configuration
      - OIDC_REDIRECT_URI=https://mydia.---/auth/oidc/callback

Also tried with discovery document but no issuer and vice versa, with and without trailing slash

The discovery document is reachable in the open internet I checked from an incognito tab

I deleted the database between retries

This would be the first user

The error I get:

mydia  |   Parameters: %{"provider" => "oidc"}

mydia  |   Pipelines: [:browser]

mydia  | 22:18:00.238 request_id=GHyW6LUfluT4D58AAARi file=lib/mydia_web/controllers/auth_controller.ex [debug] OIDC request called with params: %{"provider" => "oidc"}

mydia  | 22:18:00.238 request_id=GHyW6LUfluT4D58AAARi file=lib/mydia_web/controllers/auth_controller.ex [debug] Connection halted? false

mydia  | 22:18:00.238 request_id=GHyW6LUfluT4D58AAARi file=lib/mydia_web/controllers/auth_controller.ex [debug] Response sent? unset

mydia  | 22:18:00.238 request_id=GHyW6LUfluT4D58AAARi file=lib/mydia_web/controllers/auth_controller.ex [error] Ueberauth didn't handle the request and no failure was set

Thanks!

[arsfeld]

I'm seeing errors on my instance too, I'm still investigating, not sure what broke it

[arsfeld]

I just released v0.7.2 with fixes to OIDC, it's working with Authelia for me with something similar to:

    clients:
      - client_id: 'mydia'
        client_name: 'Mydia - Media Companion'
        client_secret: 'your-client-secret-here'  # Plain text or hashed
        authorization_policy: 'one_factor'  # or 'two_factor'
        redirect_uris:
          - 'https://mydia.example.com/auth/oidc/callback'
          - 'http://localhost:4000/auth/oidc/callback'  # For development
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        grant_types:
          - 'authorization_code'
        response_types:
          - 'code'
        response_modes:
          - 'query'
          - 'fragment'
          - 'form_post'
        token_endpoint_auth_method: 'client_secret_post'

It feels like properly configuring OIDC is more magic then science though, so please let me know if something isn't working right.

[stignarnia]

hey! for sure it's better than before, it at least sends me to the login page of authentik and sends and receives the code, but then:

18:22:19.691 request_id=GH11yg7PqroU9NYAACGi file=lib/mydia_web/controllers/auth_controller.ex [error] OIDC callback failure: %Ueberauth.Failure{provider: :oidc, strategy: Ueberauth.Strategy.Oidcc, errors: [%Ueberauth.Failure.Error{message_key: "redirect_uri", message: "Redirected to the wrong URI: http://mydia.---/auth/oidc/callback"}]}

despite it being set to https both in authentik and in URL_SCHEME=https in the docker compose

[stignarnia]

Ok so I have it fixed now, what happened was:

• I was using Authentik as a reverse proxy, not only as the IdP
• Authentik had a bug (What is the TLS version of the OIDC provider of Authentik? goauthentik/authentik#10523) where it would pin TLS 1.2 for no reason and it would do so without complying with the spec, so without a proper handshake flow, thus simply denying the connection
• Unlike browsers and curl which are smart enough to simply retry a brand new connection with TLS 1.2 instead of 1.3, erlang's (and others', like the default webDAV client in linux) default behaviour is to strictly comply with the standard, so it would give up after the first denial.

Authentik fixed their bug but I decided to finally switch to a proper reverse proxy anyway (Traefik) so now it works perfectly, the only thing is the /profile and /preferences endpoints go to 404 when the user is created via OAuth.

Also, with local authentication completely disabled, it goes to ERR_TOO_MANY_REDIRECTS on the login screen.