OIDC must be available at Homebox Startup

[rv10guy]

First Check

• This is not a feature request
• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the documentation, with the integrated search.
• I already read the docs and didn't find an answer.
• I can replicate the issue inside the Demo install.

Homebox Version

v0.22.3

What is the issue you are experiencing?

If the OIDC provider is not available when Homebox starts, OIDC login will fail until Homebox is restarted.

I use Pocket ID, and I learned this when I had to restart all of my services. If Homebox came up before Pocket ID I could not log in even if Pocket ID was up and running. The only way to resolve the issues was to restart Homebox once PocketID had finished it's startup.

It seems that there is some checking of the OIDC provider at startup and if that check fails it never retries.

How can the maintainer reproduce the issue?

Start Homebox with the OIDC provider unavailable. Start the OIDC provider. Try to login to Homebox.

To fix:
Restart Homebox and you will be able to log in with no change/modification to the OIDC provider.

Deployment

Docker (Linux)

Database Type

SQLite

OS Architechture

x86_64 (AMD, Intel)

Deployment Details

This is running on NixOS.

[tankerkiller125]

This is expected, Homebox checks the OIDC well-known endpoint to get information on login, token, and user information endpoints. Without that information it can't setup the backend requirements to make a successful OIDC connection.

The library we use will get new keys automatically as needed, but only gets the core information once on startup, which is generally considered safe, and even good practice both to prevent DoS attacks on the well known endpoints, but also somewhat security (although I somewhat question that logic, smarter people than me designed things)

[rv10guy]

I believe you but I can say of the 12 or so apps I run with OIDC this is the only one where I see this behavior.

[dougmeredith]

Perhaps the solution is that the Homebox startup should fail if the IdP is not available, rather than starting in a broken state. Then the container could be configured to re-try the failed application. Once the IdP is up, the Homebox startup would succeed.

[rv10guy]

The other option would be to initialize the ODIC connection on the first login attempt.