🐞 Bug: oidc oauth login with authentik not working

[bucky2780]

Bug Description

Does anyone have the oidc login working with authentik ?
I tried to hook it up yesterday... staying as generic as possible. However fails with a uri re-direct error.
Are you sure the client secret is getting captured ? Does not seem to remember it from login to login.

Happy to post pics of the integration if you think it is working....

Steps To Reproduce

setup authentik sso oauth integration
use UI to setup oauth on arcane side.
URI redirect error will result

Expected Behavior

I would expect a clean login...

Actual Behavior

would expect a clean login

Screenshots

No response

Arcane Version

v 1.30

Operating System

macOS

Browser

brave

Docker Version

latest

[kmendell]

I got it working when anotehr issue popped up about authentik. I know the OIDC logic is working as its how i login to my prodtuon setup.

The secret should be persisted (at least in the login flow) anywhere past using it to "authenticate" to the OIDC provider, beyond that it should never be stored anywhere.

[kmendell]

Post any images or logs from your error and i can certainly help you troubleshoot or find the issue if it is in the code.

[bucky2780]

screen caps posted above. The client secret appears blank... but I assure you I saved it previously. I would have expected a like of asterisks... that way I know its saved.

Might try the environment method... not sure.

I am still new with authentik....

[kmendell]

The client secret is saved I left it blank vs atrixs as it can be changed if a new value is saved.

I think the issue is there mutiple call back urls in authemtik using the strict option, im not a fan of than in authentik, but try remove the callback urls and then logging in it should auto populate the correct callback url

[bucky2780]

I think it is something else... Replaced the redirect uri to regex ".*" which is less secure... but more open. Still gave me the same redirect error.

what should I use for issuer url ?
https://auth.expander.dedyn.io/application/o/arcane/.well-known/openid-configuration (doesint work)
or
https://auth.expander.dedyn.io/application/o/arcane/ (gets me further)

[keonramses]

@bucky2780, are you using the default Authentik certificate? I am having issues getting this to work on my end and I am trying to see if I am missing anything that is causing me to get this error below.

"Failed to generate OIDC auth URL: failed to discover provider: Get \"https://auth.{domain}/application/o/arcane/.well-known/openid-configuration\": tls: failed to verify certificate: x509: certificate signed by unknown authority"

[bucky2780]

Interesting... I am not getting much in the logs... getting unauthenticated lines in the authentik log, and not much in the arcane log.

I note that arcane says at the top of the documentation... that they insist on using PKCE. I assume authentik handles this natively... but now not so sure. Or perhaps authentik has some secret config to help adjust for pkce... not sure.

[kmendell]

Right Arcane needs PKCE the error you are getting is caused by a insecure TLS Certificate some where, see this issue: #527. I cant reproduce it as my instance worked just fine, however there is the posibility i could add the dont verify tls certs switch for OIDC but its not really recommended for obvious reasons

[kmendell]

Can you try the ghcr.io/ofkm/arcane:next image once its done building? I enabled both PKCE and plain auth challenges im curious if that will fix anything.

[bucky2780]

yes... will try soon. Can you make it configuratble via an env variable ? I noticed other services do something similar.

[kmendell]

The auth challenge does need to be configured it automatucally wil use whatever the provider advertises, but the rest of the OIDC settings can be set via environment variables

[bucky2780]

sorry... does not work for me.
I am going to capitulate for the moment... as there are quite a few complexities involved. From what I can tell it is NOT a requirement to have a cert for pkce... and my authentik install is very much basic and standard at this stage.
For my homelab cert handling is done in opnsense/caddy... all access is via the reverse proxy.
Thanks for your efforts... very much appreciated.

[bucky2780]

further to this... taking a page out of immich's book...

in user settings for oauth... in addition to client id etc... they have a combo dropdown - TOKEN_ENDPOINT_AUTH_METHOD. Values are client_secret_post, client_secret_basic. The first takes you on pkce, and the latter drops it.

seems like the way forward to me....