Homarr•4mo ago

OIDC not working for me with authentik

Hi, I have setup OIDC in authentik and my container as follows

Solution:

Try to generate your own RS256 NEXTAUTH_SECRET, should dérive from it then

Jump to solution

26 Replies

Cakey Bot•4mo ago

Thank you for submitting a support request. Depending on the volume of requests, our team should get in contact with you shortly.

⚠️ Please include the following details in your post or we may reject your request without further comment: - Log (See https://homarr.dev/docs/community/faq#how-do-i-open-the-console--log) - Operating system (Unraid, TrueNAS, Ubuntu, ...) - Exact Homarr version (eg. 0.15.0, not latest) - Configuration (eg. docker-compose, screenshot or similar. Use ``your-text`` to format) - Other relevant information (eg. your devices, your browser, ...)

❓ Frequently Asked Questions | Homarr documentation

Can I install Homarr on a Raspberry Pi?

andresOP•4mo ago

Bue for some reason, after logging in I get this:

andresOP•4mo ago

homarr is behind a reverse proxy, maybe that's the reason? I see this in the URL redirect_uri=http%3A%2F%2F192.168.1.54%3A10004

Serenaphic•4mo ago

Set the NEXTAUTH_URL env var for homarr to homarr's https address Ah wait you did that already?

andresOP•4mo ago

yeah ok I was messing with something before I removed that I was testing nginx proxy authentication so I just removed that and now I get a different error but getting closer

https://next-auth.js.org/errors#oauth_callback_error unexpected JWT alg received, expected RS256, got: HS256 {
  error: RPError: unexpected JWT alg received, expected RS256, got: HS256
      at Client.validateJWT (/app/node_modules/openid-client/lib/client.js:911:13)
      at Client.validateIdToken (/app/node_modules/openid-client/lib/client.js:766:60)
      at Client.callback (/app/node_modules/openid-client/lib/client.js:505:18)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
      at async oAuthCallback (/app/node_modules/next-auth/core/lib/oauth/callback.js:109:16)
      at async Object.callback (/app/node_modules/next-auth/core/routes/callback.js:52:11)
      at async AuthHandler (/app/node_modules/next-auth/core/index.js:208:28)
      at async NextAuthApiHandler (/app/node_modules/next-auth/next/index.js:22:19)
      at async auth (/app/.next/server/pages/api/auth/[...nextauth].js:143:12) {
    name: 'OAuthCallbackError',
    code: undefined
  },
  providerId: 'oidc',
  message: 'unexpected JWT alg received, expected RS256, got: HS256'

https://next-auth.js.org/errors#oauth_callback_error unexpected JWT alg received, expected RS256, got: HS256 {
  error: RPError: unexpected JWT alg received, expected RS256, got: HS256
      at Client.validateJWT (/app/node_modules/openid-client/lib/client.js:911:13)
      at Client.validateIdToken (/app/node_modules/openid-client/lib/client.js:766:60)
      at Client.callback (/app/node_modules/openid-client/lib/client.js:505:18)
      at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
      at async oAuthCallback (/app/node_modules/next-auth/core/lib/oauth/callback.js:109:16)
      at async Object.callback (/app/node_modules/next-auth/core/routes/callback.js:52:11)
      at async AuthHandler (/app/node_modules/next-auth/core/index.js:208:28)
      at async NextAuthApiHandler (/app/node_modules/next-auth/next/index.js:22:19)
      at async auth (/app/.next/server/pages/api/auth/[...nextauth].js:143:12) {
    name: 'OAuthCallbackError',
    code: undefined
  },
  providerId: 'oidc',
  message: 'unexpected JWT alg received, expected RS256, got: HS256'

Serenaphic•4mo ago

thank me I don't even look at whatever you sent I guess? :x Is that new error in homarr or authentik?

andresOP•4mo ago

homarr

Serenaphic•4mo ago

I never saw that error before so I'm looking into it It seems to be a problem with the NEXTAUTH_SECRET ngl I don't even set it myself but maybe look into it Eatiing time for me, sorry if I don't answer

andresOP•4mo ago

no worries, thanks for taking a look removed the secret but the same thing happens

Solution

Serenaphic•4mo ago

Try to generate your own RS256 NEXTAUTH_SECRET, should dérive from it then

Serenaphic•4mo ago

Actually, it's possible it has to do with the oidc secret now that I think about it

andresOP•4mo ago

found something similar here

andresOP•4mo ago

https://community.vikunja.io/t/struggling-with-sso-via-authentik/701/7

Vikunja Community

Struggling with SSO via Authentik

Here’s the results of my testing: GET HTTPS akserver FROM vikunja_api-1: refused (port 443) GET HTTPS akserver:9443 FROM vikunja_api-1: not refused, but curl has a problem with the self-signed cert GET HTTPS authentik.fqdn FROM vikunja_api-1: resolves to the correct IP and port 443 as per Traefik config, but times out GET HTTPS akserver FROM...

Serenaphic•4mo ago

Are you using self signed certs?

andresOP•4mo ago

for SSL I'm using letsencrypt in signing key I don't have anything selected it's weird though my certificates are RSA ok it works for local auth users now so the issue is when I use Google Auth but all good on homarr side no idea how to fix it for social logins tho

Serenaphic•4mo ago

Nice! Absolutely no idea about Google either, sorry. Usually people do self hosting to get away from them x)

andresOP•4mo ago

yeah I know XD

Serenaphic•4mo ago

Welp, however knows about it is welcome to chip in here, otherwise good luck and be sure to share if you find a solution.

andresOP•4mo ago

sure thing thanks a lot you were right, generating a new key did the trick

Serenaphic•4mo ago

Nice! Glad it's all working then

sunmetis•3mo ago

Hi almost same error with iodc. The auth_url is needed?? Not a word in authelia or homarr manuals. The correct url should be homar.domain.com Thx for your help

andresOP•3mo ago

what´s the error? @sunmetis

sunmetis•3mo ago

Hi thx for your answer localhost:7575/api/auth/error?error=OAuthSignin

andresOP•3mo ago

hey let me check @sunmetis you need to make sure to setup AUTH_OIDC_URI, AUTH_OIDC_CLIENT_SECRET, BASE_URL, NEXTAUTH_URL, NEXTAUTH_SECRET, AUTH_OIDC_REDIRECT_LOGOUT

sunmetis•3mo ago

Private conf sent in msg @andres

Gaming

Programming

OIDC not working for me with authentik