OIDC (Authentik) inconsistently loading

[begunfx]

Drydock version

1.5.0-rc.3

What happened?

I saw this 1x prior to 1.5.0-rc.3 (just thought it was a ghost in the machine), but it happened again this morning. After a container restart it appeared again and I was able to login via sso.

What did you expect?

see above

Steps to reproduce

see above

Relevant configuration

Logs

Installation method

Docker Compose

Docker version

24.0.1

OS / Architecture

Synology DSM 7

[s-b-e-n-s-o-n]

Found the root cause — OIDC discovery was a one-shot startup gate. If Authentik wasn't reachable when Drydock booted (common on Synology/Compose where container startup order isn't guaranteed), the OIDC provider was silently dropped and never retried. SSO only came back after restarting Drydock.

The fix makes OIDC discovery lazy:

• Startup discovery failure no longer prevents provider registration
• Redirect, callback, and token-validation paths lazily initialize the OIDC client on first use
• If Authentik becomes available after boot, SSO recovers on the next login attempt without restarting Drydock

This will ship in the next RC — please verify once it's out.

[s-b-e-n-s-o-n]

Fixed in v1.5.0-rc.4. Please update and let us know if this resolves the issue.

[begunfx]

So far OIDC is loading as expected. This one wasn't a consistent reportable bug so I'd say feel free to close this and if it happens again we can re-open or we can just leave it open for now and keep an eye on it? Thanks!

[s-b-e-n-s-o-n]

Re-verified on the RC5 branch (feature/v1.5-rc5):

Root cause: OIDC discovery was a one-shot startup gate. If the IdP was unreachable at boot time (common with Docker Compose startup races), the provider was silently dropped and SSO never recovered.

Fix (RC4): Lazy OIDC discovery — startup failure is now a warning, not fatal. The redirect, callback, and token-validation paths all lazily initialize the OIDC client on first use via ensureClientInitialized(). If the IdP becomes available after boot, SSO recovers transparently.

Verification:

• 205 OIDC-related unit tests pass, including the specific regression test for this scenario
• QA stack log confirms graceful degradation: OIDC discovery unavailable during startup (fetch failed). Drydock will retry on the next authentication attempt.
• Auth status API confirms provider stays registered even after failed startup discovery

Since you confirmed this is working — closing. Will ship in the final 1.5.0 release. If it resurfaces, reopen anytime.