OIDC Security and Troubleshooting

OIDC Security and Troubleshooting

Activation Is Blocked

Nutify requires these stages in order for UI-managed OIDC:

1. configuration saved
2. discovery and JWKS validation successful
3. real browser login test successful
4. SSO enabled

Changing issuer, credentials, callback, scopes, claims, or authorization groups invalidates verification and disables SSO.

Common Errors

Issuer mismatch

The configured issuer must exactly equal discovery issuer and token iss. Paths and trailing slashes matter.

Redirect URI mismatch

Register the exact URL shown in Nutify. Reverse-proxy installations normally need the public HTTPS URL, not localhost or the container hostname.

User is not authorized

Confirm the token/UserInfo includes the configured groups claim and at least one matching user or administrator group. Comparisons are case-insensitive.

Username conflict

Nutify never links identities by username or email. Rename the provider-facing username or remove the conflicting unused Nutify account after confirming its ownership.

Private provider rejected

Enable Allow a private-network issuer only for an IdP you operate on the trusted LAN. Nutify still rejects link-local, multicast, unspecified, reserved, and metadata-service-style destinations.

Dynamic registration rejected

The provider may require an Initial Access Token, a specific DCR scope, or an administrator policy. Create a least-privilege, short-lived registration token or configure the client manually. Nutify never stores the supplied token.

Recovery

Open the local login directly:

https://nutify.example.com/auth/login?local=1

If environment configuration is invalid, correct .env and recreate the container. If database-managed SSO is invalid, sign in locally and use System -> Authentication to disable or delete it.

Secret Handling

• UI-managed client secrets are encrypted using a key derived from SECRET_KEY.
• APIs return ********, never plaintext.
• blank or masked secret fields preserve the current stored secret.
• Dynamic Registration Initial Access Tokens exist only for one request.
• provider secrets and access tokens are excluded from normal logs.

Changing SECRET_KEY without rebuilding/re-entering encrypted configuration makes existing encrypted secrets unreadable.