[Bug] OIDC error not parsed correctly / Rauthy incompatible

[daniel-tp]

Gokapi Version

v2.2.2

Operating System / Deployment

Docker (Official Image)

Storage Backend

S3 Compatible (AWS, Minio, etc.)

Database

SQLite

Steps to Reproduce

1. Setup Rauthy as OIDC Provider
2. Try to Login
3. Get "401 Unauthorized login_required" from Rauthy.

Additional Context

I am not 100% sure if this is an issue here or with Rauthy, but when trying to login to Gokapi, you get an immediate 401 with Rauthy. If you remove prompt=none from the request URL or set prompt=consent it works fine.

This is the area of the code in Rauthy where my understanding is it only allows prompt=none if a session already exists.

https://github.com/sebadob/rauthy/blob/d7c4b9c0818ae4fe4d84559cc908b80bea9b7ea4/src/api/src/oidc.rs#L147-L157

Relevant Logs

Before submitting

• I have removed sensitive information (API keys, passwords) from my logs.

[Forceu]

Thanks a lot for the bug report! Should be fixed in a0a3c9d, let me know if it is working for you!

[daniel-tp]

Updated my docker container to latest-dev just now, but unfortunately the problem persists.

[Forceu]

Thanks for the reply, I will have another look

[daniel-tp]

I don't know much about OIDC auth, but would not sending the prompt param instead of prompt=none work?

[Forceu]

Basically what Gokapi tries is to use prompt=none first and the provider should normally respond with login_required if no session is active for the user. I could imagine that Rauthy sends HTTP status code 401 as well, which might throw off the Gokapi logic. According to the OIDC specifications in such a case the status code 302 shall be sent.

[Forceu]

@daniel-tp So I had a look at Rauthy's code and it is indeed a bug on their side. I openend an issue and created a pull request to fix this bug.