Issues with Outline with newest version of Authelia

[Mag1cByt3s]

Version

v4.38.1

Deployment Method

Docker

Reverse Proxy

Caddy

Reverse Proxy Version

2.7.6

Description

I am getting weird errors when trying to authenticate with my Outline server (getoutline.com) since Authelia 4.38.1.
Version 4.38.0 works without issues so i downgraded it for now.

Here is the error from Outline:

ERR Error during authentication | error=Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method. stack=TokenError: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method.
    at OAuth2Strategy.parseErrorResponse (/opt/outline/node_modules/passport-oauth2/lib/strategy.js:373:12)
    at OAuth2Strategy._createOAuthError (/opt/outline/node_modules/passport-oauth2/lib/strategy.js:420:16)
    at /opt/outline/node_modules/passport-oauth2/lib/strategy.js:177:45
    at /opt/outline/node_modules/oauth/lib/oauth2.js:191:18
    at passBackControl (/opt/outline/node_modules/oauth/lib/oauth2.js:132:9)
    at IncomingMessage.<anonymous> (/opt/outline/node_modules/oauth/lib/oauth2.js:157:7)
    at IncomingMessage.emit (node:events:530:35)
    at IncomingMessage.emit (node:domain:488:12)
    at endReadableNT (node:internal/streams/readable:1696:12)
    at process.processTicksAndRejections (node:internal/process/task_queues:82:21)

Here the relevant config of Outline:

      - OIDC_CLIENT_ID=<myOIDCClientID>
      - OIDC_CLIENT_SECRET=<myOIDCClientSecret>
      - OIDC_AUTH_URI=https://auth.<mydomain.com>/api/oidc/authorization
      - OIDC_TOKEN_URI=https://auth.<mydomain.com>/api/oidc/token
      - OIDC_USERINFO_URI=https://auth.<mydomain.com>/api/oidc/userinfo
      - OIDC_USERNAME_CLAIM=preferred_username
      - OIDC_DISPLAY_NAME=Authelia
      - OIDC_SCOPES="openid offline_access profile email"
      - OIDC_LOGOUT_URL=https://auth.<mydomain.com>/logout

I am hoping that the info I provided is enough and that this issue will get fixed soon as Outline is one of the most important services for me that i am hosting.

Reproduction

• Use Outline with Authelia version >= 4.38.1 using OIDC
• Outline version does not matter, I tested using the latest version
• Used Proxy is Caddy

Expectations

No error should occur while loggin in

Configuration (Authelia)

---
###############################################################################
#                           Authelia Configuration                            #
###############################################################################

## Note: the container by default expects to find this file at /config/configuration.yml.

## Certificates directory specifies where Authelia will load trusted certificates (public portion) from in addition to
## the system certificates store.
## They should be in base64 format, and have one of the following extensions: *.cer, *.crt, *.pem.
# certificates_directory: /config/certificates/

## The theme to display: light, dark, grey, auto.
theme: dark

## The secret used to generate JWT tokens when validating user identity by email confirmation. JWT Secret can also be
## set using a secret: https://www.authelia.com/c/secrets
jwt_secret: <base64JWTSecret>

## Default redirection URL
##
## If user tries to authenticate without any referer, Authelia does not know where to redirect the user to at the end
## of the authentication process. This parameter allows you to specify the default redirection URL Authelia will use
## in such a case.
##
## Note: this parameter is optional. If not provided, user won't be redirected upon successful authentication.
default_redirection_url: https://auth.<mydomain.com>

## Set the default 2FA method for new users and for when a user has a preferred method configured that has been
## disabled. This setting must be a method that is enabled.
## Options are totp, webauthn, mobile_push.
default_2fa_method: "webauthn"

##
## Server Configuration
##
server:

  ## The address to listen on.
  host: 0.0.0.0

  ## The port to listen on.
  port: 9091

  ## Set the single level path Authelia listens on.
  ## Must be alphanumeric chars and should not contain any slashes.
  path: "auth"

  ## Set the path on disk to Authelia assets.
  ## Useful to allow overriding of specific static assets.
  # asset_path: /config/assets/

  ## Buffers usually should be configured to be the same value.
  ## Explanation at https://www.authelia.com/c/server#buffer-sizes
  ## Read buffer size adjusts the server's max incoming request size in bytes.
  ## Write buffer size does the same for outgoing responses.
  buffers.read: 8192
  buffers.write: 8192

  ## Enables the pprof endpoint.
  enable_pprof: false

  ## Enables the expvars endpoint.
  enable_expvars: false

  ## Disables writing the health check vars to /app/.healthcheck.env which makes healthcheck.sh return exit code 0.
  ## This is disabled by default if either /app/.healthcheck.env or /app/healthcheck.sh do not exist.
  disable_healthcheck: false

  ## Authelia by default doesn't accept TLS communication on the server port. This section overrides this behaviour.
  #tls:
    ## The path to the DER base64/PEM format private key.
  #  key: ""

    ## The path to the DER base64/PEM format public certificate.
 #   certificate: ""

    ## The list of certificates for client authentication.
 #   client_certificates: []

  ## Server headers configuration/customization.
  headers:

    ## The CSP Template. Read the docs.
    csp_template: ""

##
## Log Configuration
##
log:
  ## Level of verbosity for logs: info, debug, trace.
  level: info

  ## Format the logs are written as: json, text.
  format: json

  ## File path where the logs will be written. If not set logs are written to stdout.
  file_path: /config/authelia.log

  ## Whether to also log to stdout when a log_file_path is defined.
  keep_stdout: true

##
## Telemetry Configuration
##
telemetry:

  ##
  ## Metrics Configuration
  ##
  metrics:
    ## Enable Metrics.
    enabled: false

    ## The address to listen on for metrics. This should be on a different port to the main server.port value.
    address: tcp://0.0.0.0:9959

##
## TOTP Configuration
##
## Parameters used for TOTP generation.
totp:
  ## Disable TOTP.
  disable: false

  ## The issuer name displayed in the Authenticator application of your choice.
  issuer: auth.<mydomain.com>

  ## The TOTP algorithm to use.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#algorithm
  algorithm: sha512

  ## The number of digits a user has to input. Must either be 6 or 8.
  ## Changing this option only affects newly generated TOTP configurations.
  ## It is CRITICAL you read the documentation before changing this option:
  ## https://www.authelia.com/c/totp#digits
  digits: 8

  ## The period in seconds a one-time password is valid for.
  ## Changing this option only affects newly generated TOTP configurations.
  period: 30

  ## The skew controls number of one-time passwords either side of the current one that are valid.
  ## Warning: before changing skew read the docs link below.
  skew: 1
  ## See: https://www.authelia.com/c/totp#input-validation to read
  ## the documentation.

  ## The size of the generated shared secrets. Default is 32 and is sufficient in most use cases, minimum is 20.
  secret_size: 40

##
## WebAuthn Configuration
##
## Parameters used for WebAuthn.
webauthn:
  ## Disable Webauthn.
  disable: false

  ## Adjust the interaction timeout for Webauthn dialogues.
  timeout: 60s

  ## The display name the browser should show the user for when using Webauthn to login/register.
  display_name: Authelia

  ## Conveyance preference controls if we collect the attestation statement including the AAGUID from the device.
  ## Options are none, indirect, direct.
  attestation_conveyance_preference: direct

  ## User verification controls if the user must make a gesture or action to confirm they are present.
  ## Options are required, preferred, discouraged.
  user_verification: preferred

##
## Duo Push API Configuration
##
## Parameters used to contact the Duo API. Those are generated when you protect an application of type
## "Partner Auth API" in the management panel.
duo_api:
  disable: false
  #hostname: api-123456789.example.com
  #integration_key: ABCDEF
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  #secret_key: 1234567890abcdefghifjkl
  #enable_self_enrollment: false

##
## NTP Configuration
##
## This is used to validate the servers time is accurate enough to validate TOTP.
ntp:
  ## NTP server address.
  address: "ptbtime1.ptb.de:123"

  ## NTP version.
  version: 3

  ## Maximum allowed time offset between the host and the NTP server.
  max_desync: 3s

  ## Disables the NTP check on startup entirely. This means Authelia will not contact a remote service at all if you
  ## set this to true, and can operate in a truly offline mode.
  disable_startup_check: false

  ## The default of false will prevent startup only if we can contact the NTP server and the time is out of sync with
  ## the NTP server more than the configured max_desync. If you set this to true, an error will be logged but startup
  ## will continue regardless of results.
  disable_failure: false

##
## Authentication Backend Provider Configuration
##
## Used for verifying user passwords and retrieve information such as email address and groups users belong to.
##
## The available providers are: `file`, `ldap`. You must use only one of these providers.
authentication_backend:

  ## Password Reset Options.
  password_reset:
    ## Disable both the HTML element and the API for reset password functionality.
    disable: true

    ## External reset password url that redirects the user to an external reset portal. This disables the internal reset
    ## functionality.
    custom_url: ""

  ## The amount of time to wait before we refresh data from the authentication backend. Uses duration notation.
  ## To disable this feature set it to 'disable', this will slightly reduce security because for Authelia, users will
  ## always belong to groups they belonged to at the time of login even if they have been removed from them in LDAP.
  ## To force update on every request you can set this to '0' or 'always', this will increase processor demand.
  ## See the below documentation for more information.
  ## Duration Notation docs:  https://www.authelia.com/c/common#duration-notation-format
  ## Refresh Interval docs: https://www.authelia.com/c/1fa#refresh-interval
  refresh_interval: 2m

  ##
  ## LDAP (Authentication Provider)
  ##
  ## This is the recommended Authentication Provider in production
  ## because it allows Authelia to offload the stateful operations
  ## onto the LDAP service.
  #ldap:
    ## The LDAP implementation, this affects elements like the attribute utilised for resetting a password.
    ## Acceptable options are as follows:
    ## - 'activedirectory' - For Microsoft Active Directory.
    ## - 'custom' - For custom specifications of attributes and filters.
    ## This currently defaults to 'custom' to maintain existing behaviour.
    ##
    ## Depending on the option here certain other values in this section have a default value, notably all of the
    ## attribute mappings have a default value that this config overrides, you can read more about these default values
    ## at https://www.authelia.com/c/ldap#defaults
  #  implementation: custom

    ## The url to the ldap server. Format: <scheme>://<address>[:<port>].
    ## Scheme can be ldap or ldaps in the format (port optional).
  #  url: ldap://127.0.0.1

    ## The dial timeout for LDAP.
  #  timeout: 5s

    ## Use StartTLS with the LDAP connection.
  #  start_tls: false

  #  tls:
      ## Server Name for certificate validation (in case it's not set correctly in the URL).
      # server_name: ldap.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
  #    skip_verify: false

      ## Minimum TLS version for either Secure LDAP or LDAP StartTLS.
  #    minimum_version: TLS1.2

    ## The distinguished name of the container searched for objects in the directory information tree.
    ## See also: additional_users_dn, additional_groups_dn.
 #   base_dn: dc=example,dc=com

    ## The attribute holding the username of the user. This attribute is used to populate the username in the session
    ## information. It was introduced due to #561 to handle case insensitive search queries. For you information,
    ## Microsoft Active Directory usually uses 'sAMAccountName' and OpenLDAP usually uses 'uid'. Beware that this
    ## attribute holds the unique identifiers for the users binding the user and the configuration stored in database.
    ## Therefore only single value attributes are allowed and the value must never be changed once attributed to a user
    ## otherwise it would break the configuration for that user. Technically, non-unique attributes like 'mail' can also
    ## be used but we don't recommend using them, we instead advise to use the attributes mentioned above
    ## (sAMAccountName and uid) to follow https://www.ietf.org/rfc/rfc2307.txt.
    # username_attribute: uid

    ## The additional_users_dn is prefixed to base_dn and delimited by a comma when searching for users.
    ## i.e. with this set to OU=Users and base_dn set to DC=a,DC=com; OU=Users,DC=a,DC=com is searched for users.
 #   additional_users_dn: ou=users

    ## The users filter used in search queries to find the user profile based on input filled in login form.
    ## Various placeholders are available in the user filter which you can read about in the documentation which can
    ## be found at: https://www.authelia.com/c/ldap#users-filter-replacements
    ##
    ## Recommended settings are as follows:
    ## - Microsoft Active Directory: (&({username_attribute}={input})(objectCategory=person)(objectClass=user))
    ## - OpenLDAP:
    ##   - (&({username_attribute}={input})(objectClass=person))
    ##   - (&({username_attribute}={input})(objectClass=inetOrgPerson))
    ##
    ## To allow sign in both with username and email, one can use a filter like
    ## (&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))
 #   users_filter: (&({username_attribute}={input})(objectClass=person))

    ## The additional_groups_dn is prefixed to base_dn and delimited by a comma when searching for groups.
    ## i.e. with this set to OU=Groups and base_dn set to DC=a,DC=com; OU=Groups,DC=a,DC=com is searched for groups.
 #   additional_groups_dn: ou=groups

    ## The groups filter used in search queries to find the groups based on relevant authenticated user.
    ## Various placeholders are available in the groups filter which you can read about in the documentation which can
    ## be found at: https://www.authelia.com/c/ldap#groups-filter-replacements
    ##
    ## If your groups use the `groupOfUniqueNames` structure use this instead:
    ##    (&(uniqueMember={dn})(objectClass=groupOfUniqueNames))
 #   groups_filter: (&(member={dn})(objectClass=groupOfNames))

    ## The attribute holding the name of the group.
    # group_name_attribute: cn

    ## The attribute holding the mail address of the user. If multiple email addresses are defined for a user, only the
    ## first one returned by the LDAP server is used.
    # mail_attribute: mail

    ## The attribute holding the display name of the user. This will be used to greet an authenticated user.
    # display_name_attribute: displayName

    ## Follow referrals returned by the server.
    ## This is especially useful for environments where read-only servers exist. Only implemented for write operations.
 #   permit_referrals: false

    ## The username and password of the admin user.
 #   user: cn=admin,dc=example,dc=com
    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
 #   password: password

  ##
  ## File (Authentication Provider)
  ##
  ## With this backend, the users database is stored in a file which is updated when users reset their passwords.
  ## Therefore, this backend is meant to be used in a dev environment and not in production since it prevents Authelia
  ## to be scaled to more than one instance. The options under 'password' have sane defaults, and as it has security
  ## implications it is highly recommended you leave the default values. Before considering changing these settings
  ## please read the docs page below:
  ## https://www.authelia.com/r/passwords#tuning
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  file:
     path: /config/users_database.yml
     password:
       algorithm: argon2id
       iterations: 2
       key_length: 32
       salt_length: 16
       memory: 1048576
       parallelism: 8

##
## Password Policy Configuration.
##
password_policy:

  ## The standard policy allows you to tune individual settings manually.
  standard:
    enabled: false

    ## Require a minimum length for passwords.
    min_length: 8

    ## Require a maximum length for passwords.
    max_length: 0

    ## Require uppercase characters.
    require_uppercase: true

    ## Require lowercase characters.
    require_lowercase: true

    ## Require numeric characters.
    require_number: true

    ## Require special characters.
    require_special: true

  ## zxcvbn is a well known and used password strength algorithm. It does not have tunable settings.
  zxcvbn:
    enabled: false

    ## Configures the minimum score allowed.
    min_score: 3

##
## Access Control Configuration
##
## Access control is a list of rules defining the authorizations applied for one resource to users or group of users.
##
## If 'access_control' is not defined, ACL rules are disabled and the 'bypass' rule is applied, i.e., access is allowed
## to anyone. Otherwise restrictions follow the rules defined.
##
## Note: One can use the wildcard * to match any subdomain.
## It must stand at the beginning of the pattern. (example: *.mydomain.com)
##
## Note: You must put patterns containing wildcards between simple quotes for the YAML to be syntactically correct.
##
## Definition: A 'rule' is an object with the following keys: 'domain', 'subject', 'policy' and 'resources'.
##
## - 'domain' defines which domain or set of domains the rule applies to.
##
## - 'subject' defines the subject to apply authorizations to. This parameter is optional and matching any user if not
##    provided. If provided, the parameter represents either a user or a group. It should be of the form
##    'user:<username>' or 'group:<groupname>'.
##
## - 'policy' is the policy to apply to resources. It must be either 'bypass', 'one_factor', 'two_factor' or 'deny'.
##
## - 'resources' is a list of regular expressions that matches a set of resources to apply the policy to. This parameter
##   is optional and matches any resource if not provided.
##
## Note: the order of the rules is important. The first policy matching (domain, resource, subject) applies.
access_control:
  ## Default policy can either be 'bypass', 'one_factor', 'two_factor' or 'deny'. It is the policy applied to any
  ## resource if there is no policy to be applied to the user.
  default_policy: deny

  networks:
    - name: internal
      networks:
        - '172.22.0.0/12'
        - '172.28.0.0/12'
        - '192.168.0.0/16'

  rules:
    ## Rules applied to everyone
    - domain: 'auth.<mydomain.com>'
      policy: bypass

    - domain: 'homer.<mydomain.com>'
      policy: two_factor

    - domain: 'home.<mydomain.com>'
      policy: two_factor

    - domain: 'nextcloud.<mydomain.com>'
      policy: two_factor

    - domain: 'sonarr.<mydomain.com>'
      policy: two_factor

    - domain: 'radarr.<mydomain.com>'
      policy: two_factor

    - domain: 'sabnzbd.<mydomain.com>'
      policy: two_factor

    - domain: 'qbittorrent.<mydomain.com>'
      policy: two_factor

    - domain: 'stash.<mydomain.com>'
      policy: two_factor

    - domain: 'outline.<mydomain.com>'
      policy: two_factor

    - domain: 'cloud.<mydomain.com>'
      policy: two_factor

    - domain: 'files.<mydomain.com>'
      policy: two_factor

    - domain: 'linkwarden.<mydomain.com>'
      policy: two_factor

    ## Domain Regex examples. Generally we recommend just using a standard domain.
    # - domain_regex: '^(?P<User>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^(?P<Group>\w+)\.example\.com$'
    #   policy: one_factor
    # - domain_regex:
    #    - '^appgroup-.*\.example\.com$'
    #    - '^appgroup2-.*\.example\.com$'
    #   policy: one_factor
    # - domain_regex: '^.*\.example\.com$'
    #   policy: two_factor

    #- domain: 'secure.example.com'
    #  policy: one_factor
    #  ## Network based rule, if not provided any network matches.
    #  networks:
    #    - internal
    #    - VPN
    #    - 192.168.1.0/24
    #    - 10.0.0.1

    #- domain:
    #    - 'secure.example.com'
    #    - 'private.example.com'
    #  policy: two_factor

    #- domain: 'singlefactor.example.com'
    #  policy: one_factor

    ## Rules applied to 'admins' group
    #- domain: 'mx2.mail.example.com'
    #  subject: 'group:admins'
    #  policy: deny

    #- domain: '*.example.com'
    #  subject:
    #    - 'group:admins'
    #    - 'group:moderators'
    #  policy: two_factor

    ## Rules applied to 'dev' group
    #- domain: 'dev.example.com'
    #  resources:
    #    - '^/groups/dev/.*$'
    #  subject: 'group:dev'
    #  policy: two_factor

    ## Rules applied to user 'john'
    #- domain: 'dev.example.com'
    #  resources:
    #    - '^/users/john/.*$'
    #  subject: 'user:john'
    #  policy: two_factor

    ## Rules applied to user 'harry'
    #- domain: 'dev.example.com'
    #  resources:
    #    - '^/users/harry/.*$'
    #  subject: 'user:harry'
    #  policy: two_factor

    ## Rules applied to user 'bob'
    #- domain: '*.mail.example.com'
    #  subject: 'user:bob'
    #  policy: two_factor
    #- domain: 'dev.example.com'
    #  resources:
    #    - '^/users/bob/.*$'
    #  subject: 'user:bob'
    #  policy: two_factor

##
## Session Provider Configuration
##
## The session cookies identify the user once logged in.
## The available providers are: `memory`, `redis`. Memory is the provider unless redis is defined.
session:
  ## The name of the session cookie.
  name: auth_session

  ## The domain to protect.
  ## Note: the authenticator must also be in that domain.
  ## If empty, the cookie is restricted to the subdomain of the issuer.
  domain: <mydomain.com>

  ## Sets the Cookie SameSite value. Possible options are none, lax, or strict.
  ## Please read https://www.authelia.com/c/session#same_site
  same_site: lax

  ## The secret to encrypt the session data. This is only used with Redis / Redis Sentinel.
  ## Secret can also be set using a secret: https://www.authelia.com/c/secrets
  secret: <mysecret>

  ## The value for expiration, inactivity, and remember_me_duration are in seconds or the duration notation format.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ## All three of these values affect the cookie/session validity period. Longer periods are considered less secure
  ## because a stolen cookie will last longer giving attackers more time to spy or attack.

  ## The time before the cookie expires and the session is destroyed if remember me IS NOT selected.
  expiration: 72h

  ## The inactivity time before the session is reset. If expiration is set to 1h, and this is set to 5m, if the user
  ## does not select the remember me option their session will get destroyed after 1h, or after 5m since the last time
  ## Authelia detected user activity.
  inactivity: 72h

  ## The time before the cookie expires and the session is destroyed if remember me IS selected.
  ## Value of -1 disables remember me.
  remember_me_duration: 168h

  ##
  ## Redis Provider
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  redis:
    host: authelia_redis
    port: 6379
    ## Use a unix socket instead
    # host: /var/run/redis/redis.sock

    ## Username used for redis authentication. This is optional and a new feature in redis 6.0.
    # username: authelia

    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
    password: <myRedisPw>

    ## This is the Redis DB Index https://redis.io/commands/select (sometimes referred to as database number, DB, etc).
    database_index: 0

    ## The maximum number of concurrent active connections to Redis.
    maximum_active_connections: 8

    ## The target number of idle connections to have open ready for work. Useful when opening connections is slow.
    minimum_idle_connections: 0

    ## The Redis TLS configuration. If defined will require a TLS connection to the Redis instance(s).
    # tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      # server_name: myredis.example.com

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      # skip_verify: false

      ## Minimum TLS version for the connection.
      # minimum_version: TLS1.2

    ## The Redis HA configuration options.
    ## This provides specific options to Redis Sentinel, sentinel_name must be defined (Master Name).
    # high_availability:
      ## Sentinel Name / Master Name.
      # sentinel_name: mysentinel

      ## Specific username for Redis Sentinel. The node username and password is configured above.
      # sentinel_username: sentinel_specific_user

      ## Specific password for Redis Sentinel. The node username and password is configured above.
      # sentinel_password: sentinel_specific_pass

      ## The additional nodes to pre-seed the redis provider with (for sentinel).
      ## If the host in the above section is defined, it will be combined with this list to connect to sentinel.
      ## For high availability to be used you must have either defined; the host above or at least one node below.
      # nodes:
      #   - host: sentinel-node1
      #     port: 6379
      #   - host: sentinel-node2
      #     port: 6379

      ## Choose the host with the lowest latency.
      # route_by_latency: false

      ## Choose the host randomly.
      # route_randomly: false

##
## Regulation Configuration
##
## This mechanism prevents attackers from brute forcing the first factor. It bans the user if too many attempts are made
## in a short period of time.
regulation:
  ## The number of failed login attempts before user is banned. Set it to 0 to disable regulation.
  max_retries: 3

  ## The time range during which the user can attempt login before being banned. The user is banned if the
  ## authentication failed 'max_retries' times in a 'find_time' seconds window. Find Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  find_time: 10m

  ## The length of time before a banned user can login again. Ban Time accepts duration notation.
  ## See: https://www.authelia.com/c/common#duration-notation-format
  ban_time: 365d

##
## Storage Provider Configuration
##
## The available providers are: `local`, `mysql`, `postgres`. You must use one and only one of these providers.
storage:
  ## The encryption key that is used to encrypt sensitive information in the database. Must be a string with a minimum
  ## length of 20. Please see the docs if you configure this with an undesirable key and need to change it.
  encryption_key: <myEncryptionKey>

  ##
  ## Local (Storage Provider)
  ##
  ## This stores the data in a SQLite3 Database.
  ## This is only recommended for lightweight non-stateful installations.
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  # local:
  #   path: /config/db.sqlite3

  ##
  ## MySQL / MariaDB (Storage Provider)
  ##
  #mysql:
  #  host: mariadb
  #  port: 3306
  #  database: authelia
  #  username: authelia
    ## Password can also be set using a secret: https://www.authelia.com/c/secrets
  #  password: 
  #  timeout: 5s

  ##
  ## PostgreSQL (Storage Provider)
  ##
  postgres:
    host: authelia_postgres
    port: 5432
    database: authelia
    schema: public
    username: authelia
  #   ## Password can also be set using a secret: https://www.authelia.com/c/secrets
    password: <myPostgresPassword>
    timeout: 5s
    ssl:
      mode: disable
      root_certificate: disable
      certificate: disable
      key: disable

##
## Notification Provider
##
## Notifications are sent to users when they require a password reset, a Webauthn registration or a TOTP registration.
## The available providers are: filesystem, smtp. You must use only one of these providers.
notifier:
  ## You can disable the notifier startup check by setting this to true.
  disable_startup_check: false

  ##
  ## File System (Notification Provider)
  ##
  ## Important: Kubernetes (or HA) users must read https://www.authelia.com/t/statelessness
  ##
  #filesystem:
    #filename: /config/notification.txt

  ##
  ## SMTP (Notification Provider)
  ##
  ## Use a SMTP server for sending notifications. Authelia uses the PLAIN or LOGIN methods to authenticate.
  ## [Security] By default Authelia will:
  ##   - force all SMTP connections over TLS including unauthenticated connections
  ##      - use the disable_require_tls boolean value to disable this requirement
  ##        (only works for unauthenticated connections)
  ##   - validate the SMTP server x509 certificate during the TLS handshake against the hosts trusted certificates
  ##     (configure in tls section)
  smtp:
    ## The SMTP host to connect to.
    host: mail.<mydomain.com>

    ## The port to connect to the SMTP host on.
    port: 465

    ## The connection timeout.
    timeout: 10s

    ## The username used for SMTP authentication.
    username: authelia@<mydomain.com>

    ## The password used for SMTP authentication.
    ## Can also be set using a secret: https://www.authelia.com/c/secrets
    password: <mySMTPPassword>

    ## The sender is used to is used for the MAIL FROM command and the FROM header.
    ## If this is not defined and the username is an email, we use the username as this value. This can either be just
    ## an email address or the RFC5322 'Name <email address>' format.
    sender: authelia <authelia@<mydomain.com>>

    ## HELO/EHLO Identifier. Some SMTP Servers may reject the default of localhost.
    identifier: <mydomain.com>

    ## Subject configuration of the emails sent. {title} is replaced by the text from the notifier.
    subject: "[Authelia] {title}"

    ## This address is used during the startup check to verify the email configuration is correct.
    ## It's not important what it is except if your email server only allows local delivery.
    startup_check_address: <myemail>

    ## By default we require some form of TLS. This disables this check though is not advised.
 #   disable_require_tls: false

    ## Disables sending HTML formatted emails.
    disable_html_emails: true

    tls:
      ## Server Name for certificate validation (in case you are using the IP or non-FQDN in the host option).
      server_name: mail.<mydomain.com>

      ## Skip verifying the server certificate (to allow a self-signed certificate).
      ## In preference to setting this we strongly recommend you add the public portion of the certificate to the
      ## certificates directory which is defined by the `certificates_directory` option at the top of the config.
      skip_verify: false

      ## Minimum TLS version for either StartTLS or SMTPS.
      minimum_version: TLS1.2

##
## Identity Providers
##
identity_providers:
  ##
  ## OpenID Connect (Identity Provider)
  ##
  ## It's recommended you read the documentation before configuration of this section:
  ## https://www.authelia.com/c/oidc
  oidc:
    ## The hmac_secret is used to sign OAuth2 tokens (authorization code, access tokens and refresh tokens).
    ## HMAC Secret can also be set using a secret: https://www.authelia.com/c/secrets
    hmac_secret: <myHMACSecret>

    ## The issuer_private_key is used to sign the JWT forged by OpenID Connect.
    ## Issuer Private Key can also be set using a secret: https://www.authelia.com/c/secrets
    issuer_private_key: |
      -----BEGIN RSA PRIVATE KEY-----
      <myRSAPrivateKey>
      -----END RSA PRIVATE KEY-----

    ## The lifespans configure the expiration for these token types.
    access_token_lifespan: 1h
    authorize_code_lifespan: 1m
    id_token_lifespan: 1h
    refresh_token_lifespan: 90m

    ## Enables additional debug messages.
    # enable_client_debug_messages: false

    ## SECURITY NOTICE: It's not recommended changing this option and values below 8 are strongly discouraged.
    # minimum_parameter_entropy: 8

    ## SECURITY NOTICE: It's not recommended changing this option, and highly discouraged to have it set to 'never'
    ## for security reasons.
    # enforce_pkce: public_clients_only

    ## Cross-Origin Resource Sharing (CORS) settings.
    cors:
      ## List of endpoints in addition to the metadata endpoints to permit cross-origin requests on.
      endpoints:
         - authorization
         - token
         - revocation
         - introspection
         - userinfo

      ## List of allowed origins.
      ## Any origin with https is permitted unless this option is configured or the
      ## allowed_origins_from_client_redirect_uris option is enabled.
      # allowed_origins:
      #   - https://example.com

      ## Automatically adds the origin portion of all redirect URI's on all clients to the list of allowed_origins,
      ## provided they have the scheme http or https and do not have the hostname of localhost.
      # allowed_origins_from_client_redirect_uris: false

    ## Clients is a list of known clients and their configuration.
    clients:
      - id: nextcloud.<mydomain.com>
        description: NextCloud
        secret: <mySecret>
        public: false
        authorization_policy: two_factor
        redirect_uris:
          - https://nextcloud.<mydomain.com>/index.php/apps/sociallogin/custom_oidc/authelia
          - https://nextcloud.<mydomain.com>/apps/sociallogin/custom_oidc/authelia
        scopes:
          - openid
          - profile
          - email
          - groups
        userinfo_signing_algorithm: none
      - id: grafana.<mydomain.com>
        secret: <mySecret>
        public: false
        authorization_policy: two_factor
        scopes:
          - openid
          - profile
          - groups
          - email
        redirect_uris:
          - https://grafana.<mydomain.com>/login/generic_oauth
        userinfo_signing_algorithm: none
      - id: git.<mydomain.com>
        secret: <mySecret>
        public: false
        authorization_policy: two_factor
        scopes:
          - openid
          - email
          - profile
        redirect_uris:
          - https://git.<mydomain.com>/user/oauth2/authelia/callback
        userinfo_signing_algorithm: none
      - id: outline.<mydomain.com>
        secret: <mySecret>
        public: false
        authorization_policy: two_factor
        scopes:
          - openid
          - offline_access
          - email
          - profile
        redirect_uris:
          - https://outline.<mydomain.com>/auth/oidc.callback
        userinfo_signing_algorithm: none
      - id: linkwarden.<mydomain.com>
        secret: <mySecret>
        public: false
        authorization_policy: two_factor
        scopes:
          - openid
          - offline_access
          - email
          - profile
        redirect_uris:
          - https://linkwarden.<mydomain.com>/
        userinfo_signing_algorithm: none

Build Information

I don't have that info since i downgraded Authelia but i was using the latest tag which should be version 4.38.1. The digest i saw in Watchtower logs is 61543a0fb33d.

Logs (Authelia)

{"level":"info","msg":"Listening for non-TLS connections on '[::]:9091' path '/' and '/auth'","server":"main","service":"server","time":"2024-03-15T10:03:15+01:00"}
{"level":"error","method":"POST","msg":"Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method. The registered client with id 'outline.netcat.rocks' only supports 'token_endpoint_client_auth_method' method 'client_secret_basic'.","path":"/api/oidc/token","remote_ip":"192.168.99.1","stack":[{"File":"github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go","Line":25,"Name":"OpenIDConnectTokenPOST"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go","Line":114,"Name":"handleRouter.NewHTTPToAutheliaHandlerAdaptor.func25"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/bridge.go","Line":54,"Name":"handleRouter.(*BridgeBuilder).Build.func16.1"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/headers.go","Line":82,"Name":"SecurityHeadersNoStore.func1"},{"File":"github.com/valyala/fasthttp@v1.52.0/userdata.go","Line":57,"Name":"(*userData).Get"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/headers.go","Line":12,"Name":"SecurityHeaders.func1"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/cors.go","Line":216,"Name":"handleRouter.(*CORSPolicy).Middleware.func26"},{"File":"github.com/fasthttp/router@v1.5.0/router.go","Line":441,"Name":"(*Router).Handler"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/log_request.go","Line":14,"Name":"handleRouter.LogRequest.func40"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/strip_path.go","Line":22,"Name":"handleRouter.StripPath.func41.1"},{"File":"github.com/authelia/authelia/v4/internal/middlewares/errors.go","Line":38,"Name":"RecoverPanic.func1"},{"File":"github.com/valyala/fasthttp@v1.52.0/server.go","Line":2374,"Name":"(*Server).serveConn"},{"File":"github.com/valyala/fasthttp@v1.52.0/workerpool.go","Line":224,"Name":"(*workerPool).workerFunc"},{"File":"github.com/valyala/fasthttp@v1.52.0/workerpool.go","Line":196,"Name":"(*workerPool).getCh.func1"},{"File":"runtime/asm_amd64.s","Line":1695,"Name":"goexit"}],"time":"2024-03-15T10:04:19+01:00"}
{"error":"read tcp 172.19.0.16:9091-\u003e172.19.0.24:50472: i/o timeout","level":"error","method":"GET","msg":"Request timeout occurred while handling request from client.","path":"/","remote_ip":"172.19.0.24","stack":[{"File":"github.com/authelia/authelia/v4/internal/server/handlers.go","Line":73,"Name":"CreateDefaultServer.handleError.func2"},{"File":"github.com/valyala/fasthttp@v1.52.0/server.go","Line":2865,"Name":"(*Server).writeErrorResponse"},{"File":"github.com/valyala/fasthttp@v1.52.0/server.go","Line":2303,"Name":"(*Server).serveConn"},{"File":"github.com/valyala/fasthttp@v1.52.0/workerpool.go","Line":224,"Name":"(*workerPool).workerFunc"},{"File":"github.com/valyala/fasthttp@v1.52.0/workerpool.go","Line":196,"Name":"(*workerPool).getCh.func1"},{"File":"runtime/asm_amd64.s","Line":1695,"Name":"goexit"}],"status_code":408,"time":"2024-03-15T10:08:46+01:00"}

Logs (Proxy / Application)

ERR ts=1710493707.226478 logger=http.log.error msg=dial tcp 172.19.0.27:5000: connect: connection refused request={"remote_ip":"192.168.99.1","remote_port":"51526","client_ip":"192.168.99.1","proto":"HTTP/2.0","method":"GET","host":"outline.<mydomain.com>","uri":"/","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"],"Sec-Fetch-Mode":["navigate"],"Accept-Language":["en-US,en;q=0.9"],"Dnt":["1"],"Sec-Purpose":["prefetch;prerender"],"Sec-Fetch-User":["?1"],"Accept-Encoding":["gzip, deflate, br"],"Purpose":["prefetch"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Sec-Fetch-Site":["none"],"Sec-Fetch-Dest":["document"],"Sec-Ch-Ua":["\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\""],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Ch-Ua-Platform":["\"Linux\""],"Upgrade-Insecure-Requests":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"outline.<mydomain.com>"}} duration=0.002292299 status=502 err_id=fnscbfhjz err_trace=reverseproxy.statusError (reverseproxy.go:1267)
ERR ts=1710493707.4004743 logger=http.log.error msg=dial tcp 172.19.0.27:5000: connect: connection refused request={"remote_ip":"192.168.99.1","remote_port":"51526","client_ip":"192.168.99.1","proto":"HTTP/2.0","method":"GET","host":"outline.<mydomain.com>","uri":"/","headers":{"Sec-Ch-Ua-Mobile":["?0"],"Accept-Encoding":["gzip, deflate, br"],"Sec-Ch-Ua-Platform":["\"Linux\""],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Dest":["document"],"Sec-Ch-Ua":["\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\""],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Accept-Language":["en-US,en;q=0.9"],"Dnt":["1"],"Upgrade-Insecure-Requests":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"outline.<mydomain.com>"}} duration=0.001385471 status=502 err_id=t7adyvg90 err_trace=reverseproxy.statusError (reverseproxy.go:1267)
ERR ts=1710493708.6502073 logger=http.log.error msg=dial tcp 172.19.0.27:5000: connect: connection refused request={"remote_ip":"192.168.99.1","remote_port":"51526","client_ip":"192.168.99.1","proto":"HTTP/2.0","method":"GET","host":"outline.<mydomain.com>","uri":"/","headers":{"Accept-Encoding":["gzip, deflate, br"],"Sec-Ch-Ua":["\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\""],"Upgrade-Insecure-Requests":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Sec-Ch-Ua-Mobile":["?0"],"Dnt":["1"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-Dest":["document"],"Accept-Language":["en-US,en;q=0.9"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"],"Cache-Control":["max-age=0"],"Sec-Ch-Ua-Platform":["\"Linux\""]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"outline.<mydomain.com>"}} duration=0.001638267 status=502 err_id=z076v0qtn err_trace=reverseproxy.statusError (reverseproxy.go:1267)
ERR ts=1710493714.9283638 logger=http.log.error msg=dial tcp 172.19.0.27:5000: connect: connection refused request={"remote_ip":"192.168.99.1","remote_port":"51526","client_ip":"192.168.99.1","proto":"HTTP/2.0","method":"GET","host":"outline.<mydomain.com>","uri":"/","headers":{"Sec-Ch-Ua-Platform":["\"Linux\""],"Dnt":["1"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Ch-Ua":["\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\""],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Cache-Control":["max-age=0"],"Sec-Fetch-Dest":["document"],"Accept-Encoding":["gzip, deflate, br"],"Upgrade-Insecure-Requests":["1"],"Sec-Fetch-Site":["none"],"Sec-Fetch-User":["?1"],"Accept-Language":["en-US,en;q=0.9"],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"outline.<mydomain.com>"}} duration=0.00160076 status=502 err_id=8q9pqzije err_trace=reverseproxy.statusError (reverseproxy.go:1267)
ERR ts=1710493715.4856813 logger=http.log.error msg=dial tcp 172.19.0.27:5000: connect: connection refused request={"remote_ip":"192.168.99.1","remote_port":"51526","client_ip":"192.168.99.1","proto":"HTTP/2.0","method":"GET","host":"outline.<mydomain.com>","uri":"/","headers":{"Cache-Control":["max-age=0"],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Ch-Ua-Platform":["\"Linux\""],"User-Agent":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"],"Sec-Fetch-Site":["none"],"Sec-Fetch-Mode":["navigate"],"Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Accept-Encoding":["gzip, deflate, br"],"Dnt":["1"],"Upgrade-Insecure-Requests":["1"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua":["\"Chromium\";v=\"121\", \"Not A(Brand\";v=\"99\""],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/jxl,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"outline.<mydomain.com>"}} duration=0.001513712 status=502 err_id=pjycde2ji err_trace=reverseproxy.statusError (reverseproxy.go:1267)

Documentation

No response

Pre-Submission Checklist

• I agree to follow the Code of Conduct

• This is a bug report and not a support request

• I have read the security policy and this bug report is not a security issue or security related issue

• I have either included the complete configuration file or I am sure it's unrelated to the configuration

• I have either included the complete debug / trace logs or the output of the build-info command if the logs are not relevant

• I have provided all of the required information in full with the only alteration being reasonable sanitization in accordance with the Troubleshooting Sanitization reference guide

• I have checked for related proxy or application logs and included them if available

• I have checked for related issues and checked the documentation

[glime-ai]

Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it.

---

Based on the error message you provided from Outline, it seems like the issue is related to the method Authelia is using for client authentication with the OpenID Connect token endpoint. The error indicates that the request was using the client_secret_post method, but the OAuth 2.0 client (in this case, Outline) does not support this method and expects client_secret_basic instead.

This issue appears to be a compatibility problem between the version of Authelia you upgraded to (4.38.1) and your Outline server. In version 4.38.0, this issue was not present, suggesting that a change in Authelia's handling of client authentication methods in the newer version might be causing this problem.

To resolve this issue, you have a few options:

1. Continue using Authelia 4.38.0: Since you mentioned that version 4.38.0 works without issues, staying on this version temporarily is a viable workaround until a fix or configuration option is available in a newer version of Authelia that allows specifying the client authentication method.

2. Check Authelia's Release Notes and Documentation: Look for any changes mentioned in the release notes of Authelia version 4.38.1 related to OpenID Connect or client authentication methods. There might be new configuration options introduced that allow you to specify the client authentication method expected by Outline.

3. Contact Authelia Support or Community: Since this seems to be a version-specific issue, reaching out to Authelia's support channels or community forums might provide more insights or workarounds. Other users might have faced similar issues, or the developers might be aware of this compatibility problem.

4. Monitor Authelia's GitHub Issues: Keep an eye on Authelia's GitHub issues page for any reported issues related to this problem. If it's a known issue, there might be ongoing discussions or fixes planned for future releases.

Unfortunately, without access to Authelia's source code changes between versions 4.38.0 and 4.38.1, it's challenging to pinpoint the exact cause or suggest a direct fix. However, the steps mentioned above should help in finding a resolution or workaround.

This comment was generated by Glime.

[james-d-elliott]

Per the release notes which link to the blog post you'll need to set the token_endpoint_auth_method for the client. This is a duplicate of #6860

[Mag1cByt3s]

Which value do I need to set for Outline?
It is not mentioned here: https://www.authelia.com/integration/openid-connect/outline/

[james-d-elliott]

The one logged in the message as being used by the client client_secret_post. I'll make sure to update the community doc unless you'd like to.

[Mag1cByt3s]

So I just have to replace secret with client_secret_post ?

[james-d-elliott]

You need to set this value: https://www.authelia.com/configuration/identity-providers/openid-connect/clients/#token_endpoint_auth_method

[james-d-elliott]

i.e.:

identity_providers:
  oidc:
    clients:
    - client_id: outline
      token_endpoint_auth_method: 'client_secret_post'

[n-connect]

@james-d-elliott

From #6860 the promised key parts, what should be fixed in my opinion connected to the new default 'client_secret_basic'. Luckily it just fixing misleading wording/text of log message, not actual code:

"
Let me show you breaking down the log message, what it says for me (and perhaps to others too):

time="2024-03-14T21:19:55+01:00" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). -> true no question

The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', -> that's true again, but only confirmed to me after the what fix worked
however the OAuth 2.0 client does not support this method. -> based on the actual fix for the problem is to put into the Authelia config this token_endpoint_auth_method: client_secret_post`` it must a wrong statement. Also it is not clear what OAuth 2.0 client the error message talks about.Is it Authelia's own one or the external webapplication? Anyway the actual fix negates this statement in both cases (fixme if I'm wrong). The registered client with id 'appname' only supports 'token_endpoint_client_auth_method' method 'client_secret_basic'.` -> The biggest final false part. This was the first I tried with an explicit config line, wrote in my previous post.

In short, this log message is a twisted catch of 22. If the new default is the basic token which you should not specify at all in the config and my [client]id:_ is support only the very same basic, why is there an error at all. And how is my client has sent a post? Which is not supported by the Oauth 2.0 client anyway :D
"

[james-d-elliott]

Sorry I don't understand, Please show a complete log message and the associated registered client.

[n-connect]

No problem. Very short version:

• new default with basic, understood
• fix could be to a line with OIDC client_id in question as token_endpoint_auth_method: 'client_secret_post', although from Latest update broke ownCloud Ocis and Outline #6904 it seems there are additional problems with it depending on the client (OCIS tries multiple auth method in one request?)
• for my raised issue and for this one the error message itself needs a change in the code, because it states wrong things -> People goes wrong direction looking for fixes unnecessary issues will be raised. Fixing the log message and put it into the documentation could fix it in the long run.

I did copy /paste the config and log here but somehow they not parsed correctly using code insert(Firefox - Linux), please see them in #6860 in their original form. Logically they are the same as @Mag1cByt3s posted his/her ones here in this issue.

Config:
authorization_policies: appname_policy: default_policy: 'two_factor' rules: - policy: 'deny' subject: 'group:appdeny_au' - policy: 'two_factor' subject: 'group:appallow_au' clients: - id: appname description: AppName SSO secret: '$plaintext$asdassdassdasdASDASDASDASDDASD' public: false authorization_policy: appname_policy audience: [] scopes: - openid - email - profile redirect_uris: - https://appname.example.com/auth/oauth2/callback grant_types: - refresh_token - authorization_code response_types: - code response_modes: - form_post - query - fragment userinfo_signing_algorithm: none

The log line in question is the last line starting with time:

`time="2024-03-14T15:47:08+01:00" level=debug msg="Authorization Request with id '0799233d-1ddb-468e-8de3-6ff887ea97ff' on client with id 'appname' is being processed" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:08+01:00" level=debug msg="Authorization Request with id '0799233d-1ddb-468e-8de3-6ff887ea97ff' on client with id 'appname' using consent mode 'explicit' proceeding to generate a new consent session" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:08+01:00" level=debug msg="Authorization Request with id '0799233d-1ddb-468e-8de3-6ff887ea97ff' on client with id 'appname' using consent mode 'explicit' authentication level 'one_factor' is insufficient for client level 'two_factor'" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:08+01:00" level=debug msg="Authorization Request with id '0799233d-1ddb-468e-8de3-6ff887ea97ff' on client with id 'appname' using consent mode 'explicit' is being redirected to 'https://auth.example.com/?workflow=openid_connect&workflow_id=2488e35f-4cb9-488f-96d8-aeb7aeb559e8'" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:20+01:00" level=debug msg="Mark TOTP authentication attempt made by user 'attis'" method=POST path=/api/secondfactor/totp remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:20+01:00" level=debug msg="Successful TOTP authentication attempt made by user 'attis'" method=POST path=/api/secondfactor/totp remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:21+01:00" level=debug msg="Authorization Request with id '203f8d72-c9d5-4219-82bc-a2490ffcb9ee' on client with id 'appname' is being processed" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:21+01:00" level=debug msg="Authorization Request with id '203f8d72-c9d5-4219-82bc-a2490ffcb9ee' on client with id 'appname' using consent mode 'explicit' authentication level 'two_factor' is sufficient for client level 'two_factor'" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:21+01:00" level=debug msg="Authorization Request with id '203f8d72-c9d5-4219-82bc-a2490ffcb9ee' on client with id 'appname' using consent mode 'explicit' is being redirected to 'https://auth.example.com/consent?id=2488e35f-4cb9-488f-96d8-aeb7aeb559e8'" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:24+01:00" level=debug msg="Authorization Request with id 'ead55c3d-f4aa-467f-aad5-5b52048666c7' on client with id 'appname' is being processed" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:24+01:00" level=debug msg="Authorization Request with id 'ead55c3d-f4aa-467f-aad5-5b52048666c7' on client with id 'appname' was successfully processed, proceeding to build Authorization Response" method=GET path=/api/oidc/authorization remote_ip=xx.xxx.xx.xxx
time="2024-03-14T15:47:24+01:00" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method. The registered client with id 'appname' only supports 'token_endpoint_client_auth_method' method 'client_secret_basic'." method=POST path=/api/oidc/token remote_ip=xxx.xxx.xx.xx

stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go:25
OpenIDConnectTokenPOST\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:114 handleRouter.NewHTTPToAutheliaHandlerAdaptor.func25\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54
handleRouter.(*BridgeBuilder).Build.func16.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:82
SecurityHeadersNoStore.func1\ngithub.com/valyala/fasthttp@v1.52.0/userdata.go:5
(*userData).Get\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:12
SecurityHeaders.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216
handleRouter.(*CORSPolicy).Middleware.func26\ngithub.com/fasthttp/router@v1.5.0/router.go:441
(*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14
handleRouter.LogRequest.func40\ngithub.com/authelia/authelia/v4/internal/middlewares/errors.go:38
RecoverPanic.func1\ngithub.com/valyala/fasthttp@v1.52.0/server.go:2374
(*Server).serveConn\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:224
(*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:196
(*workerPool).getCh.func1\nruntime/asm_amd64.s:1695
goexit"`

[james-d-elliott]

fix could be to a line with OIDC client_id in question as token_endpoint_auth_method: 'client_secret_post', although from #6904 it seems there are additional problems with it depending on the client (OCIS tries multiple auth method in one request?)

Yeah, there is a bug with the client, not Authelia.

level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method. The registered client with id 'appname' only supports 'token_endpoint_client_auth_method' method 'client_secret_basic'." method=POST path=/api/oidc/token remote_ip=xxx.xxx.xx.xx

Yep, without the registered client having a value the default method the authorization server should expect (see point 3) is client_secret_basic (i.e. in header, see point 2), but they're using client_secret_post (i.e. in form body, see point 1).

1. The request was determined to be using 'token_endpoint_client_auth_method' method 'client_secret_post', however the OAuth 2.0 client does not support this method..
2. The registered client with id 'appname' only supports 'token_endpoint_client_auth_method' method 'client_secret_basic'.
3. From the specifications which we have every intention to be compliant with:

token_endpoint_auth_method

OPTIONAL. Requested Client Authentication method for the Token Endpoint. The options are client_secret_post,
client_secret_basic, client_secret_jwt, private_key_jwt, and none, as described in Section 9 of [OpenID Connect Core 1.0]
(https://openid.net/specs/openid-connect-registration-1_0.html#OpenID.Core) [OpenID.Core]. Other authentication
methods MAY be defined by extensions. If omitted, the default is client_secret_basic -- the HTTP Basic Authentication
Scheme specified in Section 2.3.1 of OAuth 2.0
[RFC6749].

for my raised issue and for this one the error message itself needs a change in the code, because it states wrong things -> People goes wrong direction looking for fixes unnecessary issues will be raised. Fixing the log message and

You'll have to be very clear about what's unclear about the log message and how you think it'll be fixed. Thus far I'm not understanding what's unclear about it.

put it into the documentation could fix it in the long run.

See the documentation on the configuration, the blog post , and the Outline OpenID Connect 1.0 Integration Documentation.

[n-connect]

Okay we are getting there.
Its not about if the registered client is doing it well or not - since the applied new default as per as per oid specs its not, I'm with you from the beginning.
However that is why it turns into a breaking change from the point of view of Authelia users at the same time. Also I agree with you its not an Authelia code level bug. Best case scenario its just a wrong error message can be simply re-worded, plus documented well for Authelia users (those IT people who are on the level putting together SSO in their network landscape). So end of the day they'll try out client_secret_post and if that not helps they'll contact the registered client's support/code maintainers.

Your points shows the contractions of the message parts:

1. If QAuth 2.0 client does not support the ˙client_secret_post˙, how is it come that the fix is tell it to Authelia to use it for a registered client?
2. If the registered client only supports client_secret_basic, how come specifying client_secret_post for the very same registered client makes the error goes away?
3. A third one, if the registered client only supports 'client_secret_basic' and the new default is the very same, why do we got the whole error message at all? Here could be a code level bug too, if its determined.

Let me put here the modified log message parts, which would be good in my opinion:

The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client is _not_ configured to send it like that, but using the default: client_secret_basic. Therefore OICD provider can't accept it

The registered client with id 'appname' possibly _not_ supports the default 'token_endpoint_client_auth_method' method 'client_secret_basic', please configure it with 'client_secret_post'.

Please note I've replaced token_endpoint_client_auth_method with token_endpoint_auth_method as well because that is the name of the configuration item in Authelia config.

[james-d-elliott]

However that is why it turns into a breaking change from the point of view of Authelia users at the same time. Also I agree with you its not an Authelia code level bug. Best case scenario its just a wrong error message can be simply re-worded, plus documented well for Authelia users (those IT people who are on the level putting together SSO in their network landscape). So end of the day they'll try out client_secret_post and if that not helps they'll contact the registered client's support/code maintainers.

I'm sorry but OpenID Connect 1.0 is in beta, and there may be the occasional change like this, this has effectively been the only one to date. We included the important change in the release notes, We are nearing the end of the beta but we reasonably have to be able to comply with the spec where possible, if we have to introduce another major version every time we find an issue with our spec compliance that's going to become rather annoying. After it's stable we can introduce stability guarantees.

If QAuth 2.0 client does not support the ˙client_secret_post˙, how is it come that the fix is tell it to Authelia to use it for a registered client?

Per the spec if the client is NOT registered with a method it supports client_secret_basic. The authorization server supporting multiple methods does not mean the registered client does. It can only support 1 method at a time. Just because you can configure the registered client to support another authentication mechanism doesn't mean it currently supports it.

A third one, if the registered client only supports 'client_secret_basic' and the new default is the very same, why do we got the whole error message at all? Here could be a code level bug too, if its determined.

Do not understand this I'm sorry.

Please note I've replaced token_endpoint_client_auth_method with token_endpoint_auth_method as well because that is the name of the configuration item in Authelia config.

This is already the case in the latest version. It came originally from the upstream library which I've already fixed.

[n-connect]

I got you, hard to keep up everywhere. I'm happy to contribute, anywhere I'm capable. This time I failed to find the source lines related to the log message. Based on your answer it is - at least in part - in an upstream library. Please point me in a direction. I'm late in the game, started to use Authelia 10 days ago, put together a working one with RBAC a week or so (I hate YAML configs that's for sure :) )

Changing the error message like my example can improve the invested time related to the new default around client_secret_basic. Also marking such breaking change as breaking change in release and in general documentation can help people in planing upgrades accordingly. That's all.

Thank you for all the good code

[james-d-elliott]

Also marking such breaking change as breaking change in release and in general documentation can help people in planing upgrades accordingly. That's all.

This is semantics I believe. Would users have read and understood it if it was noted as a breaking change if they didn't bother to read it to begin with? I can try it in the future, pretty sure there will still be complaints.

The first line of the release notes reads:

It's important users check the Release Notes on the Blog as there are potential necessary changes with experimental/beta features.

Changing the error message like my example can improve the invested time related to the new default around client_secret_basic.

I'm not satisfied the wording is better or that you're looking at the most recent wording, that's probably the first place to start. I think that since this is a wording issue then it quite clearly belongs in a discussion, as it's not really a bug.

I have hard forked the library however to solve this and various other issues. See here.

[n-connect]

No need for discussion at all
I've checked the new/modified error messages in the code of client_authentication.go #145 from Authelia's oauth2-provider -> its perfect as it is, better than my suggestion. Also checked it with live logs, temporarily removing the fixer proper config line - same messsage coming out via v4.38.2 already.

Thank you!

@Mag1cByt3s I think you can close this issue yourself if you like

[james-d-elliott]

I've long closed it.

[n-connect]

I was clearly lagging behind, sorry.
Checked the connecting PR 59 for it, it's already merged after midnight early morning today (GMT+1).
Thanks again.