Proxmox Authentication over openID doesn't work anymore

[hackmybeer]

Hey,
Like described in this proxmox forum post, proxmox authentication over openID isn't working anymore.
Could please somebody look into this?

Thanks in advance (:

Kind Regards
Maris

[fwollny]

@hackmybeer
Can you post the syslog of proxmox while trying to log invia oauth?

[Maximilian-Staab]

I'm having the same issue. It also looks like the documentation is somewhat out of date: https://goauthentik.io/integrations/services/proxmox-ve/
It said to set the JWT Algorithm to RS256, but this setting isn't visible for me. When I check the openid-configuration, this is what I get (note the lack of RS256):

openid-configuration

{
  "issuer": "https://<deleted>/application/o/proxmox/",
  "authorization_endpoint": "https://<deleted>/application/o/authorize/",
  "token_endpoint": "https://<deleted>/application/o/token/",
  "userinfo_endpoint": "https://<deleted>/application/o/userinfo/",
  "end_session_endpoint": "https://<deleted>/if/session-end/proxmox/",
  "introspection_endpoint": "https://<deleted>/application/o/introspect/",
  "response_types_supported": [
    "code",
    "id_token",
    "id_token token",
    "code token",
    "code id_token",
    "code id_token token"
  ],
  "jwks_uri": "https://<deleted>/application/o/proxmox/jwks/",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "implicit",
    "client_credentials"
  ],
  "id_token_signing_alg_values_supported": [
    "HS256"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "acr_values_supported": [
    "goauthentik.io/providers/oauth2/default"
  ],
  "scopes_supported": [
    "openid",
    "email",
    "profile"
  ],
  "request_parameter_supported": false,
  "claims_supported": [
    "sub"
  ],
  "claims_parameter_supported": false
}

EDIT: @hackmybeer I just added the self-signed certificate as Signing Key for the proxmox provider, now it works! Did you try that as well?

[hackmybeer]

Sorry for my inactivity. Thanks for all you replies! I’m going to test it later this day.
Thank you so much (:

[hackmybeer]

@Maximilian-Staab i think i did. I've added my config here...

[Maximilian-Staab]

Does is work for you? My setup is slightly different: I've kept my launch URL empty and I don't have a trailing slash in the redirect URL.

[hackmybeer]

No, it doesn't work :/

Here is my Proxmox config:

And this is the error message I'm getting when trying to use authentik as my ID-Provider:

[BeryJu]

No, it doesn't work :/

Here is my Proxmox config:

And this is the error message I'm getting when trying to use authentik as my ID-Provider:

You are missing a leading slash on the issuer URL, with this URL it won't work since promox will append a path and get a wrong URL

[hackmybeer]

No, it doesn't work :/
Here is my Proxmox config:
And this is the error message I'm getting when trying to use authentik as my ID-Provider:

You are missing a leading slash on the issuer URL, with this URL it won't work since promox will append a path and get a wrong URL

Thanks for your quick reply. I added it and it sadly it still refuses to work...

[Maximilian-Staab]

Does the user you want to log in with exist? You need a <username>@authentik user, or you enable Autocreate Users in the OpenID config for proxmox. Also check your Issuer URL in the same config. I have a trailing slash, pretty sure that's what @BeryJu is referring to. See:

[hackmybeer]

I don‘t even get to the part where i can log in. I just get a error 500 from the proxmox api. I‘ve also added the trailing slash but it doesn‘t work either :/
Autocreate is also enabled.

[Maximilian-Staab]

Make sure you use a private window or delete cookies every time you change something. Other than that I'm all out of ideas.

[hackmybeer]

Thanks for the quick reply (:
In Authentik or Proxmox? To test the openID login I already use a private window :/
Hmm

[Maximilian-Staab]

The cookies for the domain your proxmox is responding from, so pve.<something>.intern. Also are you not using a proxy for your subdomain? I'm asking because of your use of a both specific subdomain and a non standard port. My setup is probably a bit different from yours, so I can't really show you my configs (I'm using authentik both for authentication and as my proxy).

I'm pretty sure that when the 'datacenter-path', eg. #v1:0:18:4:::::7:: was missing, my setup wasn't working as well. Maybe try adding that as the redirection URL.

Also we should probably move this to a private conversation. This isn't a bug report anymore. We could still update the documentation if we find out what's wrong with your config.

[hackmybeer]

Thanks, I agree with you.