Generic OIDC device auth

[eisenmann-b1]

Hello,

since support for generic OIDC providers was merged last month with #928, I wanted to try to use Himmelblau with Keycloak's device authentication grant. However, I cannot get it to work.

Is there some setting other than oidc_issuer_url that needs to be set?

Also, regarding the comment in src/common/src/idprovider/openidconnect.rs about public clients: Is using client_secret supported, e.g. via credentials?

Authentication test

$ sudo aad-tool auth-test -dD tester
2026-01-15T18:05:58.769318Z DEBUG aad_tool: Starting PAM auth tester tool ...
2026-01-15T18:05:58.769935Z DEBUG himmelblau_unix_common::client_sync: path=/var/run/himmelblaud/socket
2026-01-15T18:05:58.866152Z DEBUG himmelblau_unix_common::client_sync: Filled 81 bytes, complete
PAM_ABORT: Network outage detected. 
If you are now prompted for a password from pam_unix, please disregard the prompt, go back and try again.
2026-01-15T18:06:00.866468Z ERROR aad_tool: Authentication failed: PAM_ABORT

Authentication test logs

Jan 15 18:05:58 ubuntu himmelblaud[36508]: f961c2ad-15ac-41ec-a6a3-9a22e9e27cfe INFO     pam account begin session [ 21.5µs | 100.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a INFO     pam authenticate init [ 77.9ms | 0.54% / 100.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    ┝━ get_cachestate [ 1.45µs | 0.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    ┝━ get_cachestate [ 210ns | 0.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    ┝━ check_online [ 77.4ms | 0.04% / 99.35% ] now: SystemTime { tv_sec: 1768500358, tv_nsec: 770544877 }
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │  ┕━ attempt_online [ 77.4ms | 44.67% / 99.31% ] now: SystemTime { tv_sec: 1768500358, tv_nsec: 770544877 }
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     ┝━ delayed_init [ 42.6ms | 0.04% / 54.64% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │  ┝━ read [ 1.03µs | 0.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │  ┝━ tenant_id [ 7.55µs | 0.01% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a ERROR    │     │  │  ┕━ 🚨 [error]: Missing OIDC issuer URL in config
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a WARN     │     │  ┝━ 🚧 [warn]: No idmap_range range specified in config, using 200000-2000200000!
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │  ┕━ delayed_init [ 42.5ms | 54.58% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a ERROR    │     │     ┝━ 🚨 [error]: Missing OIDC client ID in config: `[global] app_id` required for OIDC auth
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a ERROR    │     │     ┝━ 🚨 [error]: Missing OIDC issuer URL in config
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │     ┝━ 🐛 [debug]: connecting to 10.0.0.100:8443
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │     ┝━ 🐛 [debug]: connected to 10.0.0.100:8443
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │     ┝━ 🐛 [debug]: pooling idle connection for ("https", keycloak:8443)
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │     ┝━ 🐛 [debug]: reuse idle connection for ("https", keycloak:8443)
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     │     ┕━ 🐛 [debug]: pooling idle connection for ("https", keycloak:8443)
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     ┝━ read [ 272ns | 0.00% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     ┝━ 🐛 [debug]: connecting to 10.0.0.100:8443
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     ┝━ 🐛 [debug]: connected to 10.0.0.100:8443
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    │     ┝━ 🐛 [debug]: pooling idle connection for ("https", keycloak:8443)
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a ERROR    │     ┕━ 🚨 [error]: Provider online failed: 400 Bad Request | authorization_endpoint: "https://keycloak:8443/realms/test-realm/protocol/openid-connect/auth"
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG    ┕━ unix_user_offline_auth_init [ 79.7µs | 0.00% / 0.10% ]
Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a DEBUG       ┕━ fetch_hello_key [ 76.4µs | 0.10% ]

/etc/himmelblau/himmelblau.conf

[global]
# These default options are required on Debian/Ubuntu. See `man himmelblau.conf`
# for an explanation of these parameters. `home_attr` and `home_alias` need to
# match, but don't necessarily need to be set to `CN`.
local_groups = users
home_attr = CN
home_alias = CN
use_etc_skel = true

domain = keycloak
oidc_issuer_url = https://keycloak:8443/realms/test-realm
app_id = test-client

enable_experimental_mfa = false
debug = true

[keycloak]
app_id = test-client
idmap_range = 50000-999999

[dmulder]

Is there some setting other than oidc_issuer_url that needs to be set?

You need to set both oidc_issuer_url and app_id.
Also, the domain option was also required, up until a couple days ago (I just removed this requirement).

This appears to be the problem:

Jan 15 18:05:58 ubuntu himmelblaud[36508]: 91b28de3-ea47-43ed-8128-00d6af1e613a ERROR    │     ┕━ 🚨 [error]: Provider online failed: 400 Bad Request | authorization_endpoint: "https://keycloak:8443/realms/test-realm/protocol/openid-connect/auth"

It looks like Himmelblau is falling into offline mode because that endpoint is responding with a 400 Bad Request. Can you share the XML supplied by https://keycloak:8443/realms/test-realm/.well-known/openid-configuration?

[dmulder]

Also this.

[dmulder]

All of this needs to be documented.

[dmulder]

I'm adding documentation for these requirements here: 2991deb
Let me know if you think it needs additional detail.

[eisenmann-b1]

Oh, that's interesting. That configuration is invalid, FYI. And now that I think about it, the failure makes sense. Defining a section called keycloak told Himmelblau that you had a domain name called keycloak, so it was validating that your user was named tester@keycloak, but the username in the response was just tester.

Domain sections were permitted prior to Himmelblau 2.x, but have been deprecated. We still parse them for backwards compatibility, but obviously it can break things :)

Oh :)

Makes sense, when I try to log in now with tester@keycloak, I get the same error as before.

That's not happening for me. This might because you didn't permit refresh tokens in the client application? That's required for the Hello PIN to work.

Also this.
...

That works now too.

I think the problem was that I had Revoke refresh tokens enabled in the realm settings.
That would invalidate the refresh tokens after some uses (0 by default), so the refresh token would be invalidated immediately.

[eisenmann-b1]

I'm adding documentation for these requirements here: 2991deb Let me know if you think it needs additional detail.

I think it's fine as is.