Configuration of OIDC using Kanidm

[paulgoulain]

Hello,

I'm trying to configure Rustical to use Kanidm. However when I click on the button "Login with Kanidm", I'm redirected to a page with "Failed to discover OpenID provider".
The logs show this :

rustical  | 2025-12-14T21:34:09.595339Z ERROR http-request{otel.name=POST /frontend/login/oidc ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0}: rustical_oidc: An error occured trying to discover OpenID provider: Request failed
rustical  | 2025-12-14T21:34:09.595592Z ERROR http-request{otel.name=POST /frontend/login/oidc ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0 status=500 Internal Server Error}: rustical::app: server error
rustical  | 2025-12-14T21:34:09.595621Z ERROR http-request{otel.name=POST /frontend/login/oidc ua=Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0 status=500 Internal Server Error}: rustical::app: something went wrong

However Caddy and Kanidm logs show nothing.

Everything is setup using docker and accessible using Caddy as a reverse proxy.
I created the client ID in Kanidm and can access its well-known end point (https://idm.internal/oauth2/openid/rustical/.well-known/openid-configuration).

Here is my config.toml

[oidc]
name = "Kanidm"
issuer = "https://idm.internal/oauth2/openid"
client_id = "rustical"
client_secret = "redacted"
claim_userid = "preferred_username"
scopes = ["openid", "profile", "groups"]
require_group = "app/rustical"
allow_sign_up = true

[frontend]
allow_password_login = false  # optional

I'm currently stuck. Is there a way to get more detailed logs from Rustical ?

[lennart-k]

Hey, the error "Request failed" unfortunately is the full error message in
https://docs.rs/openidconnect/latest/openidconnect/enum.DiscoveryError.html#variant.Request
I guess rustical doesn't resolve your domain https://idm.internal/oauth2/openid.

[lennart-k]

I assume for other containers your setup with https://idm.internal works, right?

[paulgoulain]

I solved my problem. As expected, it was a bad configuration on my part.