Skip to content

Error: Unauthenticated, signin works only using setup keys #2123

Description

@ozoromo

Describe the problem

When trying to sign in using SSO (Zitadel) everything works fine on the SSO side and the user is redirected back to https://netbird.mydomain.com/auth?code=longcodehere and sees the following error there:

*Oops, something went wrong* There was an error logging you in. Error: Unauthenticated

To Reproduce

Steps to reproduce the behavior:

  1. Run command 'sudo netbird up --management-url https://netbird.mydomain.com:443'
  2. Browser opens
  3. SSO login
  4. See error

Expected behavior

After being redirected back to Netbird the tab should close or redirect to the main UI and the client should be added to the peers

Are you using NetBird Cloud?

No, I am selfhosting

NetBird version

0.27.10 (on client)

NetBird status -d output:

Netbird status of a client added using setup keys:

OS: linux/amd64
Daemon version: 0.27.10
CLI version: 0.27.10
Management: Connected
Signal: Connected
Relays: 2/2 Available
Nameservers: 0/0 Available
FQDN: vpsd2uodks.netbird.selfhosted
NetBird IP: 100.124.152.40/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected

Screenshots

Page that appears
image

Additional context

The following error appears in netbird-managements log:
WARN management/server/grpcserver.go:371: failed logging in peer xkk8XC31+NOZzHfFPzybhp8DbByrixl/nU8XlPJhT0o=: no peer auth method provided, please use a setup key or interactive SSO login

management.json (redacted)
{
  "DataStoreEncryptionKey": "long enryption key",
  "Datadir": "/var/lib/netbird-mgmt/data",
  "DeviceAuthorizationFlow": {
    "Provider": "hosted",
    "ProviderConfig": {
      "Audience": "numericalid@netbird",
      "ClientID": "numericalid@netbird",
      "ClientSecret": "longsecretstring",
      "DeviceAuthEndpoint": "https://auth.mydomain.com/oauth/v2/device_authorization",
      "Domain": "https://auth.mydomain.com",
      "Scope": "openid",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token",
      "UseIDToken": false
    }
  },
  "HttpConfig": {
    "Address": "127.0.0.1:8011",
    "AuthAudience": "numericalid@netbird",
    "AuthIssuer": "https://auth.mydomain.com",
    "AuthKeysLocation": "https://auth.mydomain.com/oauth/v2/keys",
    "IdpSignKeyRefreshEnabled": true,
    "OIDCConfigEndpoint": "https://auth.mydomain.com/.well-known/openid-configuration"
  },
  "IdpManagerConfig": {
    "Auth0ClientCredentials": null,
    "AzureClientCredentials": null,
    "ClientConfig": {
      "ClientID": "netbird",
      "ClientSecret": "longsecretstring",
      "GrantType": "client_credentials",
      "Issuer": "https://auth.mydomain.com",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token"
    },
    "ExtraConfig": {
      "ManagementEndpoint": "https://auth.mydomain.com/management/v1"
    },
    "KeycloakClientCredentials": null,
    "ManagerType": "zitadel",
    "ZitadelClientCredentials": null
  },
  "PKCEAuthorizationFlow": {
    "ProviderConfig": {
      "Audience": "numericalid@netbird",
      "AuthorizationEndpoint": "https://auth.mydomain.com/oauth/v2/authorize",
      "ClientID": "numericalid@netbird",
      "ClientSecret": "longsecretstring",
      "RedirectURLs": [
        "https://netbird.mydomain.com/auth",
        "https://netbird.mydomain.com/silent-auth"
      ],
      "Scope": "openid profile email offline_access api",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token",
      "UseIDToken": false
    }
  },
 "ReverseProxy": {
    "TrustedHTTPProxies": [],
    "TrustedHTTPProxiesCount": 0,
    "TrustedPeers": [
      "0.0.0.0/0"
    ]
  },
  "Signal": {
    "Password": null,
    "Proto": "https",
    "URI": "netbird.mydomain.com:443",
    "Username": ""
  },
  "StoreConfig": {
    "Engine": "sqlite"
  },
  "Stuns": [
    {
      "Password": "some long credential",
      "Proto": "udp",
      "URI": "stun:netbird.mydomain.com:3478",
      "Username": "netbird"
    }
  ],
  "TURNConfig": {
    "CredentialsTTL": "12h",
    "Secret": "some long credential",
    "TimeBasedCredentials": false,
    "Turns": [
      {
        "Password": "some long credential",
        "Proto": "udp",
        "URI": "turn:netbird.mydomain.com:3478",
        "Username": "netbird"
      }
    ]
  }
}

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions