Request to oidc.callback hangs

[cdauth]

I'm struggling to get Outline up and running.

I have tried it out with Authentic and with Keycloak. With both I'm having the same problem. The identity provider redirects me back to Outline (to /auth/oidc.callback in particular), but then that just hangs indefinitely. Eventually I get a message InternalOAuthError: Failed to obtain access token on the log and the Outline UI shows Authentication failed.

I don't even know where to start digging for this problem. Does anyone have any ideas?

[cdauth]

The problem turned out to be that the Outline container needed to reach the ID server container, which failed due to Docker's broken networking concept.

[Gatherix]

Thanks for this, I was a bit baffled with the same issue - what approach did you end up taking?

[cdauth]

The problem that is causing the trouble for me is moby/moby#24370. The isolation between Docker containers not only prevents access from one container to another that it is not linked to or that is not on the same network (which is the correct behaviour), but it also prevents access to publicly exposed ports of another container that it is not linked to or that is not on the same network (which is incorrect behaviour, since the port is public). I use a setup based on docker-compose, where Outline and its dependencies (redis, postgres, ...) run in a different docker network than Authentik and its dependencies. This means that even though Authentik (or rather, an nginx proxy that runs on an even other Docker network) is publicly reachable through a public port, the Outline container cannot reach it.

The workaround would be to enable connections between the Outline container and the Authentik (or in my case the nginx proxy) container. In my case, it meant adding the Outline container to the nginx proxy network in addition to its own network. In a setup where Outline and Authentik/nginx are not running on different docker networks, it would probably involve adding a link from the Outline container to the Authentik/nginx container.

In my docker-compose.yml file, this looks like this:

services:
    outline:
        image: outlinewiki/outline
        networks:
            - default
            - nginx
networks:
    nginx:
        external:
            name: nginx_default

The problem that I was running into was that in addition to the nginx network, I also have to add the Outline container to the mail network in order for it to access the mail server, due to the same Docker bug. For some reason, when adding it to the mail network it stopped having access to the nginx network. Probably there is another Docker bug that I am not aware of. I have not found a solution to this problem yet but for now simply disabled the connection to the mail server, meaning that for now Outline cannot send any e-mails.

Let me know if you have any questions.