OIDC Authentication

[TobiasGrether]

I've barely found any information on OIDC authentication, but I saw that a few environmental variables exist for it. Is there any document on it and is OIDC auth available in any version of outline? (Of course talking selfhosted here)

[IkerSaint]

I was able to ingrate Outline with Authentik using this env variable:

OIDC_CLIENT_ID=<yousupersecretclientid>
OIDC_CLIENT_SECRET=<evenmoresecretsecret>
OIDC_AUTH_URI=https://<yourauthdomain>/application/o/authorize/
OIDC_TOKEN_URI=https://<yourauthdomain>/application/o/token/
OIDC_USERINFO_URI=https://<yourauthdomain>/application/o/userinfo/
OIDC_USERNAME_CLAIM=email
OIDC_DISPLAY_NAME=openid
OIDC_SCOPES="openid profile email"
FORCE_HTTPS=true # this one is very important
URL=https://yourexternalurl # Also important

Additionally, on the Authentik side, the creation of the provider and application is quite easy, the redirect URL is https://yourexternalur/auth/oidc.callback

[gnowland]

What's the best way to debug OIDC auth? I've added the above environment variables but upon redirect from Keycloak I'm receiving the following error:

Authentication failed – we were unable to sign you in at this time. Please try again.

And my server logs indicate:

{
  "error": "Failed to obtain access token",
  "stack": "InternalOAuthError: Failed to obtain access token
            at OAuth2Strategy._createOAuthError (/opt/outline/node_modules/passport-oauth2/lib/strategy.js:423:17)
            at /opt/outline/node_modules/passport-oauth2/lib/strategy.js:177:45
            at /opt/outline/node_modules/oauth/lib/oauth2.js:191:18
            at ClientRequest.<anonymous> (/opt/outline/node_modules/oauth/lib/oauth2.js:162:5)
            at ClientRequest.emit (node:events:526:28)
            at ClientRequest.emit (node:domain:475:12)
            at TLSSocket.socketErrorListener (node:_http_client:442:9)
            at TLSSocket.emit (node:events:526:28)
            at TLSSocket.emit (node:domain:475:12)
            at emitErrorNT (node:internal/streams/destroy:157:8)
            at emitErrorCloseNT (node:internal/streams/destroy:122:3)
            at processTicksAndRejections (node:internal/process/task_queues:83:21)",
  "level": "error",
  "message": "Error during authentication"
}

[1itt1eB0y]

check your keycloak API address, maybe there is wrong setting.

[1itt1eB0y]

You can try authlia, authentic, keycloak, dex and other more.
Set up a OIDC server first, create a client for outline, and you will get the API address. Fill the configuration with these addresses, then you can use OIDC to login.

[Wlmrsi]

I have the same problem with Authentik, and can not find a way to resolve it...

[reejosam]

Getting same error with a custom django oidc server that works with other apps. I suspect it might have something do with not using https being an internal server. Information on the error would be helpful to debug.

[tommoor]

It's a limitation of the underlying library unfortunately, we'd have to fork passport to get better errors here… maybe it'd be worth it.

I suspect it might have something do with not using https being an internal server

For authentication you should always use https, it's expected that all parts of Outline run with SSL enabled.

[felixsanz]

It's a limitation of the underlying library unfortunately, we'd have to fork passport to get better errors here… maybe it'd be worth it.

I suspect it might have something do with not using https being an internal server

For authentication you should always use https, it's expected that all parts of Outline run with SSL enabled.

But what if I want to do SSL termination at reverse proxy level? The Outline<>Proxy connection should be under SSL too?

[almereyda]

That appears for you to decide, as it is an intermediary transmission that does not provide its own endpoint which would be used by third parties.