Redirect /auth/oidc.callback got 502

[chenmnkken]

I use Authelia for Outline OIDC-compatible authentication provider, when authelia first login is success, then redirect to outline, I got 502 error, all services proxy by Nginx.

The Nginx got error log found this: upstream prematurely closed connection while reading response header from upstream ....

The Outline docker-compose.yml key content.

version: "3"
services:

  outline:
    image: outlinewiki/outline:0.71.0
    container_name: outline
    ports:
      - 3000:3000
    environment:
      - OIDC_CLIENT_ID=outline
      - OIDC_CLIENT_SECRET=outline
      - OIDC_AUTH_URI=https://auth.example.com/api/oidc/authorization
      - OIDC_TOKEN_URI=https://auth.example.com/api/oidc/token
      - OIDC_USERINFO_URI=https://auth.example.com/api/oidc/userinfo
      - OIDC_USERNAME_CLAIM=preferred_username
      - OIDC_SCOPES="openid offline_access profile email"
...

The Authelia configuration.yml key content.

identity_providers:
  oidc:
    hmac_secret: xxx
    issuer_private_key: |
      -----BEGIN RSA PRIVATE KEY-----
      ...
      -----END RSA PRIVATE KEY-----
    clients:
    - id: outline
      description: Outline
      secret: 'outline'
      public: false
      authorization_policy: one_factor
      redirect_uris:
        - https://docs.example.com/auth/oidc.callback
      scopes:
        - openid
        - offline_access
        - profile
        - email
      userinfo_signing_algorithm: none     

The docs.example.com Nginx config key content.

location / {
        proxy_set_header X-Real_IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;        
        proxy_set_header Host $http_host;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        send_timeout 5m;
        proxy_read_timeout 360s;
        proxy_send_timeout 360s;
        proxy_connect_timeout 360s;

	client_body_buffer_size 128k;
        proxy_buffers 64 256k;
        proxy_redirect off;
	proxy_buffer_size 16k;
	proxy_http_version 1.1;   
	proxy_pass http://0.0.0.0:3000;
}

[tommoor]

nginx isn't required to run Outline so I'm not sure how much help you'll get here, I recommend searching the discussions for similar problems. Which upstream service is resulting in 502? What about Outline logs?

[chenmnkken]

The Outline only request logs, no response logs.

{"label":"http","level":"info","message":"  <-- GET /auth/oidc.callback?code=authelia_ac_MXS_9fExSQOdyGOfnnMHfLYidNQTnjV26x7x3QuIFek.Wgsi2JZfD_JeHbvvPwElSD0Ej_LQSVKw3cmhsfh3AEE&scope=openid+profile+email&state=7a05a47fb1c1489a"}

And got tcp error.

{"error":"connect ETIMEDOUT x.x.x.x:443","level":"error","message":"Error during authentication","stack":"Error: connect ETIMEDOUT x.x.x.x:443\n    at TCPConnectWrap.afterConnect [as oncomplete] (node:net:1495:16)"}

[tommoor]

Seems like Outline cannot connect to Authelia, so it's likely a docker DNS/networking issue

[chenmnkken]

I just realize the problem likes from docker network, it's true.
I resolved this problem, because the docker container can't connect outside internet, set iptables NAT resolved.

Thanks.