OAuth2 sign-in fails with ERR_STRATEGY_MISCONFIGURED

[Rintan]

Environment

Wiki.js: 3.3.1
Deployment: Docker
Database: PostgreSQL 18

Description

Signing in with a configured OAuth2 authentication provider fails. Wiki.js shows the following error and the login does not complete:

auth.errors.loginError error.ERR_STRATEGY_MISCONFIGURED

The issue was reproduced with both Mattermost and Rocket.Chat OAuth2 providers.

Configuration

Trust X-Forwarded-* Proxy Headers is enabled.

[shondsouza]

The error comes from the empty JSON Web Key Set URL field in your screenshot. Filling it in won't fix the login, though: Mattermost and Rocket.Chat can't work with this strategy in 3.3.1 at all.

Why you get ERR_STRATEGY_MISCONFIGURED

You turned Use Discovery off. With discovery off, the strategy requires all three of Authorization Endpoint URL, Token Endpoint URL and JWKS URL. If any of them is empty, it throws ERR_STRATEGY_MISCONFIGURED before the browser is even sent to the provider:

wiki/backend/modules/authentication/oidc/authentication.ts

Lines 100 to 107 in bfb13cc

	} else {
	if (!this.conf.authorizationURL || !this.conf.tokenURL || !this.conf.jwksURL) {
	strategyDebug(
	this,
	`has discovery turned off and is not configured: ${missingSettings({ 'Authorization Endpoint URL': this.conf.authorizationURL, 'Token Endpoint URL': this.conf.tokenURL, 'JWKS Endpoint URL': this.conf.jwksURL })}`
	)
	throw new Error('ERR_STRATEGY_MISCONFIGURED')
	}

You can confirm this by turning on Admin → Flags → Auth Debug and trying again. The log should say something like has discovery turned off and is not configured: JWKS Endpoint URL is empty.

Why filling in a JWKS URL won't help

Despite the "OpenID Connect / OAuth2" label, this strategy is OIDC-only. A login is accepted only when the token response includes a signed ID token. Without one, it fails with ERR_NO_ID_TOKEN:

wiki/backend/modules/authentication/oidc/authentication.ts

Lines 314 to 322 in bfb13cc

	}
	const claims = tokens.claims()
	if (!claims?.sub) {
	strategyDebug(
	this,
	'the provider returned no ID token, so there is nothing signed saying who signed in'
	)
	throw new Error('ERR_NO_ID_TOKEN')
	}

Neither of your providers issues ID tokens when acting as an OAuth server:

• Mattermost returns only access_token, token_type, refresh_token and expires_in from its token endpoint (GetOAuthAccessTokenForCodeFlow). It publishes no JWKS and no /.well-known/openid-configuration. Its OpenID Connect support is for logging into Mattermost, not for other apps logging in with it.
• Rocket.Chat's OAuth2 server publishes RFC 8414 /.well-known/oauth-authorization-server metadata (not OpenID metadata) and has a plain /oauth/userinfo endpoint, but no ID tokens or signing keys (docs/features/oauth2-server.md).

So there's no JWKS URL you could enter. Even if you got past the configuration check, the callback would fail on the missing ID token.

What you can do

Put a small OIDC provider in front of them that speaks plain OAuth2 upstream and issues real ID tokens to Wiki.js. Dex has a generic oauth connector built for this. For Mattermost:

connectors:
  - type: oauth
    id: mattermost
    name: Mattermost
    config:
      clientID: <Mattermost OAuth app ID>
      clientSecret: <Mattermost OAuth app secret>
      redirectURI: https://dex.example.com/callback
      authorizationURL: https://mattermost.example.com/oauth/authorize
      tokenURL: https://mattermost.example.com/oauth/access_token
      userInfoURL: https://mattermost.example.com/api/v4/users/me
      userIDKey: id
      claimMapping:
        userNameKey: username
        emailKey: email

staticClients:
  - id: wikijs
    name: Wiki.js
    secret: <random secret>
    redirectURIs:
      - <the "Authorization Callback URL" shown at the bottom of the Wiki.js strategy page>

For Rocket.Chat, use the same pattern with /oauth/authorize, /oauth/token and /oauth/userinfo, and set userIDKey: sub. Its userinfo returns sub, email and name.

Then, in Wiki.js:

• Issuer: your Dex URL
• Use Discovery: on
• Client ID / Secret: the staticClients values

Discovery fills in the endpoints and the JWKS URL. Leave the manual endpoint fields empty.

The alternative is Wiki.js adding a plain OAuth2 mode (userinfo only, no ID token) like the generic OAuth2 module 2.x had. That would be a good feature request, but there's no such option in 3.3.1.

[Rintan]

Thanks for the detailed explanation.
I understand now why this OAuth2 doesn't work with Mattermost and Rocket.Chat in Wiki.js 3.3.1.

I also appreciate you providing a practical workaround with Dex, including configuration examples for both providers. That was very helpful.

I hope that OAuth2 authentication support will be added in a future release. Thank you.

[NGPixel]

Added plain oauth2 strategy via 9ebb645. Will land in next release.