Help with OIDC (Authentik)

[klausmcm]

I'm running adventurelog:v0.13.0 and I followed https://adventurelog.app/docs/configuration/social_auth/authentik.html but when I try to authenticate in adventurelog with authentik, I end on an authentik page with the following error

Redirect URI Error

The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

As far as I can tell, I configured the app and provider in authentik properly and entered the proper values into adventure log.

I'm not sure if this is the error I'm encountering - https://adventurelog.app/docs/configuration/social_auth/authentik.html#_404-error-when-logging-in. If so, I'm not sure how to route <url>/accounts to the backend.

This is my compose file

  services:
    web:
      image: ghcr.io/seanmorley15/adventurelog:v0.13.0
      restart: unless-stopped
      depends_on:
        db:
          condition: service_healthy
      environment:
        - SITE_URL=${SITE_URL}
        - POSTGRES_PASSWORD=${DB_PASSWORD}
        - PGHOST=db
        - POSTGRES_DB=database
        - POSTGRES_USER=adventure
        - DEBUG=${DEBUG}
        - DISABLE_REGISTRATION=${DISABLE_REGISTRATION}
        - EMAIL_BACKEND=${EMAIL_BACKEND}
        - EMAIL_HOST=${EMAIL_HOST}
        - EMAIL_USE_TLS=${EMAIL_USE_TLS}
        - EMAIL_PORT=${EMAIL_PORT}
        - EMAIL_USE_SSL=${EMAIL_USE_SSL}
        - EMAIL_HOST_USER=${EMAIL_HOST_USER}
        - EMAIL_HOST_PASSWORD=${EMAIL_HOST_PASSWORD}
        - DEFAULT_FROM_EMAIL=${DEFAULT_FROM_EMAIL}
      ports:
        - ${PROXY_PORT}:80
      healthcheck:
        test:
          - "CMD-SHELL"
          - "python3 -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:80/health')\""
        interval: 30s
        timeout: 5s
        retries: 5
        start_period: 120s
      volumes:
        - ${MEDIA_VOLUME}:/code/media/
    db:
      image: postgis/postgis:16-3.5
      restart: unless-stopped
      environment:
        - POSTGRES_DB=database
        - POSTGRES_USER=adventure
        - POSTGRES_PASSWORD=${DB_PASSWORD}
      healthcheck:
        test:
          - "CMD-SHELL"
          - "pg_isready -U adventure -d database"
        interval: 5s
        timeout: 5s
        retries: 5
        start_period: 10s
      volumes:
        - ${DB_VOLUME}:/var/lib/postgresql/data/

@seanmorley15 Is the one container, one port deployment compatible with authentik?

Thank you,

[yudin-s]

Yes, the one-container / one-port deployment is compatible with Authentik. You do not need a separate backend port exposed publicly as long as your public URL routes /accounts/... to the AdventureLog web container.

The error you are seeing is earlier than the 404 case in the docs. Authentik is rejecting the OAuth request because the redirect_uri generated by AdventureLog does not match the redirect URI allowed on the Authentik provider.

I would check these three things first:

1. In AdventureLog, make sure SITE_URL is the exact public URL users open in the browser, including scheme and no extra port/path unless that is really public. For example:

SITE_URL=https://adventure.example.com

2. In Authentik, the provider redirect URI regex from the AdventureLog docs should match that same public URL and /accounts/oidc/..., for example:

^https://adventure\.example\.com/accounts/oidc/.*$

If your regex still says http://..., an internal Docker hostname, localhost, or the raw ${PROXY_PORT} URL, Authentik will reject the login with exactly this redirect URI error.

3. In AdventureLog admin, the social application Settings server_url should point to the Authentik application endpoint, not AdventureLog itself, e.g.:

{
  "server_url": "https://auth.example.com/application/o/adventurelog/"
}

The /accounts routing note matters when the callback returns to AdventureLog and hits the wrong frontend route. With your current Authentik-side redirect error, I would fix the allowed redirect URI and SITE_URL first, then test whether /accounts/oidc/... reaches the container through the proxy.

If matching those URLs fixes it, please mark the answer so the Authentik redirect-vs-routing distinction is easier to find.

[klausmcm]

@yudin-s Thank you for your reply. I will have a closer look within the next few days and try again.

[klausmcm]

I gave https://integrations.goauthentik.io/miscellaneous/adventurelog/ a closer read. I think what I missed when I created this post was

Users with an existing AdventureLog account can link it to their authentik account. Log in to AdventureLog with the existing account, click your user avatar in the navigation bar, select Settings, then click Launch Account Connections in the Social Authentication section. Select authentik to link the accounts.

Though I could have also missed something else the first time around but everything is working now!