|
I've been working on this all day so I apologize in advance if this is long winded. I’m trying to configure geopulse 1.33.0 OIDC with authelia behind traefik. The initial OIDC flow appears to work fine. Geopulse redirects to authelia and I authenticate successfully, and the browser is redirected back to geopulse with a valid-looking authorization code. However, when geopulse processes the callback, the frontend POSTs to: and geopulse returns {"status":"error","message":"OIDC authentication failed","data":null}with HTTP status Everything works normally when using the built-in authentication. HTTPS/TLS and traefik routing also appear to be working correctly. Expected behavior: After successful authentication in authelia, geopulse should complete the OIDC callback, create or match the user, establish a geopulse session, and redirect/log me into the application. Actual behavior: The OIDC authorization step succeeds, but the final callback handling fails. The browser is redirected back to Geopulse at Then the frontend sends POST /api/auth/oidc/callbackand I get this back HTTP/2 500
content-type: application/json;charset=UTF-8
{"status":"error","message":"OIDC authentication failed","data":null}AFAICT, the failing request is POST /api/auth/oidc/callback HTTP/2
Host: geopulse.mydomain.com
Content-Type: application/json
Referer: https://geopulse.mydomain.com/oidc/callback?code=authelia_ac_...&iss=https%3A%2F%2Fauth.mydomain.com&scope=openid+profile+email&state=...
Origin: https://geopulse.mydomain.com
X-CSRF-Token: ...
Cookie: csrf-token=...; authelia_session=...and it returns that 500 error. Here are the geopulse logs around the failed flow: Here's the authelia - client_id: 'geopulse'
client_name: 'geopulse'
client_secret: '$argon2id...redacted...'
authorization_policy: 'two_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://geopulse.mydomain.com/oidc/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
token_endpoint_auth_method: 'client_secret_post'I also tested the token endpoint as but the result was the same. This is the current state of my setup
I'm done for today but could someone help me identify what is failing here. Thanks in advance. |
Replies: 8 comments 2 replies
|
Please check for errors in geopulse-backend container. I don't have Authelia so it will take some time to setup it and test |
|
Here are the error messages from the backend. this is the important bit i think: full logs here: In my secret, I made it simpler to just be alpha numeric but the same error message is coming through. I'm using an argon2id hash...maybe that's it? idk. Tomorrow I'll do some |
|
Okay I got it working. For some reason, I can't use symbols in my password... it would only take a hexadecimal password. Also for Authelia, having identity_providers:
oidc:
claims_policies:
geopulse:
id_token:
- email
- email_verified
- name clients:
- client_id: 'geopulse'
client_name: 'geopulse'
client_secret: '$argon2id...'
authorization_policy: 'two_factor'
require_pkce: false
redirect_uris:
- 'https://geopulse.mydomain.com/oidc/callback'
scopes:
- 'openid'
- 'profile'
- 'email'
token_endpoint_auth_method: 'client_secret_post'
claims_policy: 'geopulse' |
|
@tess1o If you're up to it, I think it would be helpful to future self-hosters to put the Authelia OIDC config directions on the Authelia integration page. Here's an example for Immich and there are others on the left hand side of the page. Since you don't have Authelia, I'd be happy offer my config as an example and work with you and the Authelia team to build out the instructions. The only config line I am unsure about is I didn't feel comfortable opening this as a pull request in the Authelia repo since you're the project owner/developer and it really should be done by you. I just wanted you to know that I'm happy to do this with you as I'd love to see more people use geopulse. It's a really great application. |
|
Thanks for the suggestion and willingness to contribute! I'm planning to install Authelia tomorrow and check the required configuration by myself. I will use your configuration for reference and once everything is sorted out will create a PR to Authelia team and update docs in geopulse |
|
Ok, I finally installed Authelia and it worked for me with this configuration: In Geopulse: |
|
I edited my config to match yours and I was able to reproduce a fully working & validated OIDC login. So this is good. Thanks for working on it. The only other thing I might add is the link to the authelia svg icon: 
|
|
Thanks, I will add a detailed doc page with instructions how to do the setup. |
|
https://geopulse.cc/docs/system-administration/configuration/authelia-oidc Can you check it? |
|
It looks great to me. I was able to build an entire instance from scratch based on these instructions. The only other thing I'd add is under the 
But these directions worked perfectly for me! Thanks very much. |
@debsidian ,
https://geopulse.cc/docs/system-administration/configuration/authelia-oidc
Can you check it?