OIDC access help

[Stephane-30]

Probably easy to answer, but I'm stuck at the moment. I'm trying to run my own OIDC server (Tailscale tsidp). So far so good, and it's running. I have created ID and Secret for poznote and added it to env.
When trying to authenticate in Poznote login it throws an redirect error.
When I created the ID I also needed to add a redirect URL and in PN is an option to ovederwrite the redirect URL. What actually is the correct URL?
Sorry if this seems obvious.

[timothepoznanski]

Hi Stéphane! No worries, this is not that easy for a lot of people, even for me. :)

The redirect URL you need to register in tsidp is:

https://YOUR_POZNOTE_HOST/oidc_callback.php

where YOUR_POZNOTE_HOST is exactly the hostname (and port, if any) you type in the browser to open Poznote. Poznote auto-generates this value from the request, so in most setups you can leave the "Redirect URI" override field in Settings > Admin Tools > OIDC / SSO empty.

Two things to check if you still get a redirect error:

1. The value registered in tsidp must match what Poznote sends character for character (scheme, host, port, path). A trailing slash or http vs https mismatch is enough for the provider to reject it.

2. Poznote defaults to https:// when building the redirect URI. If you access Poznote over plain HTTP (e.g. http://192.168.1.x:8040), fill the override field with the full URL, e.g. http://192.168.1.x:8040/oidc_callback.php, and register that same value in tsidp.

If it still fails, paste the exact error message from tsidp (it usually says which redirect_uri it received) and I can take a closer look.

[Stephane-30]

Okay, I set the redirect URL and studied the logs of tsidp. The authentication flow shows no errors. However, (and this is due to my lack of understanding the ins and outs of OIDC) the token issued is actually my github username. I use my github account to log into Tailscale. I guess Poznote doesn't know what to do with my github user name and therefore login fails with:

You are not authorized to access this application. Please contact your administrator.

I tried to add a user with my github name to PN but that doesn't work either.
It isn't essential to get it to work, but it could make login easier.

[timothepoznanski]

Please try to add your username in the PN config here (in OIDC config page):

Sorry in advance if it is what you meant by "I tried to add a user with my github name to PN but that doesn't work either."

Let me know and if it still doesn't work I will try to investigate in my side.

But you are right it is so much better to log with OIDC so we have to make it work. 😉

[Stephane-30]

I have added my github username to 'Allowed users' but that didn't make any difference either.

Here is the PN log:
2026-08-07 07:34:37 [poznote-webserver-1] 127.0.0.1 - 07/Aug/2026:06:34:37 +0000 "GET /oidc_login.php" 302 2026-08-07 07:34:37 [poznote-webserver-1] 127.0.0.1 - 07/Aug/2026:06:34:37 +0000 "GET /oidc_callback.php" 302 2026-08-07 07:34:37 [poznote-webserver-1] NOTICE: PHP message: OIDC Callback Error: User not authorized to access this application (group or allowlist restriction) 2026-08-07 07:34:37 [poznote-webserver-1] NOTICE: PHP message: Stack trace: #0 /var/www/html/oidc_callback.php(35): oidc_finish_login(Array, Array) 2026-08-07 07:34:37 [poznote-webserver-1] #1 {main}
I would copy the tsipd log but there seems to be a lot of ID's and secrets shown in it.

I need to read up on OIDC to understand how Tokens like my github username relate to IDs in tsidp. I thought it's all about IDs and secrets and not about names.

[timothepoznanski]

I dug into this on the code side. The "Allowed users" list is matched against three claims from the ID token tsidp sends: email, preferred_username and sub. With tsidp these are not simply your GitHub username:

• preferred_username is your Tailscale login name without the domain part, in lowercase (so stephane-30). Older tsidp builds don't send this claim at all.
• email is your full Tailscale login name. Recent tsidp versions send it as stephane-30@github.<your-tsidp-hostname>, older ones as stephane-30@github.
• sub is your numeric Tailscale user ID.

Two things to try, in order:

1. Make sure the "Allowed groups" field is completely empty. tsidp doesn't send a groups claim, so any value there rejects every login no matter what "Allowed users" contains. The error message is the same for both checks.
2. Temporarily clear "Allowed users" too and log in via SSO. With both fields empty there is no restriction, so login should succeed. Then look at the username Poznote shows for the session it created, that's the value derived from the claims, and put exactly that back into "Allowed users".

If it still fails with both fields empty, paste the new Poznote log line and we'll dig further.

Side note: in an upcoming patch I will improve the logs so that when a login is rejected, Poznote logs which check failed (groups or allowlist) and the actual claim values it received. That way you would see the exact value to put in "Allowed users" directly in the log, without needing these workarounds.

[timothepoznanski]

I pushed a patch 6.56.3-beta with more logging. Could you try it please?

[timothepoznanski]

Could you try to use this beta version one time just to validate that is working and showing the right logs so that I can add it to the next release please? Thanks.

[Stephane-30]

Removed all the entries. After changing my additionally setup PN user account name from Stephane-30@github to Stephane-30 the login was successful. However, that's not the PN account I want to use.

Is there a way to automatically log in to my primary PN user account (the one I use on a daily basis). I don't really want to rename it to Stephane-30.

[Stephane-30]

Just tried your suggestion and it works. First I had to copy the email address from the Stephane-30 PN account and copy it to my main PN account (user). Initially it didn't work and still tried to access the Stephane-30 account. I then changed the scope entry in OIDC from 'email openid profile' to 'email' and then it worked. The email address was not set by me in the first place. I don't know if PN has or tsidp. The email is fancy Stephane-30@github.idp.MYDOMAIN.ts.net

I read up on the Tailscale docs about identity providers.
https://tailscale.com/docs/integrations/identity

Tailscale does not support sign-up with email addresses. By design, Tailscale is not an identity provider—there are no Tailscale passwords.

If I understand correctly then Tailscale will only have access to the github user name. Therefore it's the only ID available for tsidp to work with.

Although it works now (thanks to your time and help), I may have to look for an alternative self hosted OIDC provider. Maybe Authelia or Authentic?? I don't need anything fancy - just install, setup and go.

Debug information in PN is all visible now and should make it easier to tackle problems in future.

[Stephane-30]

I forgot to mention that there was no content in the "OIDC subject" field!

[timothepoznanski]

Great, glad it works! A few explanations on what you observed, because you actually did everything right and the remaining confusion was on Poznote's side:

• The email you found on the test account was set by Poznote, not by you: on every successful SSO login, Poznote syncs the email claim the provider sends into the matched account. And tsidp fabricates that address itself: your Tailscale login name (Stephane-30@github) plus the tsidp hostname, which gives the fancy Stephane-30@github.idp.MYDOMAIN.ts.net.

• Why removing profile from the scopes fixed it: with the profile scope, tsidp also sends a preferred_username claim (Stephane-30), and Poznote tries to match an account by username before trying the email. So it kept landing on the test account named "Stephane-30" and never reached the email match on your main account. Dropping profile removed that claim, so the email match won.

• I recommend putting openid back (so scopes openid email): openid is mandatory in the OIDC spec, tsidp is lenient about it but most other providers will refuse to issue an ID token without it. Now that one login has succeeded on your main account, your tsidp identity is directly linked to it, so future logins go straight there and you could even restore the full openid profile email scopes once the test account is deleted or renamed.

• Your reading of the Tailscale docs is correct: Tailscale is not an identity provider itself, so tsidp can only expose the identity you used to join the tailnet, in your case the GitHub-based login name. That's not a tsidp limitation you need to escape from though: now that everything is wired up, tsidp works fine with Poznote. If you still want a standalone provider with real control over usernames and emails, the usual self-hosted picks are Pocket ID (the closest to "install, setup and go", passkey-based), Authelia (lightweight, configured via YAML files) and Authentik (full-featured web UI, heavier). All three work with Poznote's generic OIDC support. I actually tried Pocket ID which works well with Poznote. I have heard that other PN users use Autentik and Authelia also.

And thanks for confirming that the new debug logs of the beta show up correctly, I will include them in the next release.

[timothepoznanski]

I forgot to mention that there was no content in the "OIDC subject" field!

Thanks for mentioning that, it led me to a real bug! The admin Users page did not load the OIDC subject value from the database, so the edit dialog always showed that field empty, even when an account was actually linked. Worse: saving any change from that dialog silently erased the stored link, since the empty field was written back.

That explains what you saw, and probably part of the erratic behavior too: your test account did get linked after its first successful login, but the field showed empty and editing the account wiped the link.

I have fixed it for the next release: the dialog now shows the real linked subject, and editing a user no longer clears it.

Sorry about that. 😔

[Stephane-30]

Tim, I'm glad I was able to help you as well. You have done so much in the past.
BTW, just set up OIDC in Audiobookshelf. First I added my new fancy email to my user account, then set all the OIDC values, restarted the Audiobookshelf server and I was straightaway in with OIDC login.