Google OIDC or Traefik Forward oauth proxy support?

[msiegy]

Hi, Initially I was attempting to add ABS to my forward proxy that uses Google Oath that I have setup for other apps through Traefik. This works but only for the webpage, I could not seem to get it working with the official Andoid ABS app. If this is possible please let me know!

In the meantime I saw that OIDC support was added so I was trying to take advanatage of that. I assumed I could leverage the same google oauth app as long as I added the two authorized re direct URIs noted in the ABS setup guide, e.g.: [ https://abs.mysite.net/auth/openid/mobile-redirect] but I seem to be running into issues even with the webapp which returns unauthorized.

The ABS logs show the following after every attempt.
"[Auth] No data in openid callback - RPError: unexpected iss value, expected https://oauth.mysite.net, got: https://accounts.google.com"

My settings are below, which to be honest i fumbled through looking for the appropriate values. I temporailly have auto register turned on for testing.

Thanks!

[nichwall]

Yes, forward authentication is not supported by the mobile apps and is not planned (due to not being a standard like OAuth and the ability to just use OAuth).

I haven't done anything with Google for OIDC, but I believe your Issuer URL is wrong. Based on the documentation at https://www.audiobookshelf.org/guides/oidc_authentication/#remaining-configuration-items and the error, your Issuer URL should be https://accounts.google.com or similar.

[msiegy]

Wow, thank you! I changed the issuer URL to https://accounts.google.com and also needed to restart ABS. It's working great. Hope this helps others!

[nichwall]

Glad you got it figured out!

[dialanothernumb]

@msiegy I am trying to replicate your setup.. I access abs via abs.myserver.tld through traefik reverse proxy. I run the service as a docker container.

I then created credentials for an Google OAuth 2 Client ID, specifically for abs and distinct from the credentials I created and use for my traefik-forward-auth service, also run from a docker container and which provides security for my other home server apps.

I followed the change you made, to enter the url https://accounts.google.com as the issuer url. The url which shows up when I click 'autopopulate' is https://accounts.google.com/o/oauth2/v2/auth, which I register as an authorised redirect URI in the relevant OAuth ClientID credentials page. I then restart the abs server

However I get the error: Error 400: redirect_uri_mismatch. when I click for more details I get this

If you're the app developer, register the redirect URI in the Google Cloud Console.
Request details: redirect_uri=https://abs.myserver.tld/auth/openid/callback flowName=GeneralOAuthFlow

I have tried registering the above uri in the console but I still get the error.

The only thing I can think of which may be an issue is my Traefik set up but perhap, before I go down that rabbit hole, there is something obvious I have missed?

[dialanothernumb]

Fixed it...

I had included extra text at the end of the callback uri.... it should read https://abs.myserver.tld/auth/openid/callback

Torn between removing my post and saving myself embarrassment or leaving it to help others ;-)