Authentik OIDC redirects to invalid or localhost URL #82
Comments
|
Thanks for sending such a detailed report! Really helpful. I'll look at it this weekend and see if I can replicate. |
|
I have not been able to recreate the same issue yet but i did notice one thing thats not right. the environment variable needs to be just the domain. Faction will append the correct path: |
Thanks @summitt I still get the localhost redirect however. I'll try and dig into this a bit deeper when I have some more time |
|
I've been trying to debug this. I'm fairly certain it's something in faction's code as the One thing I have noticed is there are a couple stack traces in the log immediately after starting up ( Is there a way to get verbose logging from Faction that spits out all the queries it makes? |
|
Those stack traces are actually normal. It's related to the struts-annotation-plugin. We are working to mitigate that but it actually does not affect the application so it's been a low priority. In authentik have you tried setting the redirect URI to I have not had the time to set up Authentik and a similar deployment as you. I can confirm all these ENVs work correctly with PING Identity, AUTH0, and GOOGLE OIDC. We have this working in production on several customer sites with our hosted versions as well. Sorry, this is problematic. I'll see if we can add more logging to the OIDC comms. |
I still get the localhost:8080 redirect URL with that. Some extra debug logging would be useful, if nothing else to confirm that it's Authentik that's the issue here and not faction |
|
Well I found the solution and it's incredibly stupid of me and docker-compose. Surrounding the environment variables in the docker file in single quotes doesn't seem to initilise them. If I remove them, the redirect_url is now correct as it's no longer using the default BAD environment:
- 'FACTION_REPORT_STORAGE=local'
- 'FACTION_MONGO_HOST=faction-mongo'
- 'FACTION_MONGO_DATABASE=faction'
- 'FACTION_MONGO_USER=OMITTED'
- 'FACTION_MONGO_PASSWORD=OMITTED'
- 'FACTION_SECRET_KEY=OMITTED'
- 'FACTION_OAUTH_CALLBACK=https://faction.internal.my.tld'
- 'FACTION_APPSTORE_ENABLED=true'GOOD environment:
- FACTION_REPORT_STORAGE=local
- FACTION_MONGO_HOST=faction-mongo
- FACTION_MONGO_DATABASE=faction
- FACTION_MONGO_USER=OMITTED
- FACTION_MONGO_PASSWORD=OMITTED
- FACTION_SECRET_KEY=OMITTED
- FACTION_OAUTH_CALLBACK=https://faction.internal.my.tld
- FACTION_APPSTORE_ENABLED=trueAlthough I do get redirected to a page with no content-type however, so it's just plain HTML: |
|
Oh! That last issue should be fixed in the most recent version. If it's not it's because I forgot to check it in. Glad you got the other issues working in docker-compose. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Overview
I am selfhosting Faction on my cloud server and have an issue where Faction's OIDC redirection logic does not seem to redirect me to the correct callback URL.
Environement
Note all real domains have been replaced with
my.tldand all real credentials replaced withOMITTEDfor privacyhttps://auth.my.tld/application/o/faction/.well-known/openid-configurationError
The problem I have is with the redirect after the user has successfully authenticated to Authentik. If the configuration is identical to the above, the following error is shown after the user has authenticated to Authentik successfully:
An identical error log appears in Authentik:
{"auth_via": "session", "domain_url": "auth.my.tld", "event": "The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).", "host": "auth.my.tld", "level": "warning", "logger": "authentik.providers.oauth2.views.authorize", "pid": 80162, "request_id": "15967659903f4fd58fa74df3946fcabc", "schema_name": "public", "timestamp": "2024-11-07T14:00:06.100560"}This is the final URL:
https://auth.my.tld/application/o/authorize/?max_age=0&scope=openid+profile+email&display=popup&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth%2Fcallback%3Fclient_name%3DOidcClient&state=0aff847c7c&code_challenge_method=S256&prompt=select_account&nonce=OMITTED&client_id=OMITTED&code_challenge=OMITTEDAs you can see, the
redirect_uriis incorrectly set to a localhost address. If I change theRedirect URIs/Origins (RegEx)setting in Authentik to the insecure wildcard, you can see that I am redirected to an invalid localhost address:http://localhost:8080/oauth/callback?client_name=OidcClient&code=OMITTEDHowever, the code that I am provided is valid and I can now login to Faction if I change
http://localhost:8080in the URL to the correcthttps://faction.internal.my.tld. Authentik's logs also show that authentication was successful:{"auth_via": "session", "domain_url": "auth.my.tld", "event": "/application/o/authorize/?max_age=0&scope=openid+profile+email&display=popup&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Foauth%2Fcallback%3Fclient_name%3DOidcClient&state=0aff847c7c&code_challenge_method=S256&prompt=select_account&nonce=OMITTED&client_id=OMITTED&code_challenge=OMITTED", "host": "auth.my.tld", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 80162, "remote": "10.66.66.2", "request_id": "15967659903f4fd58fa74df3946fcabc", "runtime": 10, "schema_name": "public", "scheme": "https", "status": 400, "timestamp": "2024-11-07T14:00:06.103486", "user": "OMITTED", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}My suspicion is that somewhere in either my Authentik or Faction settings, the
FACTION_OAUTH_CALLBACKvariable is not being honoured but I'm not 100% sure why or where. I'd appreciate a 2nd pair of eyes in discovering what I'm doing wrong. I'm also happy to send over more debugging info if it's needed. Thanks!The text was updated successfully, but these errors were encountered: