Gitlab OAUTH_CALLBACK_ERROR invalid_client #321
Assignees
Labels
bug
Something isn't working
Comments
|
Hey @sgohl , this is usually due to the BACKEND_API_BASE env var being either incorrectly set or unresolvable. This variable should be the internal hostname for the |
|
Hi, thanks for your answer! If I understand correctly, traefik is not involved here, since it's only the external loadbalancer for TLS termination for the users to get access to the frontend. I assume this is the case for 99% of all users having a reverse proxy in front of the frontend to provide a real domain with ssl. so, container to container works: Since the service |
|
@rohan-chaturvedi not a problem at all, thanks for responding anyway! so, From Browser-side, What not works is the login redirect mechanism:
as far as I see, all environment variables are set correctly: something else I could check? |
|
Your setup seems to be correct and I don't see any obvious issues. I assume you have Could you verify that the {"status": "alive"} |
|
Hi, I have the same issue, but with github... can i help with any additional info? |
|
@Apkahym Could you could share the details of your setup including:
Also you can add the |
|
I'm running Docker Compose, as the docs say. When i try to login, screen not change but the url change to
Docker Version: Docker version 24.0.7, build afdd53b Health endpoint it is ok GET https://localhost/service/health/ {"status": "alive"}Github App ConfigI only use the callback URL, I don't configure the other options Callback URL: https://localhost/api/auth/callback/github Docker compose fileservices:
nginx:
container_name: phase-nginx
build:
context: .
dockerfile: ./nginx/Dockerfile
restart: always
ports:
- 80:80
- 443:443
volumes:
- ./nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
depends_on:
- frontend
- backend
networks:
- phase-net
frontend:
container_name: phase-frontend
restart: unless-stopped
depends_on:
- backend
image: phasehq/frontend:latest
env_file: .env
environment:
NEXTAUTH_URL: "${HTTP_PROTOCOL}${HOST}"
BACKEND_API_BASE: "http://backend:8000"
NEXT_PUBLIC_BACKEND_API_BASE: "${HTTP_PROTOCOL}${HOST}/service/"
NEXT_PUBLIC_NEXTAUTH_PROVIDERS: "${SSO_PROVIDERS}"
networks:
- phase-net
backend:
container_name: phase-backend
restart: unless-stopped
depends_on:
- postgres
- redis
image: phasehq/backend:latest
env_file: .env
environment:
OAUTH_REDIRECT_URI: "${HTTP_PROTOCOL}${HOST}"
ALLOWED_HOSTS: "${HOST},backend"
ALLOWED_ORIGINS: "${HTTP_PROTOCOL}${HOST}"
SESSION_COOKIE_DOMAIN: "${HOST}"
networks:
- phase-net
worker:
container_name: phase-worker
restart: unless-stopped
depends_on:
- postgres
- redis
image: phasehq/backend:latest
command: python manage.py rqworker default
env_file: .env
environment:
ALLOWED_HOSTS: "${HOST},backend"
ALLOWED_ORIGINS: "${HTTP_PROTOCOL}${HOST}"
SESSION_COOKIE_DOMAIN: "${HOST}"
networks:
- phase-net
postgres:
container_name: phase-postgres
image: postgres:15.4-alpine3.17
restart: always
env_file:
- .env
environment:
POSTGRES_DB: ${DATABASE_NAME}
POSTGRES_USER: ${DATABASE_USER}
POSTGRES_PASSWORD: ${DATABASE_PASSWORD}
POSTGRES_HOST_AUTH_METHOD: "trust"
volumes:
- phase-postgres-data:/var/lib/postgresql/data
networks:
- phase-net
redis:
container_name: phase-redis
image: redis:alpine3.19
restart: always
networks:
- phase-net
volumes:
phase-postgres-data:
driver: local
networks:
phase-net:.envHOST=localhost
HTTP_PROTOCOL=https://
DEBUG=true
#USER_EMAIL_DOMAIN_WHITELIST=mydomain.com,subdomain.mydomain.com
NEXTAUTH_SECRET=82031b3760ac58352bb2d48fd9f32e9f72a0614343b669038139f18652ed1447
SECRET_KEY=92d44efc4f9a4c0556cc67d2d033d3217829c263d5ab7d1954cf4b5bfd533e58
SERVER_SECRET=9e760539415af07b22249b5878593bd4deb9b8961c7dd0570117549f2c4f32a2
SSO_PROVIDERS=github
#GOOGLE_CLIENT_ID=
#GOOGLE_CLIENT_SECRET=
GITHUB_CLIENT_ID=Iv*****************62M
GITHUB_CLIENT_SECRET=d8d*******************************1de614
#GITLAB_CLIENT_ID=
#GITLAB_CLIENT_SECRET=
#GITHUB_INTEGRATION_CLIENT_ID=
#GITHUB_INTEGRATION_CLIENT_SECRET=
DATABASE_PORT=5432
DATABASE_NAME=postgres-db-name
DATABASE_USER=postgres-user
DATABASE_PASSWORD=a765b221799be364c53c8a32acccf5dd90d5fc832607bdd14fccaaaa0062adfd
REDIS_HOST=redis
REDIS_PORT=6379
REDIS_PASSWORD=
NEXT_TELEMETRY_DISABLED=1Nginx DockerfileFROM nginx
RUN apt-get update && \
apt-get install -y openssl && \
mkdir -p /etc/nginx/ssl && \
openssl ecparam -genkey -name secp384r1 | openssl ec -out /etc/nginx/ssl/nginx.key && \
openssl req -new -x509 -sha256 -key /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt -days 365 \
-subj "/C=SG/ST=Wordwideweb/L=The Cloud/CN=example.com" \Nginx ConfLogsBackendFrontendnginxWorkerPostgresRedis
|
|
https://docs.phase.dev/self-hosting/configuration/envars#git-lab-sso is inconsistent: It tells to set the callback url to which one is correct? For me: with trailing slash: Login process stuck at Gitlab site: without trailing slash There is no I know, nginx strips from outside: I also tried setting Gitlab Application to Confidential YES and NO. Trusted is YES my full p.s. I am using self-hosted Community Edition of Gitlab. |
|
@sgohl For verbose logs, try
Apologies for the inconsistency in the docs. The correct URI is without a trailing slash. I'm making this fix in the docs as well: phasehq/docs#95
What version of the Console are running? Could you try updating to the latest release, as we added this health endpoint quite recently
These settings should not have any effect on the SSO setup or the ability to login, which is why we left it out of the docs. I'll try and set up a GitLab instance locally to replicate your setup and see if I can figure out what is wrong, but most of this time this is due to the frontend container not being able to communicate with the backend. |
|
@Apkahym Thanks for providing detailed logs and configs. I have managed to replicate your setup locally, but unfortunately not your error. I was able to log in with GitHub SSO just fine. I even tried setting up Phase on a fresh EC2 instance, but couldn't replicate the issue. The only couple of differences I see that you have made are:
server {
listen 80;
listen 443 ssl; # http2 here
...
}This, however, shouldn't cause any issues. I would suggest you give it another go, perhaps with another SSO provider. If you would like, I'm happy to get on a call and debug this with you. You can ping me on Slack: https://slack.phase.dev |
|
@sgohl Is your GitLab instance using a self-signed certificate? 🤔 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
After successful login to gitlab, redirect to phase results in
error=OAuthCallback/invalid_clientTo Reproduce
docker composeusing https://docs.phase.dev/self-hosting/docker-compose#2-download-the-configurationsv17.2.1)Gitlab (Admin area/instance-wide) Application:
docker compose logs -fExpected behavior
Successful Login
Platform you are having the issue on:
docker version
24.0.5Additional context
I assume this is not an actual bug, but if it's a configuration issue, I don't know what I've done wrong.
Documentation might lack an important information
The text was updated successfully, but these errors were encountered: