OIDC redirect to "/api/auth" just shows me the JSON

[kaibagley]

Hey guys,

As the title says, after logging in as a user in Authentik, I get redirected to some json with the following URL:

https://ryot.example.com/api/auth?code=somecode&state=somestate

Also, I made another discussion about how I don't know how to associate an Authentik login with an existing user in ryot, so it could just be related to this.

Thanks

[IgnisDa]

For existing user, please follow this guide: #750 (comment)

What does the JSON page say when you get redirected?

[kaibagley]

{"input":{"code":"somecode"}}

And when checking the database, there is no new user after logging in using authentik, probably for a similar reason

[IgnisDa]

Can you show the env variables you have set for getting OIDC working? Please make sure you redact out sensitive parts.

[kaibagley]

- FRONTEND_URL=https://ryot.example.com
- SERVER_OIDC_CLIENT_ID=oidc_id
- SERVER_OIDC_CLIENT_SECRET=oidc_secret
- SERVER_OIDC_ISSUER_URL=https://auth.example.com/application/o/ryot/

[IgnisDa]

Can you verify that the secrets and client id are correct? Also try the issuer URL without the trailing slash. Finally, you also need to give openid email scopes.

Is there anything in the docker logs which may indicate what might be wrong?

[kaibagley]

Client secret and ID are correct, and without the trailing slash I don't get the "Continue with OpenID Connect" option on the login page. I have openid and email scopes selected in Authentik.

Here is the log output:

[backend] 2024-07-04T14:14:59.563222Z  INFO ryot: Listening on: 0.0.0.0:5000
[frontend] [remix-serve] http://localhost:3000 (http://172.23.0.7:3000)
[frontend] GET /auth 200 - - 100.502 ms
[frontend] POST /auth.data?intent=getOauthRedirectUrl 202 - - 19.370 ms
[frontend] GET /api/auth?code=<somecode>&state=<somestate> 200 - - 772.607 ms
[frontend] Error: No route matches URL "/favicon.ico"
[frontend]     at getInternalRouterError (/home/ryot/node_modules/@remix-run/router/router.ts:5353:5)
[frontend]     at Object.query (/home/ryot/node_modules/@remix-run/router/router.ts:3462:19)
[frontend]     at handleDocumentRequest (/home/ryot/node_modules/@remix-run/server-runtime/dist/server.js:268:35)
[frontend]     at requestHandler (/home/ryot/node_modules/@remix-run/server-runtime/dist/server.js:160:24)
[frontend]     at /home/ryot/node_modules/@remix-run/express/dist/server.js:41:28
[frontend] GET /favicon.ico 404 - - 109.239 ms
[frontend] GET / 302 - - 30.895 ms
[frontend] GET /auth?redirectTo=%2F 200 - - 42.866 ms
[frontend] POST /auth.data?intent=getOauthRedirectUrl 202 - - 26.764 ms
[frontend] GET /api/auth?code=<somecode>&state=<somestate> 200 - - 759.266 ms
[frontend] GET / 302 - - 17.529 ms
[frontend] GET /auth?redirectTo=%2F 200 - - 53.393 ms
[frontend] GET /auth?redirectTo=%2F 200 - - 55.688 ms
[frontend] POST /auth.data?intent=getOauthRedirectUrl 202 - - 21.411 ms
[frontend] GET /api/auth?code=<somecode>&state=<somestate> 200 - - 987.356 ms

Where the following sections are all that appear in the log during the process:

• Load ryot
• Click "Continue with OpenID Connect"
• Sign in on Authentik
• Get redirected

[frontend] GET /auth?redirectTo=%2F 200 - - 55.688 ms
[frontend] POST /auth.data?intent=getOauthRedirectUrl 202 - - 21.411 ms
[frontend] GET /api/auth?code=<somecode>&state=<somestate> 200 - - 987.356 ms

[IgnisDa]

Can you join the Ryot discord? It would be difficult to debug the issue here.

[kaibagley]

Just sent a message to general

[kaibagley]

Discussion is on Discord, but this problem occured because I had USERS_ALLOW_REGISTRATION=false set in my compose.yml for ryot. Setting this to true was all I had to do to get it to work