[GH-ISSUE #5340] Login/Dashboard not working after localAuthDisabled #10407

Closed
opened 2026-08-05 01:25:48 -04:00 by saavagebueno · 3 comments
Owner

Originally created by @wm-ek on GitHub (Feb 15, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5340

Describe the problem

A clear and concise description of what the problem is.

To Reproduce

Steps to reproduce the behavior:

  1. Setup a new instance using the quick installer.
  2. Go to 'config.yaml'
  3. Add this value to auth: localAuthDisabled: true
  4. Try to login
  5. No login possible. The app will load and load and this error will show up:
Image

Even if you change back, no login form that point on!

Expected behavior

The embedded IdP should disappear from the login screen; login should still work.

Are you using NetBird Cloud?

self hosted

NetBird version

0.65.1

Is any other VPN software installed?

No

Debug output

before i commented the proxy auth

after running the proxy too, there are additional errors

´´´netbird-server | 2026-02-15T22:16:36Z WARN [context: GRPC, requestID: d694bh3ga3ic73fliu1g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:37Z WARN [context: GRPC, requestID: d694bhbga3ic73fliu20] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:38Z WARN [requestID: d694bhjga3ic73fliu2g, context: GRPC] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:38Z WARN [context: GRPC, requestID: d694bhjga3ic73fliu30] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:40Z WARN [context: GRPC, requestID: d694bi3ga3ic73fliu3g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:41Z WARN [context: GRPC, requestID: d694bibga3ic73fliu40] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
netbird-server | 2026-02-15T22:16:41Z WARN [context: GRPC, requestID: d694bibga3ic73fliu4g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts
´´´

Screenshots

Image

Additional context

traefik is used

google sso and authentik sso

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @wm-ek on GitHub (Feb 15, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5340 **Describe the problem** A clear and concise description of what the problem is. **To Reproduce** Steps to reproduce the behavior: 1. Setup a new instance using the quick installer. 2. Go to 'config.yaml' 3. Add this value to auth: localAuthDisabled: true 4. Try to login 5. No login possible. The app will load and load and this error will show up: <img width="448" height="358" alt="Image" src="https://github.com/user-attachments/assets/e5a2c90b-55ed-483a-93b8-6c004e80e155" /> Even if you change back, no login form that point on! **Expected behavior** The embedded IdP should disappear from the login screen; login should still work. **Are you using NetBird Cloud?** self hosted **NetBird version** 0.65.1 **Is any other VPN software installed?** No **Debug output** before i commented the proxy auth after running the proxy too, there are additional errors ´´´netbird-server | 2026-02-15T22:16:36Z WARN [context: GRPC, requestID: d694bh3ga3ic73fliu1g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:37Z WARN [context: GRPC, requestID: d694bhbga3ic73fliu20] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:38Z WARN [requestID: d694bhjga3ic73fliu2g, context: GRPC] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:38Z WARN [context: GRPC, requestID: d694bhjga3ic73fliu30] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:40Z WARN [context: GRPC, requestID: d694bi3ga3ic73fliu3g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:41Z WARN [context: GRPC, requestID: d694bibga3ic73fliu40] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts netbird-server | 2026-02-15T22:16:41Z WARN [context: GRPC, requestID: d694bibga3ic73fliu4g] management/internals/shared/grpc/proxy_auth.go:93: proxy auth failed: rpc error: code = ResourceExhausted desc = too many failed authentication attempts ´´´ **Screenshots** <img width="530" height="254" alt="Image" src="https://github.com/user-attachments/assets/32c8bede-0e8c-43e1-a8cd-12245edd1ba1" /> **Additional context** traefik is used google sso and authentik sso **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:25:48 -04:00
Author
Owner

@wm-ek commented on GitHub (Feb 16, 2026):

i found the reason dor the proxy erroe message; will do a second setup and try to disable local auth there again.

<!-- gh-comment-id:3906591047 --> @wm-ek commented on GitHub (Feb 16, 2026): i found the reason dor the proxy erroe message; will do a second setup and try to disable local auth there again.
Author
Owner

@wm-ek commented on GitHub (Feb 16, 2026):

I set up a new test instance and disabled local auth again
auth: issuer: "https://<url>/oauth2" localAuthDisabled: true signKeyRefreshEnabled: true dashboardRedirectURIs: - "https://<url>/nb-auth" - "https://<url>/nb-silent-auth" cliRedirectURIs: - "http://localhost:53000/"

this leads to issues:

  • Login Screen would just load until an errors occurs (504 Gateway Timeout); Screenshot above

I believe this is because of the netbird proxy configuration, which also uses that endpoint

The docs aren't clear here:

this doc (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#configure-sso-for-external-identity-providers) says

This section applies to deployments using a standalone external identity provider (Auth0, Okta, Keycloak, Zitadel, etc.) instead of the built-in embedded IdP (Dex). If you deployed using the quickstart script with default settings, you are using the embedded IdP and can skip this section.

if so, it should be clarified that when disabling local auth, those steps are necessary

Also, this doc (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#configure-sso-for-external-identity-providers) is still referring to the management .json, which is now the config.json.

Its not clear, if the proxy.env must be adjustet in this case, it contains oidc variables:

# NetBird Proxy Configuration
NB_PROXY_DEBUG_LOGS=false
# Use internal Docker network to connect to management (avoids hairpin NAT issues)
NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80
# Allow insecure gRPC connection to management (required for internal Docker network)
NB_PROXY_ALLOW_INSECURE=true
# Public URL where this proxy is reachable (used for cluster registration)
NB_PROXY_DOMAIN=<url>
NB_PROXY_ADDRESS=:8443
NB_PROXY_TOKEN=nbx_abc
NB_PROXY_CERTIFICATE_DIRECTORY=/certs
NB_PROXY_ACME_CERTIFICATES=true
NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01
NB_PROXY_OIDC_CLIENT_ID=netbird-proxy
NB_PROXY_OIDC_ENDPOINT=https://<url>/oauth2
NB_PROXY_OIDC_SCOPES=openid,profile,email
NB_PROXY_FORWARDED_PROTO=https

<!-- gh-comment-id:3908315537 --> @wm-ek commented on GitHub (Feb 16, 2026): I set up a new test instance and disabled local auth again `auth: issuer: "https://<url>/oauth2" localAuthDisabled: true signKeyRefreshEnabled: true dashboardRedirectURIs: - "https://<url>/nb-auth" - "https://<url>/nb-silent-auth" cliRedirectURIs: - "http://localhost:53000/" ` this leads to issues: - Login Screen would just load until an errors occurs (504 Gateway Timeout); Screenshot above I believe this is because of the netbird proxy configuration, which also uses that endpoint The docs aren't clear here: - the doc (https://docs.netbird.io/selfhosted/identity-providers/disable-local-authentication) doesn't reference to the changes needed if proxy is enabled: https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#configure-sso-for-external-identity-providers this doc (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#configure-sso-for-external-identity-providers) says > This section applies to deployments using a standalone external identity provider (Auth0, Okta, Keycloak, Zitadel, etc.) instead of the built-in embedded IdP (Dex). If you deployed using the quickstart script with default settings, you are using the embedded IdP and can skip this section. if so, it should be clarified that when disabling local auth, those steps are necessary Also, this doc (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#configure-sso-for-external-identity-providers) is still referring to the management .json, which is now the config.json. Its not clear, if the proxy.env must be adjustet in this case, it contains oidc variables: ``` # NetBird Proxy Configuration NB_PROXY_DEBUG_LOGS=false # Use internal Docker network to connect to management (avoids hairpin NAT issues) NB_PROXY_MANAGEMENT_ADDRESS=http://netbird-server:80 # Allow insecure gRPC connection to management (required for internal Docker network) NB_PROXY_ALLOW_INSECURE=true # Public URL where this proxy is reachable (used for cluster registration) NB_PROXY_DOMAIN=<url> NB_PROXY_ADDRESS=:8443 NB_PROXY_TOKEN=nbx_abc NB_PROXY_CERTIFICATE_DIRECTORY=/certs NB_PROXY_ACME_CERTIFICATES=true NB_PROXY_ACME_CHALLENGE_TYPE=tls-alpn-01 NB_PROXY_OIDC_CLIENT_ID=netbird-proxy NB_PROXY_OIDC_ENDPOINT=https://<url>/oauth2 NB_PROXY_OIDC_SCOPES=openid,profile,email NB_PROXY_FORWARDED_PROTO=https ```
Author
Owner

@wm-ek commented on GitHub (Feb 17, 2026):

issue does not exist anymore when upgrading to dashboard version v2.32.1 or higher

<!-- gh-comment-id:3913467641 --> @wm-ek commented on GitHub (Feb 17, 2026): issue does not exist anymore when upgrading to dashboard version v2.32.1 or higher
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10407