[GH-ISSUE #5129] Management Container won't start when custom IDP isn't available #10766

Open
opened 2026-08-05 01:27:13 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @a8291 on GitHub (Jan 19, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5129

I recently installed netbird with the integrated dex idp. After that i added Authentik as custom idp provider. I was and still am in the impression that netbird should also start (work) when the external idp is not available. Thats at least for me not the case. When Authentik is not rechable the management container won't start with the error.

Steps to reproduce the behavior:
Make the idp unreachable.

Expected behavior

Netbird starts with the integrated dex idp.

Are you using NetBird Cloud?
self-host

NetBird version

netbird version 0.63.0

Is any other VPN software installed?

no

Debug output

netbird-management | 2026-01-19T08:38:54Z INFO management/cmd/management.go:306: running with the embedded IdP: https://bird./oauth2
netbird-management | 2026-01-19T08:38:54Z INFO management/cmd/management.go:309: Relay addresses: [rels://bird.:443]
netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/store.go:292: using SQLite store engine
netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/sql_store.go:98: Setting transaction timeout to 5m0s
netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/sql_store.go:112: Set max open db connections to 1, max idle to 1, max lifetime to 1h0m0s, max idle time to 3m0s
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:263: No plain setup keys found in table setup_keys, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:301: Migration of plain setup key to hashed setup key completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enabled found in table network_resources, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enabled to default value in table network_resources completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enabled found in table network_routers, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enabled to default value in table network_routers completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty name found in table users, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty name to default value in table users completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty email found in table users, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty email to default value in table users completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_account_ip already exists on table peers
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_account_dnslabel already exists on table peers
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_peers_key_unique already exists on table peers
netbird-management | 2026-01-19T08:38:54Z INFO management/internals/server/modules.go:45: geolocation service has been initialized from /var/lib/netbird/
netbird-management | 2026-01-19T08:38:54Z INFO management/server/telemetry/app_metrics.go:193: enabled application metrics and exposing on http://0.0.0.0:9090
netbird-management | 2026-01-19T08:38:54Z WARN management/internals/server/boot.go:108: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing.
netbird-management | 2026-01-19T08:38:54Z INFO management/server/account_request_buffer.go:45: set account request buffer interval to 100ms
netbird-management | 2026-01-19T08:38:54Z INFO management/server/activity/store/sql_store.go:261: using sqlite as activity event store engine
netbird-management | 2026-01-19T08:38:54Z INFO management/server/activity/store/sql_store.go:290: Set max open db connections to 1, max idle to 1, max lifetime to 1h0m0s, max idle time to 3m0s
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty name found in table deleted_users, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty name to default value in table deleted_users completed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enc_algo found in table deleted_users, no migration needed
netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enc_algo to default value in table deleted_users completed
netbird-management | 2026-01-19T08:38:54Z WARN management/internals/controllers/network_map/controller/controller.go:84: failed to parse NB_EXPERIMENT_NETWORK_MAP, using default value false: strconv.ParseBool: parsing "": invalid syntax
netbird-management | 2026-01-19T08:38:54Z FATL management/internals/server/modules.go:107: failed to create embedded IDP manager: failed to create embedded IdP provider: failed to create dex server: server: Failed to open connector authentik-d5jor8503dpc7395k7ig: failed to open connector: failed to create connector authentik-d5jor8503dpc7395k7ig: failed to get provider: Get "https://auth./application/o/netbird/.well-known/openid-configuration": dial tcp 127.0.0.1:443: connect: connection refused

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • [x ] Checked for newer NetBird versions
  • [ x] Searched for similar issues on GitHub (including closed ones)
Originally created by @a8291 on GitHub (Jan 19, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5129 I recently installed netbird with the integrated dex idp. After that i added Authentik as custom idp provider. I was and still am in the impression that netbird should also start (work) when the external idp is not available. Thats at least for me not the case. When Authentik is not rechable the management container won't start with the error. Steps to reproduce the behavior: Make the idp unreachable. **Expected behavior** Netbird starts with the integrated dex idp. **Are you using NetBird Cloud?** self-host **NetBird version** `netbird version 0.63.0` **Is any other VPN software installed?** no **Debug output** > netbird-management | 2026-01-19T08:38:54Z INFO management/cmd/management.go:306: running with the embedded IdP: https://bird.<domain>/oauth2 > netbird-management | 2026-01-19T08:38:54Z INFO management/cmd/management.go:309: Relay addresses: [rels://bird.<domain>:443] > netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/store.go:292: using SQLite store engine > netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/sql_store.go:98: Setting transaction timeout to 5m0s > netbird-management | 2026-01-19T08:38:54Z INFO management/server/store/sql_store.go:112: Set max open db connections to 1, max idle to 1, max lifetime to 1h0m0s, max idle time to 3m0s > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:263: No plain setup keys found in table setup_keys, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:301: Migration of plain setup key to hashed setup key completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enabled found in table network_resources, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enabled to default value in table network_resources completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enabled found in table network_routers, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enabled to default value in table network_routers completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty name found in table users, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty name to default value in table users completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty email found in table users, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty email to default value in table users completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_account_ip already exists on table peers > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_account_dnslabel already exists on table peers > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:399: index idx_peers_key_unique already exists on table peers > netbird-management | 2026-01-19T08:38:54Z INFO management/internals/server/modules.go:45: geolocation service has been initialized from /var/lib/netbird/ > netbird-management | 2026-01-19T08:38:54Z INFO management/server/telemetry/app_metrics.go:193: enabled application metrics and exposing on http://0.0.0.0:9090 > netbird-management | 2026-01-19T08:38:54Z WARN management/internals/server/boot.go:108: TrustedPeers are configured to default value '0.0.0.0/0', '::/0'. This allows connection IP spoofing. > netbird-management | 2026-01-19T08:38:54Z INFO management/server/account_request_buffer.go:45: set account request buffer interval to 100ms > netbird-management | 2026-01-19T08:38:54Z INFO management/server/activity/store/sql_store.go:261: using sqlite as activity event store engine > netbird-management | 2026-01-19T08:38:54Z INFO management/server/activity/store/sql_store.go:290: Set max open db connections to 1, max idle to 1, max lifetime to 1h0m0s, max idle time to 3m0s > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty name found in table deleted_users, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty name to default value in table deleted_users completed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:344: No rows with empty enc_algo found in table deleted_users, no migration needed > netbird-management | 2026-01-19T08:38:54Z INFO management/server/migration/migration.go:358: Migration of empty enc_algo to default value in table deleted_users completed > netbird-management | 2026-01-19T08:38:54Z WARN management/internals/controllers/network_map/controller/controller.go:84: failed to parse NB_EXPERIMENT_NETWORK_MAP, using default value false: strconv.ParseBool: parsing "": invalid syntax > netbird-management | 2026-01-19T08:38:54Z FATL management/internals/server/modules.go:107: failed to create embedded IDP manager: failed to create embedded IdP provider: failed to create dex server: server: Failed to open connector authentik-d5jor8503dpc7395k7ig: failed to open connector: failed to create connector authentik-d5jor8503dpc7395k7ig: failed to get provider: Get "https://auth.<domain>/application/o/netbird/.well-known/openid-configuration": dial tcp 127.0.0.1:443: connect: connection refused Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [x ] Checked for newer NetBird versions - [ x] Searched for similar issues on GitHub (including closed ones)
saavagebueno added the triage-needed label 2026-08-05 01:27:13 -04:00
Author
Owner

@anondigriz commented on GitHub (Jan 23, 2026):

I also ran into this issue when my external IDP manager was not available. I have the same error in the logs of the management container as in the message above (FATL management/internals/server/modules.go:107: failed to create embedded IDP manager). To access my external IDP manager, a netbird connection is required (hosted in a home lab with a gray IP).

To solve this problem, I disabled the external IDP by directly modifying the SQLite database from management (/var/lib/netbird/idp.db). I removed the configuration row in the connector table with external IDP.
After restarting the containers, I was able to connect to the dashboard via embedded IDP.

<!-- gh-comment-id:3790378193 --> @anondigriz commented on GitHub (Jan 23, 2026): I also ran into this issue when my external IDP manager was not available. I have the same error in the logs of the management container as in the message above (`FATL management/internals/server/modules.go:107: failed to create embedded IDP manager`). To access my external IDP manager, a netbird connection is required (hosted in a home lab with a gray IP). To solve this problem, I disabled the external IDP by directly modifying the SQLite database from management (`/var/lib/netbird/idp.db`). I removed the configuration row in the `connector` table with external IDP. After restarting the containers, I was able to connect to the dashboard via embedded IDP.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10766