[GH-ISSUE #5673] Netbird sends openid scope twice to generic OIDC provider #10907

Open
opened 2026-08-05 01:27:40 -04:00 by saavagebueno · 4 comments
Owner

Originally created by @AbdulkadirAtAnb on GitHub (Mar 24, 2026).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/5673

Describe the problem

When using a generic OIDC provider Netbird will redirect you to the providers authentication page with the scopes set in AUTH_SUPPORTED_SCOPES in dashboard.env. In my setup these are openid groups profile email. However when redirecting Netbird replaces the groups scope with openid, resulting in openid openid profile email.

To Reproduce

Steps to reproduce the behavior:

  1. Setup generic OIDC provider
  2. Login with generic OIDC provider
  3. Login succeeds and user gets created in Netbird, but no group information will have come through from provider

Expected behavior

Netbird requests the scopes specified in AUTH_SUPPORTED_SCOPES.

Are you using NetBird Cloud?

I'm self-hosting the control plane.

NetBird version

netbird-server: 0.66.3
netbird-dashboard: 2.34.0

Is any other VPN software installed?

No

Debug output

Debug output from my mac client

Peers detail:
Events:
  [INFO] SYSTEM (170a5f3f-fa6f-416e-846d-af7d8614cb2b)
    Message: Network map updated
    Time: 51 minutes, 22 seconds ago
  [INFO] SYSTEM (4356ae5f-909d-472a-b91c-cb3898ce28bb)
    Message: Network map updated
    Time: 46 minutes, 21 seconds ago
  [INFO] SYSTEM (d5a79301-3a78-4e7b-9b60-7d3bbb3e1a15)
    Message: Network map updated
    Time: 41 minutes, 19 seconds ago
  [INFO] SYSTEM (5b666d97-7354-496b-864f-f0ad757c8fcc)
    Message: Network map updated
    Time: 36 minutes, 15 seconds ago
  [INFO] SYSTEM (df967950-02a1-446a-bb45-5b0562727393)
    Message: Network map updated
    Time: 31 minutes, 10 seconds ago
  [INFO] SYSTEM (2a549a1a-8d96-49be-81b0-3774d130937a)
    Message: Network map updated
    Time: 26 minutes, 4 seconds ago
  [INFO] SYSTEM (da6f1738-9ccc-42b3-b88e-3115b6bf5f58)
    Message: Network map updated
    Time: 21 minutes, 4 seconds ago
  [INFO] SYSTEM (3b14873b-cce5-44e7-8034-6d4f877f6a2e)
    Message: Network map updated
    Time: 15 minutes, 41 seconds ago
  [INFO] SYSTEM (e7703771-856a-4c92-b23f-9f3f77ba6667)
    Message: Network map updated
    Time: 10 minutes, 37 seconds ago
  [INFO] SYSTEM (e92f8e84-5284-43bc-9795-74c71a20bc22)
    Message: Network map updated
    Time: 5 minutes, 5 seconds ago
OS: darwin/arm64
Daemon version: 0.66.4
CLI version: 0.66.4
Profile: default
Management: Connected to https://netbird.anon-9vqOW.domain:443
Signal: Connected to https://netbird.anon-9vqOW.domain:443
Relays:
  [stun:netbird-stun.anon-9vqOW.domain:3478] is Checking...
  [rels://netbird.anon-9vqOW.domain:443] is Available
Nameservers:
FQDN: ip-192-168-129-1.netbird.selfhosted
NetBird IP: 100.127.33.91/16
Interface type: Userspace
Quantum resistance: false
Lazy connection: false
SSH Server: Disabled
Networks: -
Peers count: 0/0 Connected

Screenshots

Screenshot from my browser inspect window where netbird wants to redirect me to the external provider for authenication. Redacted hostnames, IPs, client id. Yellow outline shows scopes

Image

Additional context

When manually editing the redirect URL (see screenshot) to replace one of the duplicate openid scopes to groups everything works and group information comes through from the provider. This leads me to believe there is no problem on their end.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @AbdulkadirAtAnb on GitHub (Mar 24, 2026). Original GitHub issue: https://github.com/netbirdio/netbird/issues/5673 **Describe the problem** When using a generic OIDC provider Netbird will redirect you to the providers authentication page with the scopes set in `AUTH_SUPPORTED_SCOPES` in `dashboard.env`. In my setup these are `openid groups profile email`. However when redirecting Netbird replaces the groups scope with openid, resulting in `openid openid profile email`. **To Reproduce** Steps to reproduce the behavior: 1. Setup generic OIDC provider 2. Login with generic OIDC provider 3. Login succeeds and user gets created in Netbird, but no group information will have come through from provider **Expected behavior** Netbird requests the scopes specified in `AUTH_SUPPORTED_SCOPES`. **Are you using NetBird Cloud?** I'm self-hosting the control plane. **NetBird version** netbird-server: `0.66.3` netbird-dashboard: `2.34.0` **Is any other VPN software installed?** No **Debug output** Debug output from my mac client ``` Peers detail: Events: [INFO] SYSTEM (170a5f3f-fa6f-416e-846d-af7d8614cb2b) Message: Network map updated Time: 51 minutes, 22 seconds ago [INFO] SYSTEM (4356ae5f-909d-472a-b91c-cb3898ce28bb) Message: Network map updated Time: 46 minutes, 21 seconds ago [INFO] SYSTEM (d5a79301-3a78-4e7b-9b60-7d3bbb3e1a15) Message: Network map updated Time: 41 minutes, 19 seconds ago [INFO] SYSTEM (5b666d97-7354-496b-864f-f0ad757c8fcc) Message: Network map updated Time: 36 minutes, 15 seconds ago [INFO] SYSTEM (df967950-02a1-446a-bb45-5b0562727393) Message: Network map updated Time: 31 minutes, 10 seconds ago [INFO] SYSTEM (2a549a1a-8d96-49be-81b0-3774d130937a) Message: Network map updated Time: 26 minutes, 4 seconds ago [INFO] SYSTEM (da6f1738-9ccc-42b3-b88e-3115b6bf5f58) Message: Network map updated Time: 21 minutes, 4 seconds ago [INFO] SYSTEM (3b14873b-cce5-44e7-8034-6d4f877f6a2e) Message: Network map updated Time: 15 minutes, 41 seconds ago [INFO] SYSTEM (e7703771-856a-4c92-b23f-9f3f77ba6667) Message: Network map updated Time: 10 minutes, 37 seconds ago [INFO] SYSTEM (e92f8e84-5284-43bc-9795-74c71a20bc22) Message: Network map updated Time: 5 minutes, 5 seconds ago OS: darwin/arm64 Daemon version: 0.66.4 CLI version: 0.66.4 Profile: default Management: Connected to https://netbird.anon-9vqOW.domain:443 Signal: Connected to https://netbird.anon-9vqOW.domain:443 Relays: [stun:netbird-stun.anon-9vqOW.domain:3478] is Checking... [rels://netbird.anon-9vqOW.domain:443] is Available Nameservers: FQDN: ip-192-168-129-1.netbird.selfhosted NetBird IP: 100.127.33.91/16 Interface type: Userspace Quantum resistance: false Lazy connection: false SSH Server: Disabled Networks: - Peers count: 0/0 Connected ``` **Screenshots** Screenshot from my browser inspect window where netbird wants to redirect me to the external provider for authenication. Redacted hostnames, IPs, client id. Yellow outline shows scopes <img width="527" height="502" alt="Image" src="https://github.com/user-attachments/assets/3302e0cf-5ce8-4ca2-a953-5eb1f983cd81" /> **Additional context** When manually editing the redirect URL (see screenshot) to replace one of the duplicate openid scopes to groups everything works and group information comes through from the provider. This leads me to believe there is no problem on their end. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:27:40 -04:00
Author
Owner

@Nitive commented on GitHub (Apr 16, 2026):

I can confirm the same behavior on version 0.68.3 (latest at the moment) and without using the dashboard (auth via cli). However, it doesn't seem break anything

<!-- gh-comment-id:4260668902 --> @Nitive commented on GitHub (Apr 16, 2026): I can confirm the same behavior on version 0.68.3 (latest at the moment) and without using the dashboard (auth via cli). However, it doesn't seem break anything
Author
Owner

@Fortune6827 commented on GitHub (Apr 16, 2026):

+1

<!-- gh-comment-id:4260929218 --> @Fortune6827 commented on GitHub (Apr 16, 2026): +1
Author
Owner

@binboum commented on GitHub (Jun 19, 2026):

same, workaround is to using another provider like okta (but not very properly)

<!-- gh-comment-id:4748868490 --> @binboum commented on GitHub (Jun 19, 2026): same, workaround is to using another provider like okta (but not very properly)
Author
Owner

@CoderSufiyan commented on GitHub (Jul 12, 2026):

This should be fixed by #6743. The default OIDC scopes for generic providers were missing groups, which matched what okta and pocketid already included. If anyone can verify on a self-hosted setup, would be helpful.

<!-- gh-comment-id:4952055603 --> @CoderSufiyan commented on GitHub (Jul 12, 2026): This should be fixed by #6743. The default OIDC scopes for generic providers were missing `groups`, which matched what okta and pocketid already included. If anyone can verify on a self-hosted setup, would be helpful.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#10907