[GH-ISSUE #2123] Error: Unauthenticated, signin works only using setup keys #4117

Open
opened 2026-08-05 00:55:59 -04:00 by saavagebueno · 0 comments
Owner

Originally created by @ozoromo on GitHub (Jun 12, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2123

Describe the problem

When trying to sign in using SSO (Zitadel) everything works fine on the SSO side and the user is redirected back to https://netbird.mydomain.com/auth?code=longcodehere and sees the following error there:

*Oops, something went wrong* There was an error logging you in. Error: Unauthenticated

To Reproduce

Steps to reproduce the behavior:

  1. Run command 'sudo netbird up --management-url https://netbird.mydomain.com:443'
  2. Browser opens
  3. SSO login
  4. See error

Expected behavior

After being redirected back to Netbird the tab should close or redirect to the main UI and the client should be added to the peers

Are you using NetBird Cloud?

No, I am selfhosting

NetBird version

0.27.10 (on client)

NetBird status -d output:

Netbird status of a client added using setup keys:

OS: linux/amd64
Daemon version: 0.27.10
CLI version: 0.27.10
Management: Connected
Signal: Connected
Relays: 2/2 Available
Nameservers: 0/0 Available
FQDN: vpsd2uodks.netbird.selfhosted
NetBird IP: 100.124.152.40/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected

Screenshots

Page that appears
image

Additional context

The following error appears in netbird-managements log:
WARN management/server/grpcserver.go:371: failed logging in peer xkk8XC31+NOZzHfFPzybhp8DbByrixl/nU8XlPJhT0o=: no peer auth method provided, please use a setup key or interactive SSO login

management.json (redacted)
{
  "DataStoreEncryptionKey": "long enryption key",
  "Datadir": "/var/lib/netbird-mgmt/data",
  "DeviceAuthorizationFlow": {
    "Provider": "hosted",
    "ProviderConfig": {
      "Audience": "numericalid@netbird",
      "ClientID": "numericalid@netbird",
      "ClientSecret": "longsecretstring",
      "DeviceAuthEndpoint": "https://auth.mydomain.com/oauth/v2/device_authorization",
      "Domain": "https://auth.mydomain.com",
      "Scope": "openid",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token",
      "UseIDToken": false
    }
  },
  "HttpConfig": {
    "Address": "127.0.0.1:8011",
    "AuthAudience": "numericalid@netbird",
    "AuthIssuer": "https://auth.mydomain.com",
    "AuthKeysLocation": "https://auth.mydomain.com/oauth/v2/keys",
    "IdpSignKeyRefreshEnabled": true,
    "OIDCConfigEndpoint": "https://auth.mydomain.com/.well-known/openid-configuration"
  },
  "IdpManagerConfig": {
    "Auth0ClientCredentials": null,
    "AzureClientCredentials": null,
    "ClientConfig": {
      "ClientID": "netbird",
      "ClientSecret": "longsecretstring",
      "GrantType": "client_credentials",
      "Issuer": "https://auth.mydomain.com",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token"
    },
    "ExtraConfig": {
      "ManagementEndpoint": "https://auth.mydomain.com/management/v1"
    },
    "KeycloakClientCredentials": null,
    "ManagerType": "zitadel",
    "ZitadelClientCredentials": null
  },
  "PKCEAuthorizationFlow": {
    "ProviderConfig": {
      "Audience": "numericalid@netbird",
      "AuthorizationEndpoint": "https://auth.mydomain.com/oauth/v2/authorize",
      "ClientID": "numericalid@netbird",
      "ClientSecret": "longsecretstring",
      "RedirectURLs": [
        "https://netbird.mydomain.com/auth",
        "https://netbird.mydomain.com/silent-auth"
      ],
      "Scope": "openid profile email offline_access api",
      "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token",
      "UseIDToken": false
    }
  },
 "ReverseProxy": {
    "TrustedHTTPProxies": [],
    "TrustedHTTPProxiesCount": 0,
    "TrustedPeers": [
      "0.0.0.0/0"
    ]
  },
  "Signal": {
    "Password": null,
    "Proto": "https",
    "URI": "netbird.mydomain.com:443",
    "Username": ""
  },
  "StoreConfig": {
    "Engine": "sqlite"
  },
  "Stuns": [
    {
      "Password": "some long credential",
      "Proto": "udp",
      "URI": "stun:netbird.mydomain.com:3478",
      "Username": "netbird"
    }
  ],
  "TURNConfig": {
    "CredentialsTTL": "12h",
    "Secret": "some long credential",
    "TimeBasedCredentials": false,
    "Turns": [
      {
        "Password": "some long credential",
        "Proto": "udp",
        "URI": "turn:netbird.mydomain.com:3478",
        "Username": "netbird"
      }
    ]
  }
}
Originally created by @ozoromo on GitHub (Jun 12, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2123 **Describe the problem** When trying to sign in using SSO (Zitadel) everything works fine on the SSO side and the user is redirected back to `https://netbird.mydomain.com/auth?code=longcodehere` and sees the following error there: `*Oops, something went wrong* There was an error logging you in. Error: Unauthenticated` **To Reproduce** Steps to reproduce the behavior: 1. Run command 'sudo netbird up --management-url https://netbird.mydomain.com:443' 2. Browser opens 3. SSO login 4. See error **Expected behavior** After being redirected back to Netbird the tab should close or redirect to the main UI and the client should be added to the peers **Are you using NetBird Cloud?** No, I am selfhosting **NetBird version** `0.27.10` (on client) **NetBird status -d output:** Netbird status of a client added using setup keys: ```python OS: linux/amd64 Daemon version: 0.27.10 CLI version: 0.27.10 Management: Connected Signal: Connected Relays: 2/2 Available Nameservers: 0/0 Available FQDN: vpsd2uodks.netbird.selfhosted NetBird IP: 100.124.152.40/16 Interface type: Kernel Quantum resistance: false Routes: - Peers count: 1/1 Connected ``` **Screenshots** Page that appears ![image](https://github.com/netbirdio/netbird/assets/36481318/0700ef66-7523-4192-b55b-62363e41a7e0) **Additional context** The following error appears in `netbird-management`s log: `WARN management/server/grpcserver.go:371: failed logging in peer xkk8XC31+NOZzHfFPzybhp8DbByrixl/nU8XlPJhT0o=: no peer auth method provided, please use a setup key or interactive SSO login` <details> <summary>management.json (redacted)</summary> ```json { "DataStoreEncryptionKey": "long enryption key", "Datadir": "/var/lib/netbird-mgmt/data", "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "Audience": "numericalid@netbird", "ClientID": "numericalid@netbird", "ClientSecret": "longsecretstring", "DeviceAuthEndpoint": "https://auth.mydomain.com/oauth/v2/device_authorization", "Domain": "https://auth.mydomain.com", "Scope": "openid", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token", "UseIDToken": false } }, "HttpConfig": { "Address": "127.0.0.1:8011", "AuthAudience": "numericalid@netbird", "AuthIssuer": "https://auth.mydomain.com", "AuthKeysLocation": "https://auth.mydomain.com/oauth/v2/keys", "IdpSignKeyRefreshEnabled": true, "OIDCConfigEndpoint": "https://auth.mydomain.com/.well-known/openid-configuration" }, "IdpManagerConfig": { "Auth0ClientCredentials": null, "AzureClientCredentials": null, "ClientConfig": { "ClientID": "netbird", "ClientSecret": "longsecretstring", "GrantType": "client_credentials", "Issuer": "https://auth.mydomain.com", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token" }, "ExtraConfig": { "ManagementEndpoint": "https://auth.mydomain.com/management/v1" }, "KeycloakClientCredentials": null, "ManagerType": "zitadel", "ZitadelClientCredentials": null }, "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "numericalid@netbird", "AuthorizationEndpoint": "https://auth.mydomain.com/oauth/v2/authorize", "ClientID": "numericalid@netbird", "ClientSecret": "longsecretstring", "RedirectURLs": [ "https://netbird.mydomain.com/auth", "https://netbird.mydomain.com/silent-auth" ], "Scope": "openid profile email offline_access api", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token", "UseIDToken": false } }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] }, "Signal": { "Password": null, "Proto": "https", "URI": "netbird.mydomain.com:443", "Username": "" }, "StoreConfig": { "Engine": "sqlite" }, "Stuns": [ { "Password": "some long credential", "Proto": "udp", "URI": "stun:netbird.mydomain.com:3478", "Username": "netbird" } ], "TURNConfig": { "CredentialsTTL": "12h", "Secret": "some long credential", "TimeBasedCredentials": false, "Turns": [ { "Password": "some long credential", "Proto": "udp", "URI": "turn:netbird.mydomain.com:3478", "Username": "netbird" } ] } } ``` </details>
saavagebueno added the waiting-feedbackidpself-hosting labels 2026-08-05 00:55:59 -04:00
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#4117