[GH-ISSUE #2485] Cannot connect via SSO from a linux cli #5052

Open
opened 2026-08-05 01:01:03 -04:00 by saavagebueno · 9 comments
Owner

Originally created by @JonathanManass on GitHub (Aug 26, 2024).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/2485

Describe the problem

Whenever running netbird up from a remote linux vm via the cli I get the following error if I do not give it an access key :

2024-08-26T11:55:04Z ERRO management/client/grpc.go:350: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login
2024-08-26T11:55:04Z WARN client/server/server.go:259: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0
2024-08-26T11:55:04Z WARN client/internal/device_auth.go:81: server couldn't find device flow, contact admin: rpc error: code = NotFound desc = no device authorization flow information available

SSO has been correctly set and I all windows personal computers connected can properly connect via Azure.

I'm not sure whether it is a bug, related to configuration, or just that it does not work because I'm trying to connect via SSO on a machine without a graphical interface

To Reproduce

  • Install netbird on a linux vm
  • run netbird up --management-url xxx

Expected behavior

For it to be able to work, similarly to for example, aws sso login by either opening up a browser or giving a link to press that will connect you.

Are you using NetBird Cloud?

Self-Hosted

NetBird version

0.28.8

Originally created by @JonathanManass on GitHub (Aug 26, 2024). Original GitHub issue: https://github.com/netbirdio/netbird/issues/2485 **Describe the problem** Whenever running netbird up from a remote linux vm via the cli I get the following error if I do not give it an access key : ``` 2024-08-26T11:55:04Z ERRO management/client/grpc.go:350: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login 2024-08-26T11:55:04Z WARN client/server/server.go:259: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0 2024-08-26T11:55:04Z WARN client/internal/device_auth.go:81: server couldn't find device flow, contact admin: rpc error: code = NotFound desc = no device authorization flow information available ``` SSO has been correctly set and I all windows personal computers connected can properly connect via Azure. I'm not sure whether it is a bug, related to configuration, or just that it does not work because I'm trying to connect via SSO on a machine without a graphical interface **To Reproduce** - Install netbird on a linux vm - run `netbird up --management-url xxx` **Expected behavior** For it to be able to work, similarly to for example, aws sso login by either opening up a browser or giving a link to press that will connect you. **Are you using NetBird Cloud?** Self-Hosted **NetBird version** 0.28.8
saavagebueno added the triage-needed label 2026-08-05 01:01:03 -04:00
Author
Owner

@jb606 commented on GitHub (Aug 27, 2024):

Hello,
I think you will need to use a setup key when your device does not have a GUI.

<!-- gh-comment-id:2311770157 --> @jb606 commented on GitHub (Aug 27, 2024): Hello, I think you will need to use a [setup key](https://docs.netbird.io/how-to/register-machines-using-setup-keys) when your device does not have a GUI.
Author
Owner

@lblazewski commented on GitHub (Aug 27, 2024):

Observing the same issue. I recall this used to work in the past where a link was present in the console that could be copy pasted to browser in order to finish the auth flow and then the machine would be connected (I was using this just for testing, I know that setup keys should be used in such cases).

<!-- gh-comment-id:2312400689 --> @lblazewski commented on GitHub (Aug 27, 2024): Observing the same issue. I recall this used to work in the past where a link was present in the console that could be copy pasted to browser in order to finish the auth flow and then the machine would be connected (I was using this just for testing, I know that setup keys should be used in such cases).
Author
Owner

@vernhart commented on GitHub (Oct 16, 2024):

I am seeing this problem as well. The same process works fine on my mac. I issue the netbird up command and it gives me a URL that I have to paste into my web browser.
Under linux (I'm running from a lxd container) I get the above rpc error.
My linux client is 0.30.2 and my mac is using 0.30.0.

<!-- gh-comment-id:2417873278 --> @vernhart commented on GitHub (Oct 16, 2024): I am seeing this problem as well. The same process works fine on my mac. I issue the netbird up command and it gives me a URL that I have to paste into my web browser. Under linux (I'm running from a lxd container) I get the above rpc error. My linux client is 0.30.2 and my mac is using 0.30.0.
Author
Owner

@atomlab commented on GitHub (Apr 24, 2025):

The same issue.

Netbird agent: 0.42.0
Netbird manager: 0.41.3
Keycloak: 25.0.4

I can successfully log in to the Netbird dashboard at https://netbird.mydomain.com via Keycloak in the browser. However, when attempting to connect a Netbird agent on a local Linux machine with a KDE desktop environment, I encounter an error. My goal is to use SSO authentication for the client, leveraging the interactive browser-based login flow.

The netbird up command fails with the following error:

% netbird up --management-url https://netbird.mydomain.com --admin-url https://netbird.mydomain.com

2025-04-24T18:14:45+03:00 WARN client/cmd/root.go:250: retrying Login to the Management service in 5.268709461s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

At the same time, the Netbird management server logs show:

2025-04-24T15:14:51Z WARN [context: GRPC, requestID: 907249e3-1940-432c-aaae-168e7244df4b, accountID: UNKNOWN, peerID: OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=] management/server/grpcserver.go:474: failed logging in peer OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=: no peer auth method provided, please use a setup key or interactive SSO login

Confirmation of browser integration on the client computer:

% xdg-settings get default-web-browser
vivaldi-stable.desktop

% xdg-open http://stackoverflow.com
# Successfully opens link in Vivaldi

UPDATE: My mistake.
By mistake, I did not fill in the PKCEAuthorizationFlow.RedirectURLs field in management.json. I added the same values as in the Keycloak for the netbird client in the Valid Redirect URIs and the redirect to the browser from the console was successful.

{
    ...
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            ...
            "RedirectURLs": [
                "http://localhost:53000",
                "https://netbird.mydomain.com"
            ],
            ...
}
<!-- gh-comment-id:2828145297 --> @atomlab commented on GitHub (Apr 24, 2025): The same issue. **Netbird agent: 0.42.0** **Netbird manager: 0.41.3** **Keycloak: 25.0.4** I can successfully log in to the Netbird dashboard at https://netbird.mydomain.com via Keycloak in the browser. However, when attempting to connect a Netbird agent on a local Linux machine with a KDE desktop environment, I encounter an error. My goal is to use SSO authentication for the client, leveraging the interactive browser-based login flow. The `netbird up` command fails with the following error: >% netbird up --management-url https://netbird.mydomain.com --admin-url https://netbird.mydomain.com > >2025-04-24T18:14:45+03:00 WARN client/cmd/root.go:250: retrying Login to the Management service in 5.268709461s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys At the same time, the Netbird management server logs show: > 2025-04-24T15:14:51Z WARN [context: GRPC, requestID: 907249e3-1940-432c-aaae-168e7244df4b, accountID: UNKNOWN, peerID: OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=] management/server/grpcserver.go:474: failed logging in peer OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=: no peer auth method provided, please use a setup key or interactive SSO login Confirmation of browser integration on the client computer: ``` % xdg-settings get default-web-browser vivaldi-stable.desktop % xdg-open http://stackoverflow.com # Successfully opens link in Vivaldi ``` **UPDATE:** My mistake. By mistake, I did not fill in the `PKCEAuthorizationFlow.RedirectURLs` field in `management.json`. I added the same values as in the Keycloak for the netbird client in the **Valid Redirect URIs** and the redirect to the browser from the console was successful. ```json { ... "PKCEAuthorizationFlow": { "ProviderConfig": { ... "RedirectURLs": [ "http://localhost:53000", "https://netbird.mydomain.com" ], ... } ```
Author
Owner

@dbgalz11 commented on GitHub (Nov 16, 2025):

Hi is this issue resolved? I have the same problem using wsl2 - ubuntu 22.04. We are using Entra Id as SSO provider.

Error logs:

netbird up --management-url https://netbird.xxx.xxxxnet:33073
2025-11-16T18:42:20+08:00 WARN client/cmd/root.go:248: retrying Login to the Management service in 567.653817ms due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys
Error: daemon up failed: login backoff cycle failed: rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

docker management logs:

2025-11-16T10:01:35Z WARN [context: GRPC, requestID: 1c444a96-2c21-4fb6-a0e1-a336bf2015d8, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:03:41Z WARN [peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: 3e914a69-1e55-4fa9-97fc-67b74ed98573, accountID: UNKNOWN] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:04:22Z WARN [context: GRPC, requestID: be59add1-bfe9-400b-8b08-f2fac09d7102, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:08:30Z WARN [context: GRPC, requestID: 27fed642-c573-481e-9da0-269c46266127, accountID: d38jqigm0anc73crcpvg, peerID: ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=] management/server/grpcserver.go:543: failed logging in peer ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=: peer login has expired, please log in once more
2025/11/16 10:14:33 http: TLS handshake error from 122.171.19.226:19598: read tcp 192.168.2.5:443->122.171.19.226:19598: read: connection timed out
2025-11-16T10:15:03Z WARN [context: GRPC, requestID: 89e5e408-4428-4d03-af6d-c6aa8121860d, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:15:44Z WARN [accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: dce38474-144b-426a-8c0d-44ac93951cfa] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
<!-- gh-comment-id:3538521747 --> @dbgalz11 commented on GitHub (Nov 16, 2025): Hi is this issue resolved? I have the same problem using wsl2 - ubuntu 22.04. We are using Entra Id as SSO provider. Error logs: ```shell netbird up --management-url https://netbird.xxx.xxxxnet:33073 2025-11-16T18:42:20+08:00 WARN client/cmd/root.go:248: retrying Login to the Management service in 567.653817ms due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys Error: daemon up failed: login backoff cycle failed: rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys ``` docker management logs: ```shell 2025-11-16T10:01:35Z WARN [context: GRPC, requestID: 1c444a96-2c21-4fb6-a0e1-a336bf2015d8, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:03:41Z WARN [peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: 3e914a69-1e55-4fa9-97fc-67b74ed98573, accountID: UNKNOWN] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:04:22Z WARN [context: GRPC, requestID: be59add1-bfe9-400b-8b08-f2fac09d7102, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:08:30Z WARN [context: GRPC, requestID: 27fed642-c573-481e-9da0-269c46266127, accountID: d38jqigm0anc73crcpvg, peerID: ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=] management/server/grpcserver.go:543: failed logging in peer ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=: peer login has expired, please log in once more 2025/11/16 10:14:33 http: TLS handshake error from 122.171.19.226:19598: read tcp 192.168.2.5:443->122.171.19.226:19598: read: connection timed out 2025-11-16T10:15:03Z WARN [context: GRPC, requestID: 89e5e408-4428-4d03-af6d-c6aa8121860d, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:15:44Z WARN [accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: dce38474-144b-426a-8c0d-44ac93951cfa] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login ```
Author
Owner

@sunshine-22 commented on GitHub (Dec 14, 2025):

Any update over the above issue!

<!-- gh-comment-id:3651580481 --> @sunshine-22 commented on GitHub (Dec 14, 2025): Any update over the above issue!
Author
Owner

@rthill commented on GitHub (Jan 29, 2026):

I started testing Netbird and run into the same issue. I am using the latest software versions 0.64.2.
Anyone has a solution? I tried playing around with the variable NETBIRD_AUTH_DEVICE_AUTH_PROVIDER set as hosted or none, same for the management.json DeviceAuthorizationFlow.Provider.
No setting ever changed the behavior.

<!-- gh-comment-id:3818123515 --> @rthill commented on GitHub (Jan 29, 2026): I started testing Netbird and run into the same issue. I am using the latest software versions 0.64.2. Anyone has a solution? I tried playing around with the variable NETBIRD_AUTH_DEVICE_AUTH_PROVIDER set as hosted or none, same for the management.json DeviceAuthorizationFlow.Provider. No setting ever changed the behavior.
Author
Owner

@skoenig commented on GitHub (Jun 16, 2026):

Same issue still in netbird version 0.72.4

<!-- gh-comment-id:4717527710 --> @skoenig commented on GitHub (Jun 16, 2026): Same issue still in netbird version 0.72.4
Author
Owner

@neVERberleRfellerER commented on GitHub (Jul 30, 2026):

It seems that

env XDG_CURRENT_DESKTOP=KDE netbird up ... --no-browser

(yes, that XDG_CURRENT_DESKTOP=KDE is what makes it work) workarounds the issue and the login url is printed to standard output. After that, the redirect will fail on different system, as it point to localhost, but it's possible to take the URL, pass it to curl on the same system the netbird up is running and it will connect.

<!-- gh-comment-id:5133426951 --> @neVERberleRfellerER commented on GitHub (Jul 30, 2026): It seems that ``` env XDG_CURRENT_DESKTOP=KDE netbird up ... --no-browser ``` (yes, that `XDG_CURRENT_DESKTOP=KDE` is what makes it work) workarounds the issue and the login url is printed to standard output. After that, the redirect will fail on different system, as it point to localhost, but it's possible to take the URL, pass it to curl on the same system the `netbird up` is running and it will connect.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#5052