[GH-ISSUE #4032] Netbird client cant't connect use keycloack #8341

Open
opened 2026-08-05 01:17:29 -04:00 by saavagebueno · 1 comment
Owner

Originally created by @tapokshot on GitHub (Jun 23, 2025).
Original GitHub issue: https://github.com/netbirdio/netbird/issues/4032

Describe the problem

Netbird client cant't connect to vpn use keycloack. When i try to connect i get an error

Please do the SSO login in your browser.    
If your browser didn't open automatically, use this URL to log in:  
  
https://<keycloak_-host>/realms/netbird/device?user_code=<some-code>   
-->> after login in keycloak
Error: waiting sso login failed with: rpc error: code = Unknown desc = validate access token failed with error: invalid JWT token audience field

Some logs from /var/log/netbird# tail -f client.log


2025-06-23T11:02:24+03:00 DEBG client/internal/statemanager/manager.go:298: state file does not exist  
2025-06-23T11:02:24+03:00 INFO client/internal/config.go:364: switching Network Monitor to false  
2025-06-23T11:02:24+03:00 INFO client/internal/config.go:498: disabling notifications  
2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:94: connecting to the Management service https://my-valid-netbird-domain:443  
2025-06-23T11:02:24+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443  
2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:64: connected to the Management service https://my-valid-netbird-domain:443  
2025-06-23T11:02:24+03:00 ERRO management/client/grpc.go:349: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login  
2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:73: peer registration required  
2025-06-23T11:02:24+03:00 WARN client/server/server.go:268: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0  
2025-06-23T11:02:24+03:00 DEBG client/internal/pkce_auth.go:63: connecting to Management Service https://my-valid-netbird-domain:443  
2025-06-23T11:02:24+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443  
2025-06-23T11:02:25+03:00 DEBG client/internal/pkce_auth.go:69: connected to the Management service https://my-valid-netbird-domain:443  
2025-06-23T11:02:25+03:00 WARN client/internal/pkce_auth.go:87: server couldn't find pkce flow, contact admin: rpc error: code = NotFound desc = no pkce authorization flow information available  
2025-06-23T11:02:25+03:00 DEBG client/internal/auth/oauth.go:75: failed to initialize pkce authentication with error: getting pkce authorization flow info failed with error: rpc error: code = NotFound desc = no pkce authorizati  
on flow information available  
  
2025-06-23T11:02:25+03:00 DEBG client/internal/auth/oauth.go:76: falling back to device code flow  
2025-06-23T11:02:25+03:00 DEBG client/internal/device_auth.go:57: connecting to Management Service https://my-valid-netbird-domain:443  
2025-06-23T11:02:25+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443  
2025-06-23T11:02:25+03:00 DEBG client/internal/device_auth.go:63: connected to the Management service https://my-valid-netbird-domain:443  
2025-06-23T11:02:25+03:00 DEBG client/internal/auth/device_flow.go:69: Using system certificate pool.  
2025-06-23T11:02:25+03:00 WARN client/server/server.go:476: canceling previous waiting execution  
2025-06-23T11:02:30+03:00 ERRO client/server/server.go:576: waiting for browser login failed: validate access token failed with error: invalid JWT token audience field

Log on netbird server:

2025-06-23T07:52:38Z WARN [context: GRPC, requestID: , accountID: UNKNOWN, peerID: ] management/server/grpcserver.go:486: failed logging in peer : no peer auth method provided, please use a setup key or interactive SSO login

Log on keycloak can't show, but there without error

Other things like login in dashboard use keycloak works

To Reproduce

Steps to reproduce the behavior:

  1. Install netbird in k8s use https://artifacthub.io/packages/helm/jaconi/netbird
  2. Setup with keycloak with instruction https://docs.netbird.io/selfhosted/identity-providers#keycloak
  3. try to connect

Expected behavior
just work

Are you using NetBird Cloud?
No.
Use selfhosted in k8s.
Image version: netbirdio/management:0.47.2

NetBird version

0.47.2

Is any other VPN software installed?

no

Debug output

Can't do this because

Error: failed to up: up already in progress: current status LoginFailed

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
Originally created by @tapokshot on GitHub (Jun 23, 2025). Original GitHub issue: https://github.com/netbirdio/netbird/issues/4032 **Describe the problem** Netbird client cant't connect to vpn use keycloack. When i try to connect i get an error ``` Please do the SSO login in your browser.   If your browser didn't open automatically, use this URL to log in: https://<keycloak_-host>/realms/netbird/device?user_code=<some-code>  -->> after login in keycloak Error: waiting sso login failed with: rpc error: code = Unknown desc = validate access token failed with error: invalid JWT token audience field ``` Some logs from ```/var/log/netbird# tail -f client.log``` ``` 2025-06-23T11:02:24+03:00 DEBG client/internal/statemanager/manager.go:298: state file does not exist 2025-06-23T11:02:24+03:00 INFO client/internal/config.go:364: switching Network Monitor to false 2025-06-23T11:02:24+03:00 INFO client/internal/config.go:498: disabling notifications 2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:94: connecting to the Management service https://my-valid-netbird-domain:443 2025-06-23T11:02:24+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443 2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:64: connected to the Management service https://my-valid-netbird-domain:443 2025-06-23T11:02:24+03:00 ERRO management/client/grpc.go:349: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login 2025-06-23T11:02:24+03:00 DEBG client/internal/login.go:73: peer registration required 2025-06-23T11:02:24+03:00 WARN client/server/server.go:268: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0 2025-06-23T11:02:24+03:00 DEBG client/internal/pkce_auth.go:63: connecting to Management Service https://my-valid-netbird-domain:443 2025-06-23T11:02:24+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443 2025-06-23T11:02:25+03:00 DEBG client/internal/pkce_auth.go:69: connected to the Management service https://my-valid-netbird-domain:443 2025-06-23T11:02:25+03:00 WARN client/internal/pkce_auth.go:87: server couldn't find pkce flow, contact admin: rpc error: code = NotFound desc = no pkce authorization flow information available 2025-06-23T11:02:25+03:00 DEBG client/internal/auth/oauth.go:75: failed to initialize pkce authentication with error: getting pkce authorization flow info failed with error: rpc error: code = NotFound desc = no pkce authorizati on flow information available 2025-06-23T11:02:25+03:00 DEBG client/internal/auth/oauth.go:76: falling back to device code flow 2025-06-23T11:02:25+03:00 DEBG client/internal/device_auth.go:57: connecting to Management Service https://my-valid-netbird-domain:443 2025-06-23T11:02:25+03:00 DEBG util/net/dialer_dial.go:52: Dialing tcp my-valid-netbird-domain:443 2025-06-23T11:02:25+03:00 DEBG client/internal/device_auth.go:63: connected to the Management service https://my-valid-netbird-domain:443 2025-06-23T11:02:25+03:00 DEBG client/internal/auth/device_flow.go:69: Using system certificate pool. 2025-06-23T11:02:25+03:00 WARN client/server/server.go:476: canceling previous waiting execution 2025-06-23T11:02:30+03:00 ERRO client/server/server.go:576: waiting for browser login failed: validate access token failed with error: invalid JWT token audience field ``` Log on netbird server: ``` 2025-06-23T07:52:38Z WARN [context: GRPC, requestID: , accountID: UNKNOWN, peerID: ] management/server/grpcserver.go:486: failed logging in peer : no peer auth method provided, please use a setup key or interactive SSO login ``` Log on keycloak can't show, but there without error Other things like login in dashboard use keycloak works **To Reproduce** Steps to reproduce the behavior: 1. Install netbird in k8s use https://artifacthub.io/packages/helm/jaconi/netbird 2. Setup with keycloak with instruction https://docs.netbird.io/selfhosted/identity-providers#keycloak 3. try to connect **Expected behavior** just work **Are you using NetBird Cloud?** No. Use selfhosted in k8s. Image version: netbirdio/management:0.47.2 **NetBird version** 0.47.2 **Is any other VPN software installed?** no **Debug output** Can't do this because ``` Error: failed to up: up already in progress: current status LoginFailed ``` **Screenshots** If applicable, add screenshots to help explain your problem. **Additional context** Add any other context about the problem here. **Have you tried these troubleshooting steps?** - [x] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x] Checked for newer NetBird versions - [x] Searched for similar issues on GitHub (including closed ones) - [x] Restarted the NetBird client - [x] Disabled other VPN software - [x] Checked firewall settings
saavagebueno added the triage-needed label 2026-08-05 01:17:29 -04:00
Author
Owner

@b3nab commented on GitHub (Jul 20, 2025):

I am experiencing the exact same error in netbird like yours, I tried both with Zitadel and Authentik with no success.

2025-06-23T07:52:38Z WARN [context: GRPC, requestID: , accountID: UNKNOWN, peerID: ] management/server/grpcserver.go:486: failed logging in peer : no peer auth method provided, please use a setup key or interactive SSO login

Did you find a solution? Maybe I will open an issue if I am not able to solve it.

<!-- gh-comment-id:3094613403 --> @b3nab commented on GitHub (Jul 20, 2025): I am experiencing the exact same error in netbird like yours, I tried both with Zitadel and Authentik with no success. `2025-06-23T07:52:38Z WARN [context: GRPC, requestID: , accountID: UNKNOWN, peerID: ] management/server/grpcserver.go:486: failed logging in peer : no peer auth method provided, please use a setup key or interactive SSO login` Did you find a solution? Maybe I will open an issue if I am not able to solve it.
Sign in to join this conversation.
No Label triage-needed
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: DYNR/netbird#8341