SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 09:22:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Cannot connect via SSO from a linux cli #1179

New Issue
Open
opened 2025-11-20 05:25:28 -05:00 by saavagebueno · 5 comments
saavagebueno commented 2025-11-20 05:25:28 -05:00
Owner
Copy Link

Originally created by @JonathanManass on GitHub (Aug 26, 2024).

Describe the problem

Whenever running netbird up from a remote linux vm via the cli I get the following error if I do not give it an access key :

2024-08-26T11:55:04Z ERRO management/client/grpc.go:350: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login
2024-08-26T11:55:04Z WARN client/server/server.go:259: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0
2024-08-26T11:55:04Z WARN client/internal/device_auth.go:81: server couldn't find device flow, contact admin: rpc error: code = NotFound desc = no device authorization flow information available

SSO has been correctly set and I all windows personal computers connected can properly connect via Azure.

I'm not sure whether it is a bug, related to configuration, or just that it does not work because I'm trying to connect via SSO on a machine without a graphical interface

To Reproduce

  • Install netbird on a linux vm
  • run netbird up --management-url xxx

Expected behavior

For it to be able to work, similarly to for example, aws sso login by either opening up a browser or giving a link to press that will connect you.

Are you using NetBird Cloud?

Self-Hosted

NetBird version

0.28.8

Originally created by @JonathanManass on GitHub (Aug 26, 2024). **Describe the problem** Whenever running netbird up from a remote linux vm via the cli I get the following error if I do not give it an access key : ``` 2024-08-26T11:55:04Z ERRO management/client/grpc.go:350: failed to login to Management Service: rpc error: code = PermissionDenied desc = no peer auth method provided, please use a setup key or interactive SSO login 2024-08-26T11:55:04Z WARN client/server/server.go:259: failed login: rpc error: code = InvalidArgument desc = invalid setup-key or no sso information provided, err: invalid UUID length: 0 2024-08-26T11:55:04Z WARN client/internal/device_auth.go:81: server couldn't find device flow, contact admin: rpc error: code = NotFound desc = no device authorization flow information available ``` SSO has been correctly set and I all windows personal computers connected can properly connect via Azure. I'm not sure whether it is a bug, related to configuration, or just that it does not work because I'm trying to connect via SSO on a machine without a graphical interface **To Reproduce** - Install netbird on a linux vm - run `netbird up --management-url xxx` **Expected behavior** For it to be able to work, similarly to for example, aws sso login by either opening up a browser or giving a link to press that will connect you. **Are you using NetBird Cloud?** Self-Hosted **NetBird version** 0.28.8
saavagebueno added the triage-needed label 2025-11-20 05:25:28 -05:00
saavagebueno commented 2025-11-20 05:25:28 -05:00
Author
Owner
Copy Link

@jb606 commented on GitHub (Aug 27, 2024):

Hello,
I think you will need to use a setup key when your device does not have a GUI.

@jb606 commented on GitHub (Aug 27, 2024): Hello, I think you will need to use a [setup key](https://docs.netbird.io/how-to/register-machines-using-setup-keys) when your device does not have a GUI.
saavagebueno commented 2025-11-20 05:25:28 -05:00
Author
Owner
Copy Link

@lblazewski commented on GitHub (Aug 27, 2024):

Observing the same issue. I recall this used to work in the past where a link was present in the console that could be copy pasted to browser in order to finish the auth flow and then the machine would be connected (I was using this just for testing, I know that setup keys should be used in such cases).

@lblazewski commented on GitHub (Aug 27, 2024): Observing the same issue. I recall this used to work in the past where a link was present in the console that could be copy pasted to browser in order to finish the auth flow and then the machine would be connected (I was using this just for testing, I know that setup keys should be used in such cases).
saavagebueno commented 2025-11-20 05:25:29 -05:00
Author
Owner
Copy Link

@vernhart commented on GitHub (Oct 16, 2024):

I am seeing this problem as well. The same process works fine on my mac. I issue the netbird up command and it gives me a URL that I have to paste into my web browser.
Under linux (I'm running from a lxd container) I get the above rpc error.
My linux client is 0.30.2 and my mac is using 0.30.0.

@vernhart commented on GitHub (Oct 16, 2024): I am seeing this problem as well. The same process works fine on my mac. I issue the netbird up command and it gives me a URL that I have to paste into my web browser. Under linux (I'm running from a lxd container) I get the above rpc error. My linux client is 0.30.2 and my mac is using 0.30.0.
saavagebueno commented 2025-11-20 05:25:29 -05:00
Author
Owner
Copy Link

@atomlab commented on GitHub (Apr 24, 2025):

The same issue.

Netbird agent: 0.42.0
Netbird manager: 0.41.3
Keycloak: 25.0.4

I can successfully log in to the Netbird dashboard at https://netbird.mydomain.com via Keycloak in the browser. However, when attempting to connect a Netbird agent on a local Linux machine with a KDE desktop environment, I encounter an error. My goal is to use SSO authentication for the client, leveraging the interactive browser-based login flow.

The netbird up command fails with the following error:

% netbird up --management-url https://netbird.mydomain.com --admin-url https://netbird.mydomain.com

2025-04-24T18:14:45+03:00 WARN client/cmd/root.go:250: retrying Login to the Management service in 5.268709461s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

At the same time, the Netbird management server logs show:

2025-04-24T15:14:51Z WARN [context: GRPC, requestID: 907249e3-1940-432c-aaae-168e7244df4b, accountID: UNKNOWN, peerID: OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=] management/server/grpcserver.go:474: failed logging in peer OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=: no peer auth method provided, please use a setup key or interactive SSO login

Confirmation of browser integration on the client computer:

% xdg-settings get default-web-browser
vivaldi-stable.desktop

% xdg-open http://stackoverflow.com
# Successfully opens link in Vivaldi

UPDATE: My mistake.
By mistake, I did not fill in the PKCEAuthorizationFlow.RedirectURLs field in management.json. I added the same values as in the Keycloak for the netbird client in the Valid Redirect URIs and the redirect to the browser from the console was successful.

{
    ...
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            ...
            "RedirectURLs": [
                "http://localhost:53000",
                "https://netbird.mydomain.com"
            ],
            ...
}
@atomlab commented on GitHub (Apr 24, 2025): The same issue. **Netbird agent: 0.42.0** **Netbird manager: 0.41.3** **Keycloak: 25.0.4** I can successfully log in to the Netbird dashboard at https://netbird.mydomain.com via Keycloak in the browser. However, when attempting to connect a Netbird agent on a local Linux machine with a KDE desktop environment, I encounter an error. My goal is to use SSO authentication for the client, leveraging the interactive browser-based login flow. The `netbird up` command fails with the following error: >% netbird up --management-url https://netbird.mydomain.com --admin-url https://netbird.mydomain.com > >2025-04-24T18:14:45+03:00 WARN client/cmd/root.go:250: retrying Login to the Management service in 5.268709461s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys At the same time, the Netbird management server logs show: > 2025-04-24T15:14:51Z WARN [context: GRPC, requestID: 907249e3-1940-432c-aaae-168e7244df4b, accountID: UNKNOWN, peerID: OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=] management/server/grpcserver.go:474: failed logging in peer OnYukdYUGEh5zqCttiXq6WICXoFLBbaSJeRotGlNJRE=: no peer auth method provided, please use a setup key or interactive SSO login Confirmation of browser integration on the client computer: ``` % xdg-settings get default-web-browser vivaldi-stable.desktop % xdg-open http://stackoverflow.com # Successfully opens link in Vivaldi ``` **UPDATE:** My mistake. By mistake, I did not fill in the `PKCEAuthorizationFlow.RedirectURLs` field in `management.json`. I added the same values as in the Keycloak for the netbird client in the **Valid Redirect URIs** and the redirect to the browser from the console was successful. ```json { ... "PKCEAuthorizationFlow": { "ProviderConfig": { ... "RedirectURLs": [ "http://localhost:53000", "https://netbird.mydomain.com" ], ... } ```
saavagebueno commented 2025-11-20 05:25:29 -05:00
Author
Owner
Copy Link

@dbgalz11 commented on GitHub (Nov 16, 2025):

Hi is this issue resolved? I have the same problem using wsl2 - ubuntu 22.04. We are using Entra Id as SSO provider.

Error logs:

netbird up --management-url https://netbird.xxx.xxxxnet:33073
2025-11-16T18:42:20+08:00 WARN client/cmd/root.go:248: retrying Login to the Management service in 567.653817ms due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys
Error: daemon up failed: login backoff cycle failed: rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

docker management logs:

2025-11-16T10:01:35Z WARN [context: GRPC, requestID: 1c444a96-2c21-4fb6-a0e1-a336bf2015d8, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:03:41Z WARN [peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: 3e914a69-1e55-4fa9-97fc-67b74ed98573, accountID: UNKNOWN] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:04:22Z WARN [context: GRPC, requestID: be59add1-bfe9-400b-8b08-f2fac09d7102, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:08:30Z WARN [context: GRPC, requestID: 27fed642-c573-481e-9da0-269c46266127, accountID: d38jqigm0anc73crcpvg, peerID: ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=] management/server/grpcserver.go:543: failed logging in peer ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=: peer login has expired, please log in once more
2025/11/16 10:14:33 http: TLS handshake error from 122.171.19.226:19598: read tcp 192.168.2.5:443->122.171.19.226:19598: read: connection timed out
2025-11-16T10:15:03Z WARN [context: GRPC, requestID: 89e5e408-4428-4d03-af6d-c6aa8121860d, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
2025-11-16T10:15:44Z WARN [accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: dce38474-144b-426a-8c0d-44ac93951cfa] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login
@dbgalz11 commented on GitHub (Nov 16, 2025): Hi is this issue resolved? I have the same problem using wsl2 - ubuntu 22.04. We are using Entra Id as SSO provider. Error logs: ```shell netbird up --management-url https://netbird.xxx.xxxxnet:33073 2025-11-16T18:42:20+08:00 WARN client/cmd/root.go:248: retrying Login to the Management service in 567.653817ms due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys Error: daemon up failed: login backoff cycle failed: rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys ``` docker management logs: ```shell 2025-11-16T10:01:35Z WARN [context: GRPC, requestID: 1c444a96-2c21-4fb6-a0e1-a336bf2015d8, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:03:41Z WARN [peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: 3e914a69-1e55-4fa9-97fc-67b74ed98573, accountID: UNKNOWN] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:04:22Z WARN [context: GRPC, requestID: be59add1-bfe9-400b-8b08-f2fac09d7102, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:08:30Z WARN [context: GRPC, requestID: 27fed642-c573-481e-9da0-269c46266127, accountID: d38jqigm0anc73crcpvg, peerID: ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=] management/server/grpcserver.go:543: failed logging in peer ABMlOfDKYkoyRvjktOMtm0EP4QvLmfg8wXXP994LE04=: peer login has expired, please log in once more 2025/11/16 10:14:33 http: TLS handshake error from 122.171.19.226:19598: read tcp 192.168.2.5:443->122.171.19.226:19598: read: connection timed out 2025-11-16T10:15:03Z WARN [context: GRPC, requestID: 89e5e408-4428-4d03-af6d-c6aa8121860d, accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login 2025-11-16T10:15:44Z WARN [accountID: UNKNOWN, peerID: Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=, context: GRPC, requestID: dce38474-144b-426a-8c0d-44ac93951cfa] management/server/grpcserver.go:543: failed logging in peer Qjfrod9/GvI+XilikY7eN7nRTgh5FC9n1B8g9sbedwc=: no peer auth method provided, please use a setup key or interactive SSO login ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1179
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?