SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-10 01:12:51 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Google Workspace login not working on devices #1215

New Issue
Closed
opened 2025-11-20 05:26:08 -05:00 by saavagebueno · 1 comment
saavagebueno commented 2025-11-20 05:26:08 -05:00
Owner
Copy Link

Originally created by @kinafu on GitHub (Sep 4, 2024).

Describe the problem
browser login: ✅ I can login in the web browser using google OIDC.
windows netbird client login: ❌
I have a freshly installed windows netbird client with my self-hosted netbird url configured.
I cannot login after clicking [Connect] for the first time:
netbird windows client error

When playing around with the management.json file (I tried manually setting different urls etc.) I get different errors on the client and I can see nginx logging my requests. Hence I assume the connections etc. are working.

See nginx logs and another error while playing around 
web-1         | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/Login HTTP/1.1" 200 114 "-" "grpc-go/1.64.1" "88.79.157.71"
web-1         | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetServerKey HTTP/1.1" 200 88 "-" "grpc-go/1.64.1" "88.79.157.71"
web-1         | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetPKCEAuthorizationFlow HTTP/1.1" 200 404 "-" "grpc-go/1.64.1" "88.79.157.71"
web-1         | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetServerKey HTTP/1.1" 200 88 "-" "grpc-go/1.64.1" "88.79.157.71"
web-1         | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetDeviceAuthorizationFlow HTTP/1.1" 200 398 "-" "grpc-go/1.64.1" "88.79.157.71"

different windows netbird error

To Reproduce

Steps to reproduce the behavior:

  1. Follow Self-Hosted advanced installation guide
  2. Follow Google Workspace IdP installation guide (https://docs.netbird.io/selfhosted/identity-providers#google-workspace)
  3. Follow instructions to set up a new windows peer (Install netbird client on windows, set custom management url)
  4. Netbird windows client tray icon right-click "connect"
  5. See error

Expected behavior

Google login screen opens uo

Are you using NetBird Cloud?

self-hosted

NetBird version

0.28.9

View NetBird status -dA output 
Daemon status: LoginFailed

Run UP command to log in with SSO (interactive login):

 netbird up

If you are running a self-hosted version and no SSO provider has been configured in your Management Server,
you can use a setup-key:

 netbird up --management-url <YOUR_MANAGEMENT_URL> --setup-key <YOUR_SETUP_KEY>

More info: https://docs.netbird.io/how-to/register-machines-using-setup-keys

Do you face any (non-mobile) client issues?

not tried

Screenshots

see collapsed sections in my description

Additional context

Anonymized management.json 
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:example.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:example.com:3478",
                "Username": "self",
                "Password": "myPassword"
            }
        ]
    },
    "Signal": {
        "Proto": "https",
        "URI": "example.com:443",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "randomKey",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "anAccount.apps.googleusercontent.com",
        "AuthIssuer": "https://accounts.google.com",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs",
        "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "google",
        "ClientConfig": {
            "Issuer": "https://accounts.google.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "ClientID": "anAccount.apps.googleusercontent.com",
            "ClientSecret": "theSecret",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "CustomerId": "myCustomerId",
            "ServiceAccountKey": "someBase64="
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "none",
        "ProviderConfig": {
            "ClientID": "",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "anAccount.apps.googleusercontent.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "anAccount.apps.googleusercontent.com",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "anAccount.apps.googleusercontent.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}
Originally created by @kinafu on GitHub (Sep 4, 2024). **Describe the problem** browser login: ✅ I can login in the web browser using google OIDC. windows netbird client login: ❌ I have a freshly installed windows netbird client with my self-hosted netbird url configured. I cannot login after clicking [Connect] for the first time: ![netbird windows client error](https://github.com/user-attachments/assets/4acaca30-3546-4f34-a26f-c432d664a228) When playing around with the management.json file (I tried manually setting different urls etc.) I get different errors on the client and I can see nginx logging my requests. Hence I assume the connections etc. are working. <details> <summary>See nginx logs and another error while playing around</summary> ``` web-1 | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/Login HTTP/1.1" 200 114 "-" "grpc-go/1.64.1" "88.79.157.71" web-1 | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetServerKey HTTP/1.1" 200 88 "-" "grpc-go/1.64.1" "88.79.157.71" web-1 | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetPKCEAuthorizationFlow HTTP/1.1" 200 404 "-" "grpc-go/1.64.1" "88.79.157.71" web-1 | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetServerKey HTTP/1.1" 200 88 "-" "grpc-go/1.64.1" "88.79.157.71" web-1 | 192.168.2.19 - - [04/Sep/2024:15:28:16 +0000] "POST /management.ManagementService/GetDeviceAuthorizationFlow HTTP/1.1" 200 398 "-" "grpc-go/1.64.1" "88.79.157.71" ``` ![different windows netbird error](https://github.com/user-attachments/assets/bc6747d0-2728-443c-97ef-9535866d031b) </details> **To Reproduce** Steps to reproduce the behavior: 1. Follow Self-Hosted advanced installation guide 2. Follow Google Workspace IdP installation guide (https://docs.netbird.io/selfhosted/identity-providers#google-workspace) 3. Follow instructions to set up a new windows peer (Install netbird client on windows, set custom management url) 4. Netbird windows client tray icon right-click "connect" 5. See error **Expected behavior** Google login screen opens uo **Are you using NetBird Cloud?** self-hosted **NetBird version** `0.28.9` <details> <summary>View NetBird status -dA output</summary> ```txt Daemon status: LoginFailed Run UP command to log in with SSO (interactive login): netbird up If you are running a self-hosted version and no SSO provider has been configured in your Management Server, you can use a setup-key: netbird up --management-url <YOUR_MANAGEMENT_URL> --setup-key <YOUR_SETUP_KEY> More info: https://docs.netbird.io/how-to/register-machines-using-setup-keys ``` </details> **Do you face any (non-mobile) client issues?** not tried **Screenshots** see collapsed sections in my description **Additional context** <details> <summary>Anonymized management.json</summary> ```txt { "Stuns": [ { "Proto": "udp", "URI": "stun:example.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:example.com:3478", "Username": "self", "Password": "myPassword" } ] }, "Signal": { "Proto": "https", "URI": "example.com:443", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "randomKey", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "anAccount.apps.googleusercontent.com", "AuthIssuer": "https://accounts.google.com", "AuthUserIDClaim": "", "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs", "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "google", "ClientConfig": { "Issuer": "https://accounts.google.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "ClientID": "anAccount.apps.googleusercontent.com", "ClientSecret": "theSecret", "GrantType": "client_credentials" }, "ExtraConfig": { "CustomerId": "myCustomerId", "ServiceAccountKey": "someBase64=" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "ClientID": "", "ClientSecret": "", "Domain": "", "Audience": "anAccount.apps.googleusercontent.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "anAccount.apps.googleusercontent.com", "ClientSecret": "", "Domain": "", "Audience": "anAccount.apps.googleusercontent.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth", "Scope": "openid profile email", "UseIDToken": true, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ``` </details>
saavagebueno added the triage-needed label 2025-11-20 05:26:08 -05:00
saavagebueno commented 2025-11-20 05:26:08 -05:00
Author
Owner
Copy Link

@kinafu commented on GitHub (Sep 17, 2024):

I finally circumvented the problem by hosting authentik and adding Google there as a source.
Now NetBird connects to Authentik and not to Google directly.

@kinafu commented on GitHub (Sep 17, 2024): I finally circumvented the problem by hosting authentik and adding Google there as a source. Now NetBird connects to Authentik and not to Google directly.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#1215
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?