Pocket ID as IDP help #1600

@mitchplze commented on GitHub (Jun 5, 2025):

No luck for me getting Pocket ID working either.

@mitchplze commented on GitHub (Jun 5, 2025): No luck for me getting Pocket ID working either.

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jun 23, 2025):

I am also struggling to get netbird working with pocket id. Any ideas?

@karlo-el-tigre commented on GitHub (Jun 23, 2025): I am also struggling to get netbird working with pocket id. Any ideas?

saavagebueno commented

@bigtcze commented on GitHub (Jun 26, 2025):

Looking for solution for this too. Official support would be excellent!

@bigtcze commented on GitHub (Jun 26, 2025): Looking for solution for this too. Official support would be excellent!

saavagebueno commented

@mlsmaycon commented on GitHub (Jun 26, 2025):

Hello Folks, the system supports any OIDC compliment solution that provides PKCE flow. The dashboard and CLI login are all around PKCE flows, so if you share a guide for it with pocket id or a guide for single page applications, we can have a look and try to guide you.

@mlsmaycon commented on GitHub (Jun 26, 2025): Hello Folks, the system supports any OIDC compliment solution that provides PKCE flow. The dashboard and CLI login are all around PKCE flows, so if you share a guide for it with pocket id or a guide for single page applications, we can have a look and try to guide you.

saavagebueno commented

@mitchplze commented on GitHub (Jun 26, 2025):

Still no luck getting this to work natively unfortunately no matter how hard I try.

However, I was able to easily add Pocket ID as a ZITADEL authentication backend in the gui.

This is not ideal, but is a good alternative to get NetBird + OIDC running in about 5 minutes from the quick start guide.

@mitchplze commented on GitHub (Jun 26, 2025): Still no luck getting this to work natively unfortunately no matter how hard I try. However, I was able to easily add Pocket ID as a ZITADEL authentication backend in the gui. This is not ideal, but is a good alternative to get NetBird + OIDC running in about 5 minutes from the quick start guide.

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jun 26, 2025):

I got it working by following the Authelia documentation: https://www.authelia.com/integration/openid-connect/netbird/

I'll post my configs when I'm at my computer later tonight

@karlo-el-tigre commented on GitHub (Jun 26, 2025): I got it working by following the Authelia documentation: https://www.authelia.com/integration/openid-connect/netbird/ I'll post my configs when I'm at my computer later tonight

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jun 26, 2025):

Okay, after hours of troubleshooting, I finally have Caddy + Pocket-ID + Netbird working properly. I hope these configuration files are helpful. I also borrowed a few clues from running the quickstart guide as well as the Authelia/Netbird documentation: https://www.authelia.com/integration/openid-connect/netbird/

docker-compose.yml

services:
  # Caddy reverse proxy
  caddy:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    networks: 
      netbird:
        aliases:
          - "netbird.example.com"
    env_file: 
      - .env
    environment:
      - CLOUDFLARE_EMAIL=${CF_EMAIL}
      - CLOUDFLARE_API_TOKEN=${CF_API_TOKEN}
      - ACME_AGREE=true
    ports:
      - '443:443'
      - '443:443/udp'
      - '80:80'
      - '8080:8080'
    volumes:
      - /srv/caddy/netbird_caddy_data:/data
      - ./Caddyfile:/etc/caddy/Caddyfile
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
  # UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    networks: [ netbird ]
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com
      # OIDC
      - AUTH_AUDIENCE=pocketid-client-id
      - AUTH_CLIENT_ID=pocketid-client-id
      - AUTH_CLIENT_SECRET=pocketid-client-secret
      - AUTH_AUTHORITY=https://id.example.com
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    networks: [ netbird ]
    ports:
      - "10000:10000"
    command: ["--port", "10000", "--log-file", "console"]
    volumes:
      - netbird-signal:/var/lib/netbird
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    networks: [ netbird ]
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=rels://netbird.example.com:33080/relay
    # todo: change to a secure secret
    - NB_AUTH_SECRET=xxxx
    ports:
      - 33080:33080
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    networks: [ netbird ]
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    command: [
      "--port", "80",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.example.com",
      "--dns-domain=netbird.selfhosted"
      ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=
      
  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: netbird.example.com # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:

networks:
  netbird:

management.json

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.example.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.example.com:3478",
                "Username": "self",
                "Password": "xxxx"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rels://netbird.example.com:33080"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "xxxx"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.example.com:443",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "xxxx",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "pocketid-client-id",
        "AuthIssuer": "https://id.example.com",
        "AuthUserIDClaim": "sub",
        "AuthKeysLocation": "https://id.example.com/.well-known/jwks.json",
        "OIDCConfigEndpoint": "https://id.example.com/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "",
        "ClientConfig": null,
        "ExtraConfig": null,
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "",
        "ProviderConfig": {
            "ClientID": "",
            "ClientSecret": "",
            "Domain": "id.example.com",
            "Audience": "",
            "TokenEndpoint": "https://id.example.com/api/oidc/token",
            "DeviceAuthEndpoint": "https://id.example.com/api/oidc/device/authorize",
            "AuthorizationEndpoint": "",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": null,
            "DisablePromptLogin": false,
            "LoginFlag": 0
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "pocketid-client-id",
            "ClientSecret": "pocketid-client-secret",
            "Domain": "",
            "Audience": "pocketid-client-id",
            "TokenEndpoint": "https://id.example.com/api/oidc/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://id.example.com/authorize",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ],
            "DisablePromptLogin": false,
            "LoginFlag": 1
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}

Caddyfile

{
  debug
  #acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
	servers :80,:443 {
    protocols h1 h2c h2 h3
  }
}

(security_headers) {
    header * {
        # enable HSTS
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts
        # NOTE: Read carefully how this header works before using it.
        # If the HSTS header is misconfigured or if there is a problem with
        # the SSL/TLS certificate being used, legitimate users might be unable
        # to access the website. For example, if the HSTS header is set to a
        # very long duration and the SSL/TLS certificate expires or is revoked,
        # legitimate users might be unable to access the website until
        # the HSTS header duration has expired.
        # The recommended value for the max-age is 2 year (63072000 seconds).
        # But we are using 1 hour (3600 seconds) for testing purposes
        # and ensure that the website is working properly before setting
        # to two years.

        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"

        # disable clients from sniffing the media type
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
        X-Content-Type-Options "nosniff"

        # clickjacking protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
        X-Frame-Options "SAMEORIGIN"

        # xss protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
        X-XSS-Protection "1; mode=block"

        # Remove -Server header, which is an information leak
        # Remove Caddy from Headers
        -Server

        # keep referrer data off of HTTP connections
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
        Referrer-Policy strict-origin-when-cross-origin
    }
}

netbird.example.com {
    tls {
            dns cloudflare {env.CF_API_TOKEN}
            propagation_delay 2m
            resolvers 1.1.1.1
    }    
    import security_headers
    # relay
    reverse_proxy /relay* relay:33080
    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
    # Management
    reverse_proxy /api/* management:80
    reverse_proxy /management.ManagementService/* h2c://management:80
    # Dashboard
    reverse_proxy /* dashboard:80
}

@karlo-el-tigre commented on GitHub (Jun 26, 2025): Okay, after hours of troubleshooting, I finally have Caddy + Pocket-ID + Netbird working properly. I hope these configuration files are helpful. I also borrowed a few clues from running the quickstart guide as well as the Authelia/Netbird documentation: https://www.authelia.com/integration/openid-connect/netbird/ ## docker-compose.yml ``` services: # Caddy reverse proxy caddy: build: context: . dockerfile: Dockerfile restart: unless-stopped networks: netbird: aliases: - "netbird.example.com" env_file: - .env environment: - CLOUDFLARE_EMAIL=${CF_EMAIL} - CLOUDFLARE_API_TOKEN=${CF_API_TOKEN} - ACME_AGREE=true ports: - '443:443' - '443:443/udp' - '80:80' - '8080:8080' volumes: - /srv/caddy/netbird_caddy_data:/data - ./Caddyfile:/etc/caddy/Caddyfile logging: driver: "json-file" options: max-size: "500m" max-file: "2" # UI dashboard dashboard: image: netbirdio/dashboard:latest restart: unless-stopped networks: [ netbird ] environment: # Endpoints - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com # OIDC - AUTH_AUDIENCE=pocketid-client-id - AUTH_CLIENT_ID=pocketid-client-id - AUTH_CLIENT_SECRET=pocketid-client-secret - AUTH_AUTHORITY=https://id.example.com - USE_AUTH0=false - AUTH_SUPPORTED_SCOPES=openid profile email - AUTH_REDIRECT_URI= - AUTH_SILENT_REDIRECT_URI= - NETBIRD_TOKEN_SOURCE=accessToken # SSL - NGINX_SSL_PORT=443 # Letsencrypt - LETSENCRYPT_DOMAIN= - LETSENCRYPT_EMAIL= volumes: - netbird-letsencrypt:/etc/letsencrypt/ logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Signal signal: image: netbirdio/signal:latest restart: unless-stopped networks: [ netbird ] ports: - "10000:10000" command: ["--port", "10000", "--log-file", "console"] volumes: - netbird-signal:/var/lib/netbird # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "", "--log-file", "console"] logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Relay relay: image: netbirdio/relay:latest restart: unless-stopped networks: [ netbird ] environment: - NB_LOG_LEVEL=info - NB_LISTEN_ADDRESS=:33080 - NB_EXPOSED_ADDRESS=rels://netbird.example.com:33080/relay # todo: change to a secure secret - NB_AUTH_SECRET=xxxx ports: - 33080:33080 logging: driver: "json-file" options: max-size: "500m" max-file: "2" # Management management: image: netbirdio/management:latest restart: unless-stopped networks: [ netbird ] depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - ./management.json:/etc/netbird/management.json # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "", "--log-file", "console"] command: [ "--port", "80", "--log-file", "console", "--log-level", "info", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.example.com", "--dns-domain=netbird.selfhosted" ] logging: driver: "json-file" options: max-size: "500m" max-file: "2" environment: - NETBIRD_STORE_ENGINE_POSTGRES_DSN= - NETBIRD_STORE_ENGINE_MYSQL_DSN= # Coturn coturn: image: coturn/coturn:latest restart: unless-stopped #domainname: netbird.example.com # only needed when TLS is enabled volumes: - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf logging: driver: "json-file" options: max-size: "500m" max-file: "2" volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: networks: netbird: ``` ## management.json ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.example.com:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:netbird.example.com:3478", "Username": "self", "Password": "xxxx" } ] }, "Relay": { "Addresses": [ "rels://netbird.example.com:33080" ], "CredentialsTTL": "24h0m0s", "Secret": "xxxx" }, "Signal": { "Proto": "https", "URI": "netbird.example.com:443", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "xxxx", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "pocketid-client-id", "AuthIssuer": "https://id.example.com", "AuthUserIDClaim": "sub", "AuthKeysLocation": "https://id.example.com/.well-known/jwks.json", "OIDCConfigEndpoint": "https://id.example.com/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": false, "ExtraAuthAudience": "" }, "IdpManagerConfig": { "ManagerType": "", "ClientConfig": null, "ExtraConfig": null, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "", "ProviderConfig": { "ClientID": "", "ClientSecret": "", "Domain": "id.example.com", "Audience": "", "TokenEndpoint": "https://id.example.com/api/oidc/token", "DeviceAuthEndpoint": "https://id.example.com/api/oidc/device/authorize", "AuthorizationEndpoint": "", "Scope": "openid profile email", "UseIDToken": true, "RedirectURLs": null, "DisablePromptLogin": false, "LoginFlag": 0 } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "pocketid-client-id", "ClientSecret": "pocketid-client-secret", "Domain": "", "Audience": "pocketid-client-id", "TokenEndpoint": "https://id.example.com/api/oidc/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://id.example.com/authorize", "Scope": "openid profile email", "UseIDToken": true, "RedirectURLs": [ "http://localhost:53000" ], "DisablePromptLogin": false, "LoginFlag": 1 } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } ``` ## Caddyfile ``` { debug #acme_ca https://acme-staging-v02.api.letsencrypt.org/directory servers :80,:443 { protocols h1 h2c h2 h3 } } (security_headers) { header * { # enable HSTS # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts # NOTE: Read carefully how this header works before using it. # If the HSTS header is misconfigured or if there is a problem with # the SSL/TLS certificate being used, legitimate users might be unable # to access the website. For example, if the HSTS header is set to a # very long duration and the SSL/TLS certificate expires or is revoked, # legitimate users might be unable to access the website until # the HSTS header duration has expired. # The recommended value for the max-age is 2 year (63072000 seconds). # But we are using 1 hour (3600 seconds) for testing purposes # and ensure that the website is working properly before setting # to two years. Strict-Transport-Security "max-age=3600; includeSubDomains; preload" # disable clients from sniffing the media type # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options X-Content-Type-Options "nosniff" # clickjacking protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options X-Frame-Options "SAMEORIGIN" # xss protection # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection X-XSS-Protection "1; mode=block" # Remove -Server header, which is an information leak # Remove Caddy from Headers -Server # keep referrer data off of HTTP connections # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy Referrer-Policy strict-origin-when-cross-origin } } netbird.example.com { tls { dns cloudflare {env.CF_API_TOKEN} propagation_delay 2m resolvers 1.1.1.1 } import security_headers # relay reverse_proxy /relay* relay:33080 # Signal reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000 # Management reverse_proxy /api/* management:80 reverse_proxy /management.ManagementService/* h2c://management:80 # Dashboard reverse_proxy /* dashboard:80 } ```

saavagebueno commented

@mlsmaycon commented on GitHub (Jun 27, 2025):

@karlo-el-tigre can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed.

@mlsmaycon commented on GitHub (Jun 27, 2025): @karlo-el-tigre can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed.

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jun 27, 2025):

I can confirm that it was needed on my end

@karlo-el-tigre commented on GitHub (Jun 27, 2025): I can confirm that it was needed on my end

saavagebueno commented

@bigtcze commented on GitHub (Jun 27, 2025):

@karlo-el-tigre what Callback URLs do you have in your Pocket ID? I am still receiving:
Invalid callback URL
I got
https://netbird.domain.example/peers
https://netbird.domain.example/add-peers
http://localhost

@bigtcze commented on GitHub (Jun 27, 2025): @karlo-el-tigre what Callback URLs do you have in your Pocket ID? I am still receiving: _Invalid callback URL_ I got https://netbird.domain.example/peers https://netbird.domain.example/add-peers http://localhost

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jun 27, 2025):

I used two:
https://netbird.example.com/*
http://localhost:53000

@karlo-el-tigre commented on GitHub (Jun 27, 2025): I used two: `https://netbird.example.com/*` `http://localhost:53000`

saavagebueno commented

@bigtcze commented on GitHub (Jun 28, 2025):

Very nice! It works!!

@bigtcze commented on GitHub (Jun 28, 2025): Very nice! It works!!

saavagebueno commented

@Alxandr commented on GitHub (Jul 29, 2025):

Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/

@Alxandr commented on GitHub (Jul 29, 2025): Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/

saavagebueno commented

@karlo-el-tigre commented on GitHub (Jul 29, 2025):

Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/

Same here, have not figured this out either

@karlo-el-tigre commented on GitHub (Jul 29, 2025): > Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/ Same here, have not figured this out either

saavagebueno commented

@alexmoras commented on GitHub (Jul 31, 2025):

Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/

I have this issue as well. I have temporarily set NETBIRD_AUTH_USER_ID_CLAIM="preferred_username" in my Netbird configuration which makes it a bit cleaner. However, the underlying issue appears to be that it won't pull the email properly from Pocket ID (in my user profile, email field remains blank) which would normally be displayed instead of the long ID.

Does anyone else have this issue whereby the email isn't being pulled? I modified Pocket ID to set email_verified claim to true but this made no difference.

@alexmoras commented on GitHub (Jul 31, 2025): > Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/ I have this issue as well. I have temporarily set `NETBIRD_AUTH_USER_ID_CLAIM="preferred_username"` in my Netbird configuration which makes it a bit cleaner. However, the underlying issue appears to be that it won't pull the email properly from Pocket ID (in my user profile, email field remains blank) which would normally be displayed instead of the long ID. Does anyone else have this issue whereby the email isn't being pulled? I modified Pocket ID to set `email_verified` claim to `true` but this made no difference.

saavagebueno commented

@tilwegener commented on GitHub (Aug 26, 2025):

Can you post setup.env and Pocket-ID configuration?

@tilwegener commented on GitHub (Aug 26, 2025): Can you post setup.env and Pocket-ID configuration?

saavagebueno commented

@Dual-0 commented on GitHub (Aug 29, 2025):

Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/

I have this issue as well. I have temporarily set NETBIRD_AUTH_USER_ID_CLAIM="preferred_username" in my Netbird configuration which makes it a bit cleaner. However, the underlying issue appears to be that it won't pull the email properly from Pocket ID (in my user profile, email field remains blank) which would normally be displayed instead of the long ID.

Does anyone else have this issue whereby the email isn't being pulled? I modified Pocket ID to set email_verified claim to true but this made no difference.

@alexmoras I struggle with the same issue. I find out that we should use ID token instead of access token for Pocket ID.

env:

NETBIRD_TOKEN_SOURCE=idToken

@Dual-0 commented on GitHub (Aug 29, 2025): > > Just set this up myself. The only issue I have left is that users are given UUIDs as their user-id, as opposed to names :/ > > I have this issue as well. I have temporarily set `NETBIRD_AUTH_USER_ID_CLAIM="preferred_username"` in my Netbird configuration which makes it a bit cleaner. However, the underlying issue appears to be that it won't pull the email properly from Pocket ID (in my user profile, email field remains blank) which would normally be displayed instead of the long ID. > > Does anyone else have this issue whereby the email isn't being pulled? I modified Pocket ID to set `email_verified` claim to `true` but this made no difference. @alexmoras I struggle with the same issue. I find out that we should use ID token instead of access token for Pocket ID. env: ``` NETBIRD_TOKEN_SOURCE=idToken ```

saavagebueno commented

@DavidMbikayi commented on GitHub (Sep 10, 2025):

@karlo-el-tigre can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed.

I got it working without a client secret. You need to toggle ON "Public Client" in the OIDC Client Config when setting it up in pocket-id

@DavidMbikayi commented on GitHub (Sep 10, 2025): > [@karlo-el-tigre](https://github.com/karlo-el-tigre) can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed. I got it working without a client secret. You need to toggle ON "Public Client" in the OIDC Client Config when setting it up in pocket-id

saavagebueno commented

@jfrconley commented on GitHub (Sep 10, 2025):

@karlo-el-tigre can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed.

I got it working without a client secret. You need to toggle ON "Public Client" in the OIDC Client Config when setting it up in pocket-id

Did this fix issues with incorrectly displaying the email for you? It's showing the correct email and name in the upper right hand corner, but the profile page does not include an email. Things work, but it makes it confusing to understand which profile is which.

EDIT: Tested and this will not fix the issue

@jfrconley commented on GitHub (Sep 10, 2025): > > [@karlo-el-tigre](https://github.com/karlo-el-tigre) can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed. > > I got it working without a client secret. You need to toggle ON "Public Client" in the OIDC Client Config when setting it up in pocket-id Did this fix issues with incorrectly displaying the email for you? It's showing the correct email and name in the upper right hand corner, but the profile page does not include an email. Things work, but it makes it confusing to understand which profile is which. EDIT: Tested and this will not fix the issue

saavagebueno commented