SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-13 10:51:52 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

ERR_UNAUTHORIZED Request failed with status code 401 #176

New Issue
Closed
opened 2025-11-20 05:07:24 -05:00 by saavagebueno · 9 comments
saavagebueno commented 2025-11-20 05:07:24 -05:00
Owner
Copy Link

Originally created by @dcshoes23 on GitHub (Sep 6, 2022).

I have selfhosted netbird v0.9.0 using Authentik as my identity provider.

I am able to login using Authentik and I seee the following error in the UI:
image

I see two problems in the Chrome debug console.

  1. Calls to https://auth.mydomain.com/application/o/userinfo/ fail due to a CORS error:
    Access to fetch at 'https://auth.mydomain.com/application/o/userinfo/' from origin 'https://nb.mydomain.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

NOTE: the call to https://auth.mydomain.com/application/o/token/ works fine which I see is called by xhr.ts:88 vs the failing call which is directly from oidc.ts:160

  1. Any web calls to the management service on :33073 are returning 401 unauthorized with the following response: The token isn't valid
Originally created by @dcshoes23 on GitHub (Sep 6, 2022). I have selfhosted netbird v0.9.0 using Authentik as my identity provider. I am able to login using Authentik and I seee the following error in the UI: ![image](https://user-images.githubusercontent.com/4748680/188726341-3a945afa-db53-4416-926a-b79a3a87a027.png) I see two problems in the Chrome debug console. 1. Calls to `https://auth.mydomain.com/application/o/userinfo/` fail due to a CORS error: `Access to fetch at 'https://auth.mydomain.com/application/o/userinfo/' from origin 'https://nb.mydomain.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.` NOTE: the call to `https://auth.mydomain.com/application/o/token/` works fine which I see is called by `xhr.ts:88` vs the failing call which is directly from `oidc.ts:160` 2. Any web calls to the management service on :33073 are returning 401 unauthorized with the following response: `The token isn't valid`
saavagebueno commented 2025-11-20 05:07:25 -05:00
Author
Owner
Copy Link

@braginini commented on GitHub (Sep 6, 2022):

Hey @dcshoes23
There must be something wrong with the configuration. Could you please send the setup.env, docker-compose.yml, and management.json?
Would be also great to see an example of a generated JWT.

You can send this info on Slack (DM).
https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A

@braginini commented on GitHub (Sep 6, 2022): Hey @dcshoes23 There must be something wrong with the configuration. Could you please send the setup.env, docker-compose.yml, and management.json? Would be also great to see an example of a generated JWT. You can send this info on Slack (DM). https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A
saavagebueno commented 2025-11-20 05:07:25 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Sep 8, 2022):

Relates to https://github.com/goauthentik/authentik/issues/3555

@mlsmaycon commented on GitHub (Sep 8, 2022): Relates to https://github.com/goauthentik/authentik/issues/3555
saavagebueno commented 2025-11-20 05:07:25 -05:00
Author
Owner
Copy Link

@braginini commented on GitHub (Sep 14, 2022):

I think that we can close this one @dcshoes23. Since the issues have been resolved and Authentik is now compatible with NetBird!

@braginini commented on GitHub (Sep 14, 2022): I think that we can close this one @dcshoes23. Since the issues have been resolved and Authentik is now compatible with NetBird!
saavagebueno commented 2025-11-20 05:07:25 -05:00
Author
Owner
Copy Link

@dcshoes23 commented on GitHub (Sep 14, 2022):

closing as issues were with Authentik, thanks for helping to indentify what was missing!
Only point 2 was on the Authentik. For point 1, see my comment below.

@dcshoes23 commented on GitHub (Sep 14, 2022): ~~closing as issues were with Authentik, thanks for helping to indentify what was missing!~~ Only point 2 was on the Authentik. For point 1, see my comment below.
saavagebueno commented 2025-11-20 05:07:25 -05:00
Author
Owner
Copy Link

@dcshoes23 commented on GitHub (Sep 14, 2022):

Found the issue, netbird is not setting the Origin header in the request to Authentik. When I manually add that in my curl test command, the proper CORS headers are returned from Authentik.

@dcshoes23 commented on GitHub (Sep 14, 2022): Found the issue, netbird is not setting the `Origin` header in the request to Authentik. When I manually add that in my curl test command, the proper CORS headers are returned from Authentik.
saavagebueno commented 2025-11-20 05:07:26 -05:00
Author
Owner
Copy Link

@braginini commented on GitHub (Sep 15, 2022):

Found the issue, netbird is not setting the Origin header in the request to Authentik. When I manually add that in my curl test command, the proper CORS headers are returned from Authentik.

The user info endpoint, right? There must be something with related to the OIDC library. Will check that

@braginini commented on GitHub (Sep 15, 2022): > Found the issue, netbird is not setting the `Origin` header in the request to Authentik. When I manually add that in my curl test command, the proper CORS headers are returned from Authentik. The user info endpoint, right? There must be something with related to the OIDC library. Will check that
saavagebueno commented 2025-11-20 05:07:26 -05:00
Author
Owner
Copy Link

@BeryJu commented on GitHub (Oct 7, 2022):

Also trying out netbird currently (great project btw) and I've noticed one error seems to come from the netbird frontend injecting a slash into the well-known URL if you use the correct OIDC issuer for authentik, which ends with a trailing slash (https://id.beryju.org/application/o/netbird/), so if I remove that trailing slash in the UI I can login but get the same error as above, and API requests return The token isn't valid since I assume it's comparing the issuer against what is configured, which is failing

@BeryJu commented on GitHub (Oct 7, 2022): Also trying out netbird currently (great project btw) and I've noticed one error seems to come from the netbird frontend injecting a slash into the well-known URL if you use the correct OIDC issuer for authentik, which ends with a trailing slash (https://id.beryju.org/application/o/netbird/), so if I remove that trailing slash in the UI I can login but get the same error as above, and API requests return `The token isn't valid` since I assume it's comparing the issuer against what is configured, which is failing
saavagebueno commented 2025-11-20 05:07:26 -05:00
Author
Owner
Copy Link

@BeryJu commented on GitHub (Oct 7, 2022):

See the issue linked above, I monkey-patched this in the compiled main.js file and I can now correctly set the issuer. However there's still some 401 errors but also a warning due to base64-encoding

main.9e66752d.js:formatted:2797 DOMException: Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded.
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:43246
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:43311
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40691
    at Object.next (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40796)
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:39707
    at new Promise (<anonymous>)
    at a (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:39452)
    at v (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:42818)
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:41529
    at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40691

I can't quite tell yet where the code that does this is from (and I feel like this is due to some missing base64 padding, which I dont think the spec asks for?)

@BeryJu commented on GitHub (Oct 7, 2022): See the issue linked above, I monkey-patched this in the compiled main.js file and I can now correctly set the issuer. However there's still some 401 errors but also a warning due to base64-encoding ``` main.9e66752d.js:formatted:2797 DOMException: Failed to execute 'atob' on 'Window': The string to be decoded is not correctly encoded. at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:43246 at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:43311 at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40691 at Object.next (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40796) at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:39707 at new Promise (<anonymous>) at a (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:39452) at v (https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:42818) at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:41529 at https://netbird.infra.beryju.io/static/js/main.9e66752d.js:2:40691 ``` I can't quite tell yet where the code that does this is from (and I feel like this is due to some missing base64 padding, which I dont think the spec asks for?)
saavagebueno commented 2025-11-20 05:07:26 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 16, 2023):

@dcshoes23 recently we added authentik integration, you can find the docs here: https://docs.netbird.io/selfhosted/identity-providers#authentik

@mlsmaycon commented on GitHub (Jun 16, 2023): @dcshoes23 recently we added authentik integration, you can find the docs here: https://docs.netbird.io/selfhosted/identity-providers#authentik
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#176
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?