netbird 0.40.0 breaks authentik sso #1807

@ginsul commented on GitHub (Apr 11, 2025):

I'm having the same issue too. I just upgraded the NetBird Windows client, but the NetBird server hasn't been upgraded to 0.40.0 or 0.40.1.
Have you tried upgrading both the NetBird server and client? Or is the only workaround to re-add all peers again?

@mlsmaycon me too using authentik and asking for login twice but still not connected (using older version works)

@ginsul commented on GitHub (Apr 11, 2025): I'm having the same issue too. I just upgraded the NetBird Windows client, but the NetBird server hasn't been upgraded to 0.40.0 or 0.40.1. Have you tried upgrading both the NetBird server and client? Or is the only workaround to re-add all peers again? @mlsmaycon me too using authentik and asking for login twice but still not connected (using older version works)

saavagebueno commented

@mlsmaycon commented on GitHub (Apr 11, 2025):

@ginsul thanks for the clarification

@mlsmaycon commented on GitHub (Apr 11, 2025): @ginsul thanks for the clarification

saavagebueno commented

@B08Z commented on GitHub (Apr 11, 2025):

I updated Mac client and noticed that it broke authentik login. Asked twice, it connects but immediately goes offline in the dashboard.

Error on management server states no setup key orvalid Auth method on SSO.

I then uploaded the server stack to 40.1 hoping that would fix the issue.

However any sso client (Authentik) now fails to connect. Or rather it connects momentarily and then disconnects.

Rolled server back to 39.2 no change
Rolled sso client back no change

@B08Z commented on GitHub (Apr 11, 2025): I updated Mac client and noticed that it broke authentik login. Asked twice, it connects but immediately goes offline in the dashboard. Error on management server states no setup key orvalid Auth method on SSO. I then uploaded the server stack to 40.1 hoping that would fix the issue. However any sso client (Authentik) now fails to connect. Or rather it connects momentarily and then disconnects. Rolled server back to 39.2 no change Rolled sso client back no change

saavagebueno commented

@Codixer commented on GitHub (Apr 11, 2025):

I can confirm this, since this is a client issue. I rolled a (desktop) client back to 0.39.2 and this (temporarily) resolved the problem. However, this caused somewhat of a confusion with the clients.

@Codixer commented on GitHub (Apr 11, 2025): I can confirm this, since this is a client issue. I rolled a (desktop) client back to 0.39.2 and this (temporarily) resolved the problem. However, this caused somewhat of a confusion with the clients.

saavagebueno commented

@mlsmaycon commented on GitHub (Apr 11, 2025):

Thanks folks.

I was thinking that the asking for authentication was the problem. But when it doesn't work after entering the login, then we need a workaround for IdPs that behave the same.

The Pr #3660 will introduce a new flag for the PKCE config, to disable the prompt in these cases.

@mlsmaycon commented on GitHub (Apr 11, 2025): Thanks folks. I was thinking that the asking for authentication was the problem. But when it doesn't work after entering the login, then we need a workaround for IdPs that behave the same. The Pr #3660 will introduce a new flag for the PKCE config, to disable the prompt in these cases.

saavagebueno commented

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025):

Thanks for looking into this!

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025): Thanks for looking into this!

saavagebueno commented

@B08Z commented on GitHub (Apr 11, 2025):

Is there a time line on this.
Curntly I am locked out of netbird and dont have access to a remote network, so rebuilding the whole stack and wiping the database will be a significant issue.

Sorry that sounds demanding...I really apreciate you looking into this and all the work that has gone on. Just working out if I pull the trigger or wait.

@B08Z commented on GitHub (Apr 11, 2025): Is there a time line on this. Curntly I am locked out of netbird and dont have access to a remote network, so rebuilding the whole stack and wiping the database will be a significant issue. - Sorry that sounds demanding...I really apreciate you looking into this and all the work that has gone on. Just working out if I pull the trigger or wait.

saavagebueno commented

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025):

@B08Z Removing the peers in netbird dashboard and downgrading the client to 0.39.2 should fix the issue

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025): @B08Z Removing the peers in netbird dashboard and downgrading the client to 0.39.2 should fix the issue

saavagebueno commented

@B08Z commented on GitHub (Apr 11, 2025):

Unfortuneately after downgrading every thing to 39.2 and removing all affected peers from the dashboad I am still faceing the same issue.

Peer with SSO logins in (via Authentik SSO, is authed correctly) it then appears very briefly in the dashboard before going offline. Only logs I have from the mangement server are:

2025-04-11T11:59:46Z INFO [context: SYSTEM] management/server/account.go:196: single account mode enabled, accounts number 1
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:320: running gRPC backward compatibility server: [::]:33073
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:352: management server version 0.39.2
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:353: running HTTP server and gRPC server on the same port: [::]:443
2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:462: 1 entries received from IdP management
2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:493: warmed up IDP cache with 2 entries for 1 accounts

2025-04-11T12:02:48Z WARN [context: GRPC, requestID: f3f986b7-1704-46ff-9619-XXXXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJXXXXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XOzorca3XXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login
2025-04-11T12:02:50Z WARN [context: GRPC, requestID: 71bbadfb-5560-4cc4-84a5-XXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJuXhJVXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XXXXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login

@B08Z commented on GitHub (Apr 11, 2025): Unfortuneately after downgrading every thing to 39.2 and removing all affected peers from the dashboad I am still faceing the same issue. Peer with SSO logins in (via Authentik SSO, is authed correctly) it then appears very briefly in the dashboard before going offline. Only logs I have from the mangement server are: 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/server/account.go:196: single account mode enabled, accounts number 1 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:320: running gRPC backward compatibility server: [::]:33073 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:352: management server version 0.39.2 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:353: running HTTP server and gRPC server on the same port: [::]:443 2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:462: 1 entries received from IdP management 2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:493: warmed up IDP cache with 2 entries for 1 accounts 2025-04-11T12:02:48Z WARN [context: GRPC, requestID: f3f986b7-1704-46ff-9619-XXXXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJXXXXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XOzorca3XXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login 2025-04-11T12:02:50Z WARN [context: GRPC, requestID: 71bbadfb-5560-4cc4-84a5-XXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJuXhJVXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XXXXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login

saavagebueno commented

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025):

It is also breaking SSO login with okta as idp..

@marcportabellaclotet-mt commented on GitHub (Apr 11, 2025): It is also breaking SSO login with okta as idp..

saavagebueno commented

@Codixer commented on GitHub (Apr 11, 2025):

I have a feeling this broke more then it intended.

@Codixer commented on GitHub (Apr 11, 2025): I have a feeling this broke more then it intended.

saavagebueno commented

@B08Z commented on GitHub (Apr 11, 2025):

Unfortuneately after downgrading every thing to 39.2 and removing all affected peers from the dashboad I am still faceing the same issue.

Peer with SSO logins in (via Authentik SSO, is authed correctly) it then appears very briefly in the dashboard before going offline. Only logs I have from the mangement server are:

2025-04-11T11:59:46Z INFO [context: SYSTEM] management/server/account.go:196: single account mode enabled, accounts number 1
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:320: running gRPC backward compatibility server: [::]:33073
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:352: management server version 0.39.2
2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:353: running HTTP server and gRPC server on the same port: [::]:443
2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:462: 1 entries received from IdP management
2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:493: warmed up IDP cache with 2 entries for 1 accounts

2025-04-11T12:02:48Z WARN [context: GRPC, requestID: f3f986b7-1704-46ff-9619-XXXXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJXXXXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XOzorca3XXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login
2025-04-11T12:02:50Z WARN [context: GRPC, requestID: 71bbadfb-5560-4cc4-84a5-XXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJuXhJVXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XXXXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login

So ignore this, I had messed my signal config.

Reverting to 39.2 solves the issue. .

Unfortunately I deleted my whole database to try and fixed it 🤦.

Still good to test.
Fingers crossed for a quick resolve.

@B08Z commented on GitHub (Apr 11, 2025): > Unfortuneately after downgrading every thing to 39.2 and removing all affected peers from the dashboad I am still faceing the same issue. > > Peer with SSO logins in (via Authentik SSO, is authed correctly) it then appears very briefly in the dashboard before going offline. Only logs I have from the mangement server are: > > > 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/server/account.go:196: single account mode enabled, accounts number 1 > 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:320: running gRPC backward compatibility server: [::]:33073 > 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:352: management server version 0.39.2 > 2025-04-11T11:59:46Z INFO [context: SYSTEM] management/cmd/management.go:353: running HTTP server and gRPC server on the same port: [::]:443 > 2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:462: 1 entries received from IdP management > 2025-04-11T11:59:47Z INFO [context: SYSTEM] management/server/account.go:493: warmed up IDP cache with 2 entries for 1 accounts > > > 2025-04-11T12:02:48Z WARN [context: GRPC, requestID: f3f986b7-1704-46ff-9619-XXXXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJXXXXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XOzorca3XXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login > 2025-04-11T12:02:50Z WARN [context: GRPC, requestID: 71bbadfb-5560-4cc4-84a5-XXXXXX, accountID: UNKNOWN, peerID: l75SfqoKoXjj5gyJuXhJVXXXXXXXXXXX=] management/server/grpcserver.go:474: failed logging in peer l75SfqoKoXjj5gyJuXhJV67XXXXXXXXXXX=: no peer auth method provided, please use a setup key or interactive SSO login So ignore this, I had messed my signal config. Reverting to 39.2 solves the issue. . Unfortunately I deleted my whole database to try and fixed it 🤦. Still good to test. Fingers crossed for a quick resolve.

saavagebueno commented

@marcportabellaclotet-mt commented on GitHub (Apr 12, 2025):

I just built the master branch that includes the fix, and it works as expected.

However, since this is a breaking change that could impact many systems, what do you think about taking the opposite approach? That is, keeping the feature disabled by default, and requiring users to explicitly enable it.

This would help avoid the need for widespread reconfiguration on existing self-hosted Netbird servers.

@marcportabellaclotet-mt commented on GitHub (Apr 12, 2025): I just built the master branch that includes the fix, and it works as expected. However, since this is a breaking change that could impact many systems, what do you think about taking the opposite approach? That is, keeping the feature disabled by default, and requiring users to explicitly enable it. This would help avoid the need for widespread reconfiguration on existing self-hosted Netbird servers.

saavagebueno commented

@Codixer commented on GitHub (Apr 12, 2025):

Please do the above yes, the login change broke our entire instance. We are unable to upgrade above 0.39.2 due to this.

@Codixer commented on GitHub (Apr 12, 2025): Please do the above yes, the login change broke our entire instance. We are unable to upgrade above 0.39.2 due to this.

saavagebueno commented

@JasmeowTheCat commented on GitHub (Apr 13, 2025):

Sorry to chase folks - It's still impacting us here as it's quite frustrating. Any news @mlsmaycon

@JasmeowTheCat commented on GitHub (Apr 13, 2025): Sorry to chase folks - It's still impacting us here as it's quite frustrating. Any news @mlsmaycon

saavagebueno commented

@mlsmaycon commented on GitHub (Apr 14, 2025):

Hello Folks,

We've released the 0.41.0 version. Now you can set PKCEAuthorizationFlow.ProviderConfig.DisablePromptLogin in the management.json to disable the prompt=login.

See example below:

    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "Audience": "bkjhvkjhvjlvkhjlvljv",
            "ClientID": "bkjhvkjhvjlvkhjlvljv",
            ...
            "DisablePromptLogin": true
        }
    }

Then, just restart the management service with docker compose restart management.

Also, your clients should be upgraded to 0.41.0.

@mlsmaycon commented on GitHub (Apr 14, 2025): Hello Folks, We've released the 0.41.0 version. Now you can set `PKCEAuthorizationFlow.ProviderConfig.DisablePromptLogin` in the management.json to disable the `prompt=login`. See example below: ```json "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "bkjhvkjhvjlvkhjlvljv", "ClientID": "bkjhvkjhvjlvkhjlvljv", ... "DisablePromptLogin": true } } ``` Then, just restart the management service with `docker compose restart management`. Also, your clients should be upgraded to 0.41.0.

saavagebueno commented

@marcportabellaclotet-mt commented on GitHub (Apr 14, 2025):

Thanks for looking into this @mlsmaycon

@marcportabellaclotet-mt commented on GitHub (Apr 14, 2025): Thanks for looking into this @mlsmaycon

saavagebueno commented