SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-14 12:12:27 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Blank dashboard not redirecting/authenticating #2149

New Issue
Open
opened 2025-11-20 07:04:48 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 07:04:48 -05:00
Owner
Copy Link

Originally created by @sikz1 on GitHub (Aug 2, 2025).

I am porting a previous self-hosted PoC to a more reliable/available infrastructure.

Everything runs the latest netbird versions (servers and clients).

Dashboard and management have different domain names and run both behind a reverse proxy that terminates TLS on port 443. The traffic is then proxied over http to containers running on a docker swarm.

The containers reach each other via TLS and running, for example, curl https://<management_domain>/api/users from the dashboard to the management domain I get {"message":"no valid authentication provided","code":401} meaning I get there.

I am using Azure Entra ID as IdP.

The clients authenticate via the IdP with no problem and connect and talk to each other. Running netbird status -d shows all green: management, signal, relays, stun and turn are all connected.

The problem is that no matter what I do, the dashboard remains blank.

When I try to reach /peers URI on the dashboard I get these headers and that's it:

:status: 200
Alt-Svc: h3=":443"; ma=2592000
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Content-Encoding: gzip
Content-Type: text/html
Date: Sat, 02 Aug 2025 18:11:41 GMT
ETag: W/"688a348f-2c9a"
Last-Modified: Wed, 30 Jul 2025 15:04:47 GMT
Server: nginx
Vary: Accept-Encoding
Via: 1.1 Caddy

As far as I understand, in case I'm not logged in, the dashboard should redirect to my IdP but it doesn't. I had a look inside the dashboard container and the init script runs fine (exits 0) and the env variables are all there with the right values:

LETSENCRYPT_EMAIL=
LETSENCRYPT_DOMAIN=
DISABLE_LETSENCRYPT=true
NETBIRD_DOMAIN=<DASHBOARD_DOMAIN>
AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
USE_AUTH0=false
AUTH_OIDC_CONFIGURATION_ENDPOINT=https://login.microsoftonline.com/<TENANT>/v2.0/.well-known/openid-configuration
NETBIRD_OIDC_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0
OIDC_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0
AUTH_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0
AUTH_REDIRECT_URI=/auth
AUTH_SILENT_REDIRECT_URI=/silent-auth
AUTH_AUDIENCE=<CLIENT_ID>
AUTH_CLIENT_ID=<CLIENT_ID>
AUTH_CLIENT_SECRET=<SECRET>
NETBIRD_MGMT_API_ENDPOINT=https://<MANAGEMENT_DOMAIN>
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://<MANAGEMENT_DOMAIN>
# tried idToken, no luck
NETBIRD_TOKEN_SOURCE=accessToken
# an attempt
NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true

Did quite a lot of checks on the issues and I see I'm not alone. Tried everything I read about twice (LoginFlag, IdpSignKeyRefreshEnabled, UseIDToken, DisablePromptLogin and other suggested solutions) but can't make this thing work.

The logs do not show any strange activity on both the dashboard and the management servers. Entra logs successful logins when I connect the clients.

Any idea about why the dashboard refuses to authenticate me?

Originally created by @sikz1 on GitHub (Aug 2, 2025). I am porting a previous self-hosted PoC to a more reliable/available infrastructure. Everything runs the latest netbird versions (servers and clients). Dashboard and management have different domain names and run both behind a reverse proxy that terminates TLS on port 443. The traffic is then proxied over http to containers running on a docker swarm. The containers reach each other via TLS and running, for example, `curl https://<management_domain>/api/users` from the dashboard to the management domain I get `{"message":"no valid authentication provided","code":401}` meaning I get there. I am using Azure Entra ID as IdP. The clients authenticate via the IdP with no problem and connect and talk to each other. Running `netbird status -d` shows all green: management, signal, relays, stun and turn are all connected. The problem is that no matter what I do, the dashboard remains blank. When I try to reach `/peers` URI on the dashboard I get these headers and that's it: ``` :status: 200 Alt-Svc: h3=":443"; ma=2592000 Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0 Content-Encoding: gzip Content-Type: text/html Date: Sat, 02 Aug 2025 18:11:41 GMT ETag: W/"688a348f-2c9a" Last-Modified: Wed, 30 Jul 2025 15:04:47 GMT Server: nginx Vary: Accept-Encoding Via: 1.1 Caddy ``` As far as I understand, in case I'm not logged in, the dashboard should redirect to my IdP but it doesn't. I had a look inside the dashboard container and the init script runs fine (exits 0) and the env variables are all there with the right values: ``` LETSENCRYPT_EMAIL= LETSENCRYPT_DOMAIN= DISABLE_LETSENCRYPT=true NETBIRD_DOMAIN=<DASHBOARD_DOMAIN> AUTH_SUPPORTED_SCOPES="openid profile email offline_access api" USE_AUTH0=false AUTH_OIDC_CONFIGURATION_ENDPOINT=https://login.microsoftonline.com/<TENANT>/v2.0/.well-known/openid-configuration NETBIRD_OIDC_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0 OIDC_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0 AUTH_AUTHORITY=https://login.microsoftonline.com/<TENANT>/v2.0 AUTH_REDIRECT_URI=/auth AUTH_SILENT_REDIRECT_URI=/silent-auth AUTH_AUDIENCE=<CLIENT_ID> AUTH_CLIENT_ID=<CLIENT_ID> AUTH_CLIENT_SECRET=<SECRET> NETBIRD_MGMT_API_ENDPOINT=https://<MANAGEMENT_DOMAIN> NETBIRD_MGMT_GRPC_API_ENDPOINT=https://<MANAGEMENT_DOMAIN> # tried idToken, no luck NETBIRD_TOKEN_SOURCE=accessToken # an attempt NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true ``` Did quite a lot of checks on the issues and I see I'm not alone. Tried everything I read about twice (`LoginFlag`, `IdpSignKeyRefreshEnabled`, `UseIDToken`, `DisablePromptLogin` and other suggested solutions) but can't make this thing work. The logs do not show any strange activity on both the dashboard and the management servers. Entra logs successful logins when I connect the clients. Any idea about why the dashboard refuses to authenticate me?
saavagebueno added the triage-needed label 2025-11-20 07:04:48 -05:00
saavagebueno commented 2025-11-20 07:04:49 -05:00
Author
Owner
Copy Link

@Alfamari commented on GitHub (Aug 31, 2025):

Same issue on floorp (portable version installed with scoop on windows). Fixed by switching to vivaldi (also portable version installed with scoop on windows).

@Alfamari commented on GitHub (Aug 31, 2025): Same issue on floorp (portable version installed with scoop on windows). Fixed by switching to vivaldi (also portable version installed with scoop on windows).
saavagebueno commented 2025-11-20 07:04:49 -05:00
Author
Owner
Copy Link

@sikz1 commented on GitHub (Sep 16, 2025):

Tried with every browser under the sun, does not work. All the images have been updated to the latest releases but still no way to get to the dashboard. Am I the only one experiencing this behaviour?

@sikz1 commented on GitHub (Sep 16, 2025): Tried with every browser under the sun, does not work. All the images have been updated to the latest releases but still no way to get to the dashboard. Am I the only one experiencing this behaviour?
saavagebueno commented 2025-11-20 07:04:50 -05:00
Author
Owner
Copy Link

@JaccoVE commented on GitHub (Sep 16, 2025):

Nope, I’m having the same problem. I tried several versions of the images, different reverse proxy configurations and Authentik settings, but I keep having the same problem. I gave up for now, but still hope this issue can be resolved.

@JaccoVE commented on GitHub (Sep 16, 2025): Nope, I’m having the same problem. I tried several versions of the images, different reverse proxy configurations and Authentik settings, but I keep having the same problem. I gave up for now, but still hope this issue can be resolved.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2149
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?