SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-17 13:42:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Interactive SSO with Authentik #246

New Issue
Closed
opened 2025-11-20 05:08:33 -05:00 by saavagebueno · 9 comments
saavagebueno commented 2025-11-20 05:08:33 -05:00
Owner
Copy Link

Originally created by @mitsecsrl on GitHub (Dec 4, 2022).

Hello, I'm testing selfhosted netbird / authentik in docker (latest version of both) for a small setup (both behind nginxproxymanager for the sake of completeness)
I'm having some issues but I'm not really sure if I'm doing something wrong or simply trying to achieve something that it's not there yet

As of now it's working fine, but .. I'm the only user and I added all my devices with setup keys
This is what I'm trying to achieve:

  • a set of admin users each with his own devices
  • a set of normal users each with his own devices
  • a couple of groups
  • some devices shared between users (groups + ACL)

I created a new user in authentik and logged in to netbird, but as user (role) I can't create setup keys so I need to enroll my peers with interactive sso

After some digging (doc / code) I decided that my netbird instance needs this to get interactive SSO working:

 "DeviceAuthorizationFlow": {
        "Provider": "hosted",
  ..
 }

and when I try to connect with netbird ui I get the authentik login prompt which looks promising.. but soon after login I get redirected to https://authentik.mydomain.com/device?code=XXXXXX and I get a 404
Not sure if I'm missing something in authentik setup or netbird, the redirect url gets passed along in the login requests as the "next" parameter with value "/device?code=XXXX"
I saw some reference to the next parameter in authentik default_authentication_flow, but I'm not sure if I'm supposed to add some configuration somewhere or - as I said before - I'm simply trying to achieve something that is not there yet (the lack of official docs raised some questions but .. here we are)

Then there's problem #2: as the newly created user I can't see any (shared) peers in the webui - I assumed maybe not having any peers of my own could affect that?
Not sure if the ACL are properly setup, anyway if I can't enroll a peer that's not even a problem (yet) :)

At the moment I'm not even sure if the issue is with netbird, authentik or both so, any suggestion or insight is highly appreciated
Thanks

Originally created by @mitsecsrl on GitHub (Dec 4, 2022). Hello, I'm testing selfhosted netbird / authentik in docker (latest version of both) for a small setup (both behind nginxproxymanager for the sake of completeness) I'm having some issues but I'm not really sure if I'm doing something wrong or simply trying to achieve something that it's not there yet As of now it's working fine, but .. I'm the only user and I added all my devices with setup keys This is what I'm trying to achieve: - a set of admin users each with his own devices - a set of normal users each with his own devices - a couple of groups - some devices shared between users (groups + ACL) I created a new user in authentik and logged in to netbird, but as user (role) I can't create setup keys so I need to enroll my peers with interactive sso After some digging (doc / code) I decided that my netbird instance needs this to get interactive SSO working: ``` "DeviceAuthorizationFlow": { "Provider": "hosted", .. } ``` and when I try to connect with netbird ui I get the authentik login prompt which looks promising.. but soon after login I get redirected to https://authentik.mydomain.com/device?code=XXXXXX and I get a 404 Not sure if I'm missing something in authentik setup or netbird, the redirect url gets passed along in the login requests as the "next" parameter with value "/device?code=XXXX" I saw some reference to the next parameter in authentik default_authentication_flow, but I'm not sure if I'm supposed to add some configuration somewhere or - as I said before - I'm simply trying to achieve something that is not there yet (the lack of official docs raised some questions but .. here we are) Then there's problem #2: as the newly created user I can't see any (shared) peers in the webui - I assumed maybe not having any peers of my own could affect that? Not sure if the ACL are properly setup, anyway if I can't enroll a peer that's not even a problem (yet) :) At the moment I'm not even sure if the issue is with netbird, authentik or both so, any suggestion or insight is highly appreciated Thanks
saavagebueno commented 2025-11-20 05:08:33 -05:00
Author
Owner
Copy Link

@breagan-acs commented on GitHub (Dec 5, 2022):

@mitsecsrl - I'm having the same problem too. Have you seen any url scheme that's supposed to be used with the device auth in Authentik that the Netbird code would need to use? (FYI, I'm a noob at this stuff so I might be asking the wrong question)

@breagan-acs commented on GitHub (Dec 5, 2022): @mitsecsrl - I'm having the same problem too. Have you seen any url scheme that's supposed to be used with the device auth in Authentik that the Netbird code would need to use? (FYI, I'm a noob at this stuff so I might be asking the wrong question)
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@braginini commented on GitHub (Dec 5, 2022):

Hey @mitsecsrl @breagan-acs
I will be testing this PR tomorrow and will check the device flow.
https://github.com/netbirdio/docs/pull/23

But maybe @matejdivecky could help?

Also, might be worth asking on our slack
https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A

@braginini commented on GitHub (Dec 5, 2022): Hey @mitsecsrl @breagan-acs I will be testing this PR tomorrow and will check the device flow. https://github.com/netbirdio/docs/pull/23 But maybe @matejdivecky could help? Also, might be worth asking on our slack https://join.slack.com/t/netbirdio/shared_invite/zt-vrahf41g-ik1v7fV8du6t0RwxSrJ96A
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@breagan-acs commented on GitHub (Dec 5, 2022):

@braginini - answer was in the Slack, thank you! My problem was I didn't setup a default-device-flow in Authentik; soon as I followed @andi's advice to set it to the totp flow it worked great. Happy to help if I can writing docs or helping to test.

Now on to the same problem num 2 you mentioned about other users not seeing the same peers.

@breagan-acs commented on GitHub (Dec 5, 2022): @braginini - answer was in the Slack, thank you! My problem was I didn't setup a default-device-flow in Authentik; soon as I followed @andi's advice to set it to the totp flow it worked great. Happy to help if I can writing docs or helping to test. Now on to the same problem num 2 you mentioned about other users not seeing the same peers.
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@mitsecsrl commented on GitHub (Dec 5, 2022):

@breagan-acs beat me to it, thanks for sharing! I followed your advice and looked up @andi's solution.. it looks like it's working flawlessly
I'm actually seeing all peers with the new account - I still have the all/all ACL rule, maybe that's why; I will definitely test it out now that peer enrollment is working!
I started with a clean session (unauthenticated) so the first time I clicked on connect I was redirected to authentik to login and after that to the authentik dashboard; at this time when I opened netbird dashboard I had no peers but netbird itself wasn't connected.
I clicked connect again and got the authentik prompt warning me I was signing in to netbird.
After being redirected to netbird dashboard I could see all (?) the peers - I will confirm later that I'm seeing all and only what the new user is supposed to (I need to clean my setup first because I did try a lot of hacks to get this working)

Also thanks to @matejdivecky - I think I found (I must say it wasn't easy) the first draft of the guide and followed it to get to this point
The only thing I hadn't done was the removal of the trailing slash in docker-compose.yml - could it be the reason I sometimes got those double slash in .well-known/openid-configuration URI?
I took care of that the hard way - rewrite in nginxpm - I feel your solution is somewhat better :)

@braginini I can confirm @matejdivecky setup guide with the last addition from @andi works, will get back with some feedback, in the meantime thank you!

@braginini @breagan-acs as far as I know the only things missing from the guide are:

"DeviceAuthorizationFlow": {
        "Provider": "none", 
to     
"DeviceAuthorizationFlow": {
        "Provider": "hosted",

and

In Authentik in Admin Interface->System->Tenants->authentik-default->Default flows->Device code flow to default-authenticator-totp

@mitsecsrl commented on GitHub (Dec 5, 2022): @breagan-acs beat me to it, thanks for sharing! I followed your advice and looked up @andi's solution.. it looks like it's working flawlessly I'm actually seeing all peers with the new account - I still have the all/all ACL rule, maybe that's why; I will definitely test it out now that peer enrollment is working! I started with a clean session (unauthenticated) so the first time I clicked on connect I was redirected to authentik to login and after that to the authentik dashboard; at this time when I opened netbird dashboard I had no peers but netbird itself wasn't connected. I clicked connect again and got the authentik prompt warning me I was signing in to netbird. After being redirected to netbird dashboard I could see all (?) the peers - I will confirm later that I'm seeing all and only what the new user is supposed to (I need to clean my setup first because I did try a lot of hacks to get this working) Also thanks to @matejdivecky - I think I found (I must say it wasn't easy) the first draft of the guide and followed it to get to this point The only thing I hadn't done was the removal of the trailing slash in docker-compose.yml - could it be the reason I sometimes got those double slash in .well-known/openid-configuration URI? I took care of that the hard way - rewrite in nginxpm - I feel your solution is somewhat better :) @braginini I can confirm @matejdivecky setup guide with the last addition from @andi works, will get back with some feedback, in the meantime thank you! @braginini @breagan-acs as far as I know the only things missing from the guide are: ``` "DeviceAuthorizationFlow": { "Provider": "none", to "DeviceAuthorizationFlow": { "Provider": "hosted", ``` and `In Authentik in Admin Interface->System->Tenants->authentik-default->Default flows->Device code flow to default-authenticator-totp`
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@breagan-acs commented on GitHub (Dec 6, 2022):

@mitsecsrl - I haven't tested to see if I can get all the users and accounts working in single account mode w/o making sure both the management service command arg --single-account-mode-domain=, and management.json DeviceAuthorizationFlow.ProviderConfig.Domain, match up. Right now, that seems to be working but I'd wonder if it's worth further clarification in the docs on the workings of single account mode.

I gotta say, I'm super pumped about this product because of the native high availability support for network routes. Really makes sense a difference for small orgs being able to afford a level of fault tolerance.

Again, please ping me if I can be of use writing docs or making a setup video (my setup is a Nomad/Docker cluster with CephFS backed storage; using a bridged network for the dashboard/management/signal containers, and a macvlan network for the COTURN server with port forwarding setup on the routers).

@breagan-acs commented on GitHub (Dec 6, 2022): @mitsecsrl - I haven't tested to see if I can get all the users and accounts working in single account mode w/o making sure both the management service command arg --single-account-mode-domain=, and management.json DeviceAuthorizationFlow.ProviderConfig.Domain, match up. Right now, that seems to be working but I'd wonder if it's worth further clarification in the docs on the workings of single account mode. I gotta say, I'm super pumped about this product because of the native high availability support for network routes. Really makes sense a difference for small orgs being able to afford a level of fault tolerance. Again, please ping me if I can be of use writing docs or making a setup video (my setup is a Nomad/Docker cluster with CephFS backed storage; using a bridged network for the dashboard/management/signal containers, and a macvlan network for the COTURN server with port forwarding setup on the routers).
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@dragon2611 commented on GitHub (Apr 5, 2023):

default-authenticator-totp

This doesn't seem to exist on my Authenitk install, I have a default-authenticator-totp-setup flow but not a default-authenticator-totp flow

@dragon2611 commented on GitHub (Apr 5, 2023): > default-authenticator-totp This doesn't seem to exist on my Authenitk install, I have a default-authenticator-totp-setup flow but not a default-authenticator-totp flow
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@epytir123 commented on GitHub (May 4, 2023):

The documentation that @braginini posted works fine. But it uses the client type public instead of confidential. I was not able to use confidential with authentik. Was anyone able to do that or is it not supported at the moment ? Is this a major security issue with public ?

@epytir123 commented on GitHub (May 4, 2023): The documentation that @braginini posted works fine. But it uses the client type public instead of confidential. I was not able to use confidential with authentik. Was anyone able to do that or is it not supported at the moment ? Is this a major security issue with public ?
saavagebueno commented 2025-11-20 05:08:34 -05:00
Author
Owner
Copy Link

@jsbrain commented on GitHub (May 16, 2023):

@epytir123 I have the same questions. Would be great if someone can clarify that and also push the guide to the docs.

@jsbrain commented on GitHub (May 16, 2023): @epytir123 I have the same questions. Would be great if someone can clarify that and also push the guide to the docs.
saavagebueno commented 2025-11-20 05:08:35 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 16, 2023):

We've added integration and docs for authentik here: https://docs.netbird.io/selfhosted/identity-providers#authentik, let us know if you face any issues configuring it

@mlsmaycon commented on GitHub (Jun 16, 2023): We've added integration and docs for authentik here: https://docs.netbird.io/selfhosted/identity-providers#authentik, let us know if you face any issues configuring it
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#246
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?