SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-09 17:02:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

0.59.12 client login hint breaks login when username is not equal to email #2467

New Issue
Open
opened 2025-11-20 07:10:09 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 07:10:09 -05:00
Owner
Copy Link

Originally created by @ssn-github on GitHub (Nov 17, 2025).

Describe the problem
Since this change in 0.59.12: [client] Add login_hint to oidc flows https://github.com/netbirdio/netbird/pull/4724

Some users are unable authenticate with Azure/Entra because the login_hint parameter added to the url uses the email address instead of the username.

I tried to add "LoginHint": "" to the management.json PKCEAuthorizationFlow part, because I found a check if p.providerConfig.LoginHint != "" in the code but that didn't change the behavior.
It works once for new users or if I delete the PROFILE.state.json file which contains the info for the login hint. Also if I manually remove the login_hint parameter from the url it works as well.

Is there any other way to not use the login_hint in the url or to configure it using another attribute than email? Or am I just using the LoginHint parameter in the management.json wrong?

To Reproduce

Steps to reproduce the behavior:

  1. Have at least client 0.59.12 and azure/entra authentication where some users do not have their email as the username
  2. Click on connect
  3. browser opens login.microsoftonline.com but it doesn't recognize the username and so fails to authenticate

Expected behavior

Either an option to not use login_hint (similar to DisablePromptLogin) or use the username instead of email for the hint

Are you using NetBird Cloud?

self-hosted

NetBird version

0.59.13, latest docker images

Is any other VPN software installed?

no

Additional context

Clients are Windows 11 with Entra Seamless-SSO, so they usually do not need to enter their username or password but instead are automatically authenticated with their current Windows session.
I also use DisablePromptLogin: true in the management.json

Have you tried these troubleshooting steps?

  • [x ] Reviewed client troubleshooting (if applicable)
  • [x ] Checked for newer NetBird versions
  • [x ] Searched for similar issues on GitHub (including closed ones)
  • [ x] Restarted the NetBird client
  • [ x] Disabled other VPN software
  • [ x] Checked firewall settings
Originally created by @ssn-github on GitHub (Nov 17, 2025). **Describe the problem** Since this change in 0.59.12: [client] Add login_hint to oidc flows https://github.com/netbirdio/netbird/pull/4724 Some users are unable authenticate with Azure/Entra because the login_hint parameter added to the url uses the email address instead of the username. I tried to add "LoginHint": "" to the management.json PKCEAuthorizationFlow part, because I found a check `if p.providerConfig.LoginHint != ""` in the code but that didn't change the behavior. It works once for new users or if I delete the PROFILE.state.json file which contains the info for the login hint. Also if I manually remove the login_hint parameter from the url it works as well. Is there any other way to not use the login_hint in the url or to configure it using another attribute than email? Or am I just using the LoginHint parameter in the management.json wrong? **To Reproduce** Steps to reproduce the behavior: 1. Have at least client 0.59.12 and azure/entra authentication where some users do not have their email as the username 2. Click on connect 3. browser opens login.microsoftonline.com but it doesn't recognize the username and so fails to authenticate **Expected behavior** Either an option to not use login_hint (similar to DisablePromptLogin) or use the username instead of email for the hint **Are you using NetBird Cloud?** self-hosted **NetBird version** 0.59.13, latest docker images **Is any other VPN software installed?** no **Additional context** Clients are Windows 11 with Entra Seamless-SSO, so they usually do not need to enter their username or password but instead are automatically authenticated with their current Windows session. I also use DisablePromptLogin: true in the management.json **Have you tried these troubleshooting steps?** - [x ] Reviewed [client troubleshooting](https://docs.netbird.io/how-to/troubleshooting-client) (if applicable) - [x ] Checked for newer NetBird versions - [x ] Searched for similar issues on GitHub (including closed ones) - [ x] Restarted the NetBird client - [ x] Disabled other VPN software - [ x] Checked firewall settings
saavagebueno added the triage-needed label 2025-11-20 07:10:09 -05:00
saavagebueno commented 2025-11-20 07:10:11 -05:00
Author
Owner
Copy Link

@azmarifuzzaman commented on GitHub (Nov 17, 2025):

We also have the same issue with OKTA for our self hosted Netbird. I came here to create an issue, and found this! :)
Thanks!

We tested by changing in the code;
so I extracted "preferred_username" instead of "email" and changed the name too in respective places, and built the binary for linux, it works and the state file now I have:

Image

But today we found a better workaround in OKTA configuration; so we could map the "email" claim to "user.login" in OKTA settings for our Netbird app. With this in place, now Netbird works like before, so we get the login_hint as our actual login, not the email. So we don't need to create our own binary/rpm eventually.

@azmarifuzzaman commented on GitHub (Nov 17, 2025): We also have the same issue with OKTA for our self hosted Netbird. I came here to create an issue, and found this! :) Thanks! We tested by changing in the code; so I extracted "preferred_username" instead of "email" and changed the name too in respective places, and built the binary for linux, it works and the state file now I have: <img width="581" height="121" alt="Image" src="https://github.com/user-attachments/assets/6168eab8-2a10-4e09-87fd-76a93a3a1b67" /> But today we found a better workaround in OKTA configuration; so we could map the "email" claim to "user.login" in OKTA settings for our Netbird app. With this in place, now Netbird works like before, so we get the login_hint as our actual login, not the email. So we don't need to create our own binary/rpm eventually.
saavagebueno commented 2025-11-20 07:10:11 -05:00
Author
Owner
Copy Link

@saule1508 commented on GitHub (Nov 17, 2025):

Indeed, the code cannot assume that email is used to login to the OIDC provider, it should be configurable.
Since okta already has the "Remember me" function (which stores the user in local storage), the login_hint does not bring extra value for us so ability to disable it would be good enough

@saule1508 commented on GitHub (Nov 17, 2025): Indeed, the code cannot assume that email is used to login to the OIDC provider, it should be configurable. Since okta already has the "Remember me" function (which stores the user in local storage), the login_hint does not bring extra value for us so ability to disable it would be good enough
saavagebueno commented 2025-11-20 07:10:11 -05:00
Author
Owner
Copy Link

@sisumara commented on GitHub (Nov 19, 2025):

It seems that I have a similar issue with Zitadel on 59.12 or higher client. Is there any changes which should be done on IDP side or management configuration?

@sisumara commented on GitHub (Nov 19, 2025): It seems that I have a similar issue with Zitadel on 59.12 or higher client. Is there any changes which should be done on IDP side or management configuration?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#2467
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?