SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-11 18:51:53 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird selfhosted fails setup with Okta Integration #398

New Issue
Closed
opened 2025-11-20 05:10:47 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 05:10:47 -05:00
Owner
Copy Link

Originally created by @TechIsCool on GitHub (Jul 19, 2023).

Describe the problem

From a clean setup for self-hosted and leveraging Okta as the IDP we encountered that wt_account_id and wt_pending_invite seems to be added to Okta's default User Profile and is required under Profile enrollment. This impacts every application in Okta, not just the configured Applications that Netbird should be using. We were confused the first time we set this up. (luckily in a dev account).

After moving the wt_account_id and wt_pending_invite to the Applications Profile we got past the weird unknown value from a end users perspective when adding a device. After that we are still encountering a couple of errors.

From the Servers perspective

infrastructure_files-management-1  | 2023-07-20T00:48:53Z ERRO management/server/grpcserver.go:234: got an unhandled error: rpc error: code = Internal desc = unable to fetch account with claims, err: the API returned an error: Invalid search criteria.. Causes: errorSummary: Invalid search attribute.
The code line from the error above is management/server/grpcserver.go:234

From the Clients perspective:

╰─ netbird -l debug up --management-url https://<mydomain>:33073
Please do the SSO login in your browser.
If your browser didn't open automatically, use this URL to log in:

 https://dev-1234567.okta.com/activate?user_code=DK...

Error: waiting sso login failed with: rpc error: code = Internal desc = failed handling request

We never did succeed at getting a self-hosted version of Netbird running.

Pending questions we had

  • wt_account_id isn't clearly defined is it even required?

Might be Related

We also asked in the slack channel here

Originally created by @TechIsCool on GitHub (Jul 19, 2023). **Describe the problem** From a clean setup for self-hosted and leveraging Okta as the IDP we encountered that `wt_account_id` and `wt_pending_invite` seems to be added to Okta's default User Profile and is required under Profile enrollment. This impacts every application in Okta, not just the configured Applications that Netbird should be using. We were confused the first time we set this up. (luckily in a dev account). After moving the `wt_account_id` and `wt_pending_invite` to the Applications Profile we got past the weird unknown value from a end users perspective when adding a device. After that we are still encountering a couple of errors. From the Servers perspective ``` infrastructure_files-management-1 | 2023-07-20T00:48:53Z ERRO management/server/grpcserver.go:234: got an unhandled error: rpc error: code = Internal desc = unable to fetch account with claims, err: the API returned an error: Invalid search criteria.. Causes: errorSummary: Invalid search attribute. The code line from the error above is management/server/grpcserver.go:234 ``` From the Clients perspective: ``` ╰─ netbird -l debug up --management-url https://<mydomain>:33073 Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://dev-1234567.okta.com/activate?user_code=DK... Error: waiting sso login failed with: rpc error: code = Internal desc = failed handling request ``` We never did succeed at getting a self-hosted version of Netbird running. Pending questions we had - `wt_account_id` isn't clearly defined is it even required? Might be Related - #959 We also asked in the slack channel [here](https://netbirdio.slack.com/archives/C028VPB34NB/p1689815017365149?thread_ts=1688852052.206139&cid=C028VPB34NB)
saavagebueno added the bugwaiting-feedback labels 2025-11-20 05:10:47 -05:00
saavagebueno commented 2025-11-20 05:10:48 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jul 22, 2023):

Hello @TechIsCool the PR #1023 fixed the issue; we are hiding the parameters so it doesn't interfere with the user's regular authentication. We could not use the application profile with the API because of permissions reasons as it requires previous configuration.

Can you confirm and close the issue?

@mlsmaycon commented on GitHub (Jul 22, 2023): Hello @TechIsCool the PR #1023 fixed the issue; we are hiding the parameters so it doesn't interfere with the user's regular authentication. We could not use the application profile with the API because of permissions reasons as it requires previous configuration. Can you confirm and close the issue?
saavagebueno commented 2025-11-20 05:10:48 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 17, 2025):

closing for lack of feedback

@nazarewk commented on GitHub (Apr 17, 2025): closing for lack of feedback
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label bug waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#398
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?