SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-22 14:03:40 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

SSO Authentik device authentication error #399

New Issue
Closed
opened 2025-11-20 05:10:47 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:10:47 -05:00
Owner
Copy Link

Originally created by @David-Nahorniak on GitHub (Jul 16, 2023).

Originally assigned to: @bcmmbaga on GitHub.

Describe the problem
I'm trying to self-host netbird and authenticate users via Authentik. I can get to the netbird web administration through Authentik just fine. But if I want to authenticate a client device (Linux or Android) via SSO, I am always redirected to a blank page. Address: https://auth.XXXXX.eu/device?code=2XXXXXX3

To Reproduce
Steps to reproduce the behavior:

  1. follow the guidelines for self-hosting and IdPs (I use my own reverse proxy)
  2. run netbird up --management-url https://netbird.XXXXX.eu on the client pc
  3. click on the address

Expected behavior
I expect that after clicking the link, the device verification process will continue and not stop with a blank page.

NetBird status -d output:

Peers detail:
Daemon version: 0.21.8
CLI version: 0.21.8
Management: Disconnected
Signal: Disconnected
FQDN: 
NetBird IP: N/A
Interface type: N/A
Peers count: 0/0 Connected

Screenshots
image
image
image

Additional context
I repeatedly get an error message from the management container:
2023-07-16T08:27:16Z INFO management/server/account.go:1256: overriding JWT Domain and DomainCategory claims since single account mode is enabled

After an unsuccessful login:
2023-07-16T08:26:08Z WARN management/server/grpcserver.go:322: failed logging in peer T98jXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5EUY=

Too log from management conteiner:

time="2023-07-15T18:22:59Z" level=info msg="loading OIDC configuration from the provided IDP configuration endpoint https://auth.xxxx.eu/application/o/netbird/.well-known/openid-configuration"
time="2023-07-15T18:22:59Z" level=info msg="loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.xxxxxxx.eu/application/o/netbird/.well-known/openid-configuration"
time="2023-07-15T18:22:59Z" level=info msg="overriding HttpConfig.AuthIssuer with a new value https://auth.xxxxxxx.eu/application/o/netbird/, previously configured value: https://auth.xxxxxxx.eu/application/o/netbird/"
time="2023-07-15T18:22:59Z" level=info msg="overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.xxxxxxx.eu/application/o/netbird/jwks/, previously configured value: https://auth.xxxxxxx.eu/application/o/netbird/jwks/"
time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.xxxxxxx.eu/application/o/token/, previously configured value: https://auth.xxxxxxx.eu/application/o/token/"
time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.xxxxxxx.eu/application/o/device/, previously configured value: https://auth.xxxxxxx.eu/application/o/device/"
time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.xxxxxxx.eu, previously configured value: "
2023-07-15T18:22:59Z INFO management/server/telemetry/app_metrics.go:161: enabled application metrics and exposing on http://0.0.0.0:8081
2023-07-15T18:22:59Z INFO management/server/account.go:671: single account mode enabled, accounts number 0
2023-07-15T18:23:00Z INFO management/server/account.go:858: warmed up IDP cache with 1 entries
2023-07-15T18:23:00Z INFO management/cmd/management.go:233: running gRPC backward compatibility server: [::]:33073
2023-07-15T18:23:00Z INFO management/cmd/management.go:265: running HTTP server and gRPC server on the same port: [::]:443

cat management.json

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.xxxxxx.eu:3478",
            "Username": "",
            "Password": null
        }
    ],
    "TURNConfig": {
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.xxxxxx.eu:3478",
                "Username": "self",
                "Password": "xxxx"
            }
        ],
        "CredentialsTTL": "12h",
        "Secret": "secret",
        "TimeBasedCredentials": false
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.xxxxxx.eu:433",
        "Username": "",
        "Password": null
    },
    "Datadir": "",
    "HttpConfig": {
        "Address": "0.0.0.0:443",
        "AuthIssuer": "https://auth.xxxxxx.eu/application/o/netbird/",
        "AuthAudience": "xxxx",
        "AuthKeysLocation": "https://auth.xxxxxx.eu/application/o/netbird/jwks/",
        "AuthUserIDClaim": "",
        "CertFile":"",
        "CertKey":"",
        "OIDCConfigEndpoint":"https://auth.xxxxxx.eu/application/o/netbird/.well-known/openid-configuration"
    },
    "IdpManagerConfig": {
        "ManagerType": "authentik",
        "ClientConfig": {
            "Issuer": "https://auth.xxxxxx.eu/application/o/netbird/",
            "TokenEndpoint": "https://auth.xxxxxx.eu/application/o/token/",
            "ClientID": "xxxx",
            "ClientSecret": "",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
  "Password": "xxxx",
  "Username": "Netbird"
}
     },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
          "Audience": "xxxxxx",
          "Domain": "",
          "ClientID": "xxxxxxx",
          "TokenEndpoint": "https://auth.xxxxxx.eu/application/o/token/",
          "DeviceAuthEndpoint": "https://auth.xxxxxx.eu/application/o/device/",
          "Scope": "openid",
          "UseIDToken": false
         }
    }
}

cat setup.env

## example file, you can copy this file to setup.env and update its values
##
# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="netbird.xxxxx.eu"


NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://auth.xxxxx.eu/application/o/netbird/.well-known/openid-configuration"
NETBIRD_USE_AUTH0=false
NETBIRD_AUTH_CLIENT_ID="xxx"
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
NETBIRD_AUTH_AUDIENCE="xxxxxx"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="xxxxx"
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="xxxxxx"

NETBIRD_MGMT_IDP="authentik"
NETBIRD_IDP_MGMT_CLIENT_ID="xxxxxxxx"
NETBIRD_IDP_MGMT_CLIENT_SECRET=""
NETBIRD_IDP_MGMT_EXTRA_USERNAME="Netbird"
NETBIRD_IDP_MGMT_EXTRA_PASSWORD="xxxxxxx"

# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=true
NETBIRD_MGMT_API_PORT=443
NETBIRD_SIGNAL_PORT=433

# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=false
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted
Originally created by @David-Nahorniak on GitHub (Jul 16, 2023). Originally assigned to: @bcmmbaga on GitHub. **Describe the problem** I'm trying to self-host netbird and authenticate users via Authentik. I can get to the netbird web administration through Authentik just fine. But if I want to authenticate a client device (Linux or Android) via SSO, I am always redirected to a blank page. Address: https://auth.XXXXX.eu/device?code=2XXXXXX3 **To Reproduce** Steps to reproduce the behavior: 1. follow the guidelines for self-hosting and IdPs (I use my own reverse proxy) 2. run `netbird up --management-url https://netbird.XXXXX.eu` on the client pc 3. click on the address **Expected behavior** I expect that after clicking the link, the device verification process will continue and not stop with a blank page. **NetBird status -d output:** ``` Peers detail: Daemon version: 0.21.8 CLI version: 0.21.8 Management: Disconnected Signal: Disconnected FQDN: NetBird IP: N/A Interface type: N/A Peers count: 0/0 Connected ``` **Screenshots** ![image](https://github.com/netbirdio/netbird/assets/44706421/fdf290ba-eb4a-4459-82bf-4e4b97eb9f11) ![image](https://github.com/netbirdio/netbird/assets/44706421/1711d6ca-1631-41eb-acec-da5d5eae6eeb) ![image](https://github.com/netbirdio/netbird/assets/44706421/517abb0a-4fd8-49a9-8c87-f6dba7530872) **Additional context** I repeatedly get an error message from the management container: `2023-07-16T08:27:16Z INFO management/server/account.go:1256: overriding JWT Domain and DomainCategory claims since single account mode is enabled` After an unsuccessful login: `2023-07-16T08:26:08Z WARN management/server/grpcserver.go:322: failed logging in peer T98jXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX5EUY=` Too log from management conteiner: ``` time="2023-07-15T18:22:59Z" level=info msg="loading OIDC configuration from the provided IDP configuration endpoint https://auth.xxxx.eu/application/o/netbird/.well-known/openid-configuration" time="2023-07-15T18:22:59Z" level=info msg="loaded OIDC configuration from the provided IDP configuration endpoint: https://auth.xxxxxxx.eu/application/o/netbird/.well-known/openid-configuration" time="2023-07-15T18:22:59Z" level=info msg="overriding HttpConfig.AuthIssuer with a new value https://auth.xxxxxxx.eu/application/o/netbird/, previously configured value: https://auth.xxxxxxx.eu/application/o/netbird/" time="2023-07-15T18:22:59Z" level=info msg="overriding HttpConfig.AuthKeysLocation (JWT certs) with a new value https://auth.xxxxxxx.eu/application/o/netbird/jwks/, previously configured value: https://auth.xxxxxxx.eu/application/o/netbird/jwks/" time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.TokenEndpoint with a new value: https://auth.xxxxxxx.eu/application/o/token/, previously configured value: https://auth.xxxxxxx.eu/application/o/token/" time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.DeviceAuthEndpoint with a new value: https://auth.xxxxxxx.eu/application/o/device/, previously configured value: https://auth.xxxxxxx.eu/application/o/device/" time="2023-07-15T18:22:59Z" level=info msg="overriding DeviceAuthorizationFlow.ProviderConfig.Domain with a new value: auth.xxxxxxx.eu, previously configured value: " 2023-07-15T18:22:59Z INFO management/server/telemetry/app_metrics.go:161: enabled application metrics and exposing on http://0.0.0.0:8081 2023-07-15T18:22:59Z INFO management/server/account.go:671: single account mode enabled, accounts number 0 2023-07-15T18:23:00Z INFO management/server/account.go:858: warmed up IDP cache with 1 entries 2023-07-15T18:23:00Z INFO management/cmd/management.go:233: running gRPC backward compatibility server: [::]:33073 2023-07-15T18:23:00Z INFO management/cmd/management.go:265: running HTTP server and gRPC server on the same port: [::]:443 ``` cat management.json ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:netbird.xxxxxx.eu:3478", "Username": "", "Password": null } ], "TURNConfig": { "Turns": [ { "Proto": "udp", "URI": "turn:netbird.xxxxxx.eu:3478", "Username": "self", "Password": "xxxx" } ], "CredentialsTTL": "12h", "Secret": "secret", "TimeBasedCredentials": false }, "Signal": { "Proto": "https", "URI": "netbird.xxxxxx.eu:433", "Username": "", "Password": null }, "Datadir": "", "HttpConfig": { "Address": "0.0.0.0:443", "AuthIssuer": "https://auth.xxxxxx.eu/application/o/netbird/", "AuthAudience": "xxxx", "AuthKeysLocation": "https://auth.xxxxxx.eu/application/o/netbird/jwks/", "AuthUserIDClaim": "", "CertFile":"", "CertKey":"", "OIDCConfigEndpoint":"https://auth.xxxxxx.eu/application/o/netbird/.well-known/openid-configuration" }, "IdpManagerConfig": { "ManagerType": "authentik", "ClientConfig": { "Issuer": "https://auth.xxxxxx.eu/application/o/netbird/", "TokenEndpoint": "https://auth.xxxxxx.eu/application/o/token/", "ClientID": "xxxx", "ClientSecret": "", "GrantType": "client_credentials" }, "ExtraConfig": { "Password": "xxxx", "Username": "Netbird" } }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "Audience": "xxxxxx", "Domain": "", "ClientID": "xxxxxxx", "TokenEndpoint": "https://auth.xxxxxx.eu/application/o/token/", "DeviceAuthEndpoint": "https://auth.xxxxxx.eu/application/o/device/", "Scope": "openid", "UseIDToken": false } } } ``` cat setup.env ``` ## example file, you can copy this file to setup.env and update its values ## # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="netbird.xxxxx.eu" NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://auth.xxxxx.eu/application/o/netbird/.well-known/openid-configuration" NETBIRD_USE_AUTH0=false NETBIRD_AUTH_CLIENT_ID="xxx" NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api" NETBIRD_AUTH_AUDIENCE="xxxxxx" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="xxxxx" NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE="xxxxxx" NETBIRD_MGMT_IDP="authentik" NETBIRD_IDP_MGMT_CLIENT_ID="xxxxxxxx" NETBIRD_IDP_MGMT_CLIENT_SECRET="" NETBIRD_IDP_MGMT_EXTRA_USERNAME="Netbird" NETBIRD_IDP_MGMT_EXTRA_PASSWORD="xxxxxxx" # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=true NETBIRD_MGMT_API_PORT=443 NETBIRD_SIGNAL_PORT=433 # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=false # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted ```
saavagebueno commented 2025-11-20 05:10:48 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jul 22, 2023):

@bcmmbaga can you confirm if there isn't a missing an authentik login flow step for the device authoriation flow?

@David-Nahorniak can you share your authentik version for us to confirm?

@mlsmaycon commented on GitHub (Jul 22, 2023): @bcmmbaga can you confirm if there isn't a missing an authentik login flow step for the device authoriation flow? @David-Nahorniak can you share your authentik version for us to confirm?
saavagebueno commented 2025-11-20 05:10:48 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Jul 22, 2023):

@David-Nahorniak
It seems that the issue you're experiencing is due to the lack of a default device auth flow configured in authentik. To resolve this, you can follow these steps:

  • Go to the authentik admin interface
    -On the left menu, click on System and then select Tenants
  • If you haven't set a custom tenant, choose authentik-default and click the edit button
  • Scroll down toDefault flowsand update the Device code flow to use the default-authenticator-static-setup (default-authenticator-static-setup) flow
  • Click on Update, and then you can try the client login again with netbird.

Please let us know if this resolves the issue.

@bcmmbaga commented on GitHub (Jul 22, 2023): @David-Nahorniak It seems that the issue you're experiencing is due to the lack of a default device auth flow configured in authentik. To resolve this, you can follow these steps: - Go to the authentik admin interface -On the left menu, click on `System` and then select `Tenants` - If you haven't set a custom tenant, choose `authentik-default` and click the edit button - Scroll down to` Default flows `and update the `Device code flow` to use the `default-authenticator-static-setup (default-authenticator-static-setup)` flow - Click on `Update`, and then you can try the client login again with netbird. Please let us know if this resolves the issue.
saavagebueno commented 2025-11-20 05:10:48 -05:00
Author
Owner
Copy Link

@David-Nahorniak commented on GitHub (Jul 22, 2023):

Adding Device code flow helped. 🎉
Thank you @bcmmbaga for help. 😀

Authentik version is 2023.5.3 (latest)
Netbird version is v0.21.10 (latest)

@David-Nahorniak commented on GitHub (Jul 22, 2023): Adding `Device code flow` helped. 🎉 Thank you @bcmmbaga for help. 😀 Authentik version is 2023.5.3 (latest) Netbird version is v0.21.10 (latest)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#399
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?