SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-22 05:53:39 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

AzureAD SSO setup: no SSO provider returned from management #450

New Issue
Closed
opened 2025-11-20 05:11:31 -05:00 by saavagebueno · 2 comments
saavagebueno commented 2025-11-20 05:11:31 -05:00
Owner
Copy Link

Originally created by @qdrop17 on GitHub (Sep 22, 2023).

We're trying to login to our self-hosted Netbird instance but get the following errors

Client (Fedora 38):

[qdrop@qdrop-fedora-pro9i ~]$ netbird login
2023-09-22T13:19:06+02:00 WARN client/cmd/root.go:187: retrying Login to the Management service in 1.156027938s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys

Server (Ubuntu 22.04):

2023-09-22T11:12:37Z WARN management/server/grpcserver.go:326: failed logging in peer WUpiVR7smx3DOgDShdM5Zc/P1GA3w4f0uoNANu4f9wg=

-> What's interesting: Logging in with the Windows Netbird client works flawlessly. Also the dashboard operates without issues.

We followed the documentation for AzureAD-SSO integration: https://docs.netbird.io/selfhosted/identity-providers#azure-ad

setup.env

## example file, you can copy this file to setup.env and update its values
##
# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="netbird-test.devinite.com"

# -------------------------------------------
# OIDC
#  e.g., https://example.eu.auth0.com/.well-known/openid-configuration
# -------------------------------------------
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com/xxx/v2.0/.well-known/openid-configuration"
NETBIRD_AUTH_AUDIENCE="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f"
# e.g. netbird-client
NETBIRD_AUTH_CLIENT_ID="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f"
# indicates the scopes that will be requested to the IDP
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://97ac46bc-2dea-4b74-a6b2-60f3255c9b8f/api"
# NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace.
# NETBIRD_AUTH_CLIENT_SECRET=""
# if you want to use a custom claim for the user ID instead of 'sub', set it here
NETBIRD_AUTH_USER_ID_CLAIM="oid"
# indicates whether to use Auth0 or not: true or false
NETBIRD_USE_AUTH0="false"
# if your IDP provider doesn't support fragmented URIs, configure custom
# redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain.
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
# Updates the preference to use id tokens instead of access token on dashboard
# Okta and Gitlab IDPs can benefit from this
# NETBIRD_TOKEN_SOURCE="idToken"
# -------------------------------------------
# OIDC Device Authorization Flow
# -------------------------------------------
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
#NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="none"
# Some IDPs requires different audience, scopes and to use id token for device authorization flow
# you can customize here:
#NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
#NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
#NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false
# -------------------------------------------
# OIDC PKCE Authorization Flow
# -------------------------------------------
# Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative
# eg. 53000,54000
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
# -------------------------------------------
# IDP Management
# -------------------------------------------
# eg. zitadel, auth0, azure, keycloak
NETBIRD_MGMT_IDP="azure"
# Some IDPs requires different client id and client secret for management api
NETBIRD_IDP_MGMT_CLIENT_ID="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f"
NETBIRD_IDP_MGMT_CLIENT_SECRET="xxx"
NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="c4dfb176-608d-4936-8ab1-9e541963f122"
NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://graph.microsoft.com/v1.0"
# NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice.
# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=false
# e.g. hello@mydomain.com
NETBIRD_LETSENCRYPT_EMAIL="xxx"
# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=false
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted

Expected behavior
We expect that we're getting at least some login URL to self-trigger the login flow inside the browser.

Any help is highly appreciated.

Originally created by @qdrop17 on GitHub (Sep 22, 2023). We're trying to login to our self-hosted Netbird instance but get the following errors Client (Fedora 38): ``` [qdrop@qdrop-fedora-pro9i ~]$ netbird login 2023-09-22T13:19:06+02:00 WARN client/cmd/root.go:187: retrying Login to the Management service in 1.156027938s due to error rpc error: code = Unknown desc = no SSO provider returned from management. Please proceed with setting up this device using setup keys https://docs.netbird.io/how-to/register-machines-using-setup-keys ``` Server (Ubuntu 22.04): ``` 2023-09-22T11:12:37Z WARN management/server/grpcserver.go:326: failed logging in peer WUpiVR7smx3DOgDShdM5Zc/P1GA3w4f0uoNANu4f9wg= ``` -> **What's interesting:** Logging in with the Windows Netbird client works flawlessly. Also the dashboard operates without issues. We followed the documentation for AzureAD-SSO integration: https://docs.netbird.io/selfhosted/identity-providers#azure-ad **setup.env** ``` ## example file, you can copy this file to setup.env and update its values ## # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="netbird-test.devinite.com" # ------------------------------------------- # OIDC # e.g., https://example.eu.auth0.com/.well-known/openid-configuration # ------------------------------------------- NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com/xxx/v2.0/.well-known/openid-configuration" NETBIRD_AUTH_AUDIENCE="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f" # e.g. netbird-client NETBIRD_AUTH_CLIENT_ID="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f" # indicates the scopes that will be requested to the IDP NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://97ac46bc-2dea-4b74-a6b2-60f3255c9b8f/api" # NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace. # NETBIRD_AUTH_CLIENT_SECRET="" # if you want to use a custom claim for the user ID instead of 'sub', set it here NETBIRD_AUTH_USER_ID_CLAIM="oid" # indicates whether to use Auth0 or not: true or false NETBIRD_USE_AUTH0="false" # if your IDP provider doesn't support fragmented URIs, configure custom # redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain. NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" # Updates the preference to use id tokens instead of access token on dashboard # Okta and Gitlab IDPs can benefit from this # NETBIRD_TOKEN_SOURCE="idToken" # ------------------------------------------- # OIDC Device Authorization Flow # ------------------------------------------- NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" #NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="none" # Some IDPs requires different audience, scopes and to use id token for device authorization flow # you can customize here: #NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE #NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" #NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false # ------------------------------------------- # OIDC PKCE Authorization Flow # ------------------------------------------- # Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative # eg. 53000,54000 NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" # ------------------------------------------- # IDP Management # ------------------------------------------- # eg. zitadel, auth0, azure, keycloak NETBIRD_MGMT_IDP="azure" # Some IDPs requires different client id and client secret for management api NETBIRD_IDP_MGMT_CLIENT_ID="97ac46bc-2dea-4b74-a6b2-60f3255c9b8f" NETBIRD_IDP_MGMT_CLIENT_SECRET="xxx" NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="c4dfb176-608d-4936-8ab1-9e541963f122" NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://graph.microsoft.com/v1.0" # NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice. # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=false # e.g. hello@mydomain.com NETBIRD_LETSENCRYPT_EMAIL="xxx" # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=false # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted ``` **Expected behavior** We expect that we're getting at least some login URL to self-trigger the login flow inside the browser. Any help is highly appreciated.
saavagebueno added the bugwaiting-feedbackidpconfig-idp labels 2025-11-20 05:11:31 -05:00
saavagebueno commented 2025-11-20 05:11:32 -05:00
Author
Owner
Copy Link

@pascal-fischer commented on GitHub (Sep 28, 2023):

Hi, which version of management and client are you running? We introduced PKCE with version 0.23.0 which had a bug that fallback for devices without a graphical interface (or the possibility to launch a browser) e.g. via ssh was not working. Please make sure you are running the newest version and please let me know if the issue persists

@pascal-fischer commented on GitHub (Sep 28, 2023): Hi, which version of management and client are you running? We introduced PKCE with version 0.23.0 which had a bug that fallback for devices without a graphical interface (or the possibility to launch a browser) e.g. via ssh was not working. Please make sure you are running the newest version and please let me know if the issue persists
saavagebueno commented 2025-11-20 05:11:32 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 17, 2025):

closing for lack of feedback

@nazarewk commented on GitHub (Apr 17, 2025): closing for lack of feedback
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label bug config-idp idp waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#450
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?