SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-07-06 22:22:37 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Authentik SSO Login is not functioning #502

New Issue
Closed
opened 2025-11-20 05:12:36 -05:00 by saavagebueno · 13 comments
saavagebueno commented 2025-11-20 05:12:36 -05:00
Owner
Copy Link

Originally created by @ser on GitHub (Nov 6, 2023).

Setup of Authentik as SSO went well, I can login with SSO and see web management console as single user and I am able to add properly functioning peers with a setup key. But using SSO to add peers does not work correctly.

The URI which gives netbird client seems too short for Authentik:

https://sso.example.com/device?code=5536144

I suppose netbird management server misses some part?

Netbird with Keycloak in the same installation was functioning correctly.
I am using reverse proxy in front of netbird.

netbird docker: latest.
client: 0.24.2

Originally created by @ser on GitHub (Nov 6, 2023). Setup of Authentik as SSO went well, I can login with SSO and see web management console as single user and I am able to add properly functioning peers with a setup key. But using SSO to add peers does not work correctly. The URI which gives netbird client seems too short for Authentik: `https://sso.example.com/device?code=5536144` I suppose netbird management server misses some part? Netbird with Keycloak in the same installation was functioning correctly. I am using reverse proxy in front of netbird. netbird docker: latest. client: 0.24.2
saavagebueno commented 2025-11-20 05:12:37 -05:00
Author
Owner
Copy Link

@pappz commented on GitHub (Nov 7, 2023):

Dear @ser
Could you share with me the configuration file? Before you send it remove the secrets values, please.

@pappz commented on GitHub (Nov 7, 2023): Dear @ser Could you share with me the configuration file? Before you send it remove the secrets values, please.
saavagebueno commented 2025-11-20 05:12:37 -05:00
Author
Owner
Copy Link

@ser commented on GitHub (Nov 7, 2023):

If I strip all sensitive information from config file, all the rest will be exactly netbird's self deployment manual, visible on your website's docs.

@ser commented on GitHub (Nov 7, 2023): If I strip all sensitive information from config file, all the rest will be exactly netbird's self deployment manual, visible on your website's docs.
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@ser commented on GitHub (Nov 8, 2023):

I have just noticed that GUI client works correctly in the same setup with Authentik and gets correct URI to authorize a client. So it's only CLI client which fails. The working GUI client is 0.23.7 for MacOS.

@ser commented on GitHub (Nov 8, 2023): I have just noticed that GUI client works correctly in the same setup with Authentik and gets correct URI to authorize a client. So it's only CLI client which fails. The working GUI client is 0.23.7 for MacOS.
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@chrisguen commented on GitHub (Nov 8, 2023):

I have the same problem, the android app also gets the wrong url.

@chrisguen commented on GitHub (Nov 8, 2023): I have the same problem, the android app also gets the wrong url.
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Nov 9, 2023):

Hello @ser and @chrisguen , can you please share your authentik version and a screenshot of the error you are seeing in authentik?

@mlsmaycon commented on GitHub (Nov 9, 2023): Hello @ser and @chrisguen , can you please share your authentik version and a screenshot of the error you are seeing in authentik?
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@chrisguen commented on GitHub (Nov 9, 2023):

Authentik version 2023.10.2
We get no error, just a 404 in the browser.
Authentic server Logs:
INF auth_via=unauthenticated event=/application/o/device/ host=auth.x.de logger=authentik.asgi method=POST pid=52316 remote=77.22.xx request_id=7f7ac0790269434aaa3cd6b8 runtime=77 scheme=https status=200 timestamp=2023-11-09T19:37:10.203920 user= user_agent=Go-http-client/2.0 INF auth_via=session event=Tenant has no device code flow configured host=auth.x.de logger=authentik.providers.oauth2.views.device_init pid=52316 request_id=1544d541fd134af4ba0f2de tenant=<Tenant: Default tenant> timestamp=2023-11-09T19:37:10.856303 INF auth_via=session event=/device?code=258839184 host=auth.x.de logger=authentik.asgi method=GET pid=52316 remote=77.22. request_id=1544d541fd134af4ba0f2dedc runtime=36 scheme=https status=404 timestamp=2023-11-09T19:37:10.858569 user=Chriss user_agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36

@chrisguen commented on GitHub (Nov 9, 2023): Authentik version 2023.10.2 We get no error, just a 404 in the browser. Authentic server Logs: `INF auth_via=unauthenticated event=/application/o/device/ host=auth.x.de logger=authentik.asgi method=POST pid=52316 remote=77.22.xx request_id=7f7ac0790269434aaa3cd6b8 runtime=77 scheme=https status=200 timestamp=2023-11-09T19:37:10.203920 user= user_agent=Go-http-client/2.0 INF auth_via=session event=Tenant has no device code flow configured host=auth.x.de logger=authentik.providers.oauth2.views.device_init pid=52316 request_id=1544d541fd134af4ba0f2de tenant=<Tenant: Default tenant> timestamp=2023-11-09T19:37:10.856303 INF auth_via=session event=/device?code=258839184 host=auth.x.de logger=authentik.asgi method=GET pid=52316 remote=77.22. request_id=1544d541fd134af4ba0f2dedc runtime=36 scheme=https status=404 timestamp=2023-11-09T19:37:10.858569 user=Chriss user_agent=Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@tjsims1 commented on GitHub (Nov 9, 2023):

So it looks like your tenant in authentik doesn't have a device code flow associated with it.
here is what i followed to set it up https://github.com/goauthentik/authentik/issues/5133#issuecomment-1591908792
@chrisguen

@tjsims1 commented on GitHub (Nov 9, 2023): So it looks like your tenant in authentik doesn't have a device code flow associated with it. here is what i followed to set it up https://github.com/goauthentik/authentik/issues/5133#issuecomment-1591908792 @chrisguen
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@ser commented on GitHub (Nov 10, 2023):

@tjsims1 it solved all my issues, dear netbird please add this to the documentation.

@ser commented on GitHub (Nov 10, 2023): @tjsims1 it solved all my issues, dear netbird please add this to the documentation.
saavagebueno commented 2025-11-20 05:12:38 -05:00
Author
Owner
Copy Link

@excaliburzarau commented on GitHub (Sep 1, 2024):

Hello guys,

I am currently having this issue which seems to be as described above.

I have defined the tenant as stated on suggestions above.
When adding the peer (Android Phone), it does add the peer, it redirects and reports that the device is now connect, but it appears as offline.

2024-09-01T11:12:58Z WARN [context: GRPC, requestID: dfeb6633f59, accountID: UNKNOWN, peerID: dfgfggdfg=] management/server/grpcserver.go:421: failed logging in peer dfgfggdfg=: no peer auth method provided, please use a setup key or interactive SSO login
netbird-axcz_management.0.ppa7fo29wbvz@vm1s | 2024-09-01T11:12:59Z INFO management/server/peer.go:636: Peer needs login

While on the Self hosted server displays the error above.
When i try to connect gets stuck on connecting.

Do any of you guys have an idea of what could be missing?

Thank you all in advance.

@excaliburzarau commented on GitHub (Sep 1, 2024): Hello guys, I am currently having this issue which seems to be as described above. I have defined the tenant as stated on suggestions above. When adding the peer (Android Phone), it does add the peer, it redirects and reports that the device is now connect, but it appears as offline. 2024-09-01T11:12:58Z WARN [context: GRPC, requestID: dfeb6633f59, accountID: UNKNOWN, peerID: dfgfggdfg=] management/server/grpcserver.go:421: failed logging in peer dfgfggdfg=: no peer auth method provided, please use a setup key or interactive SSO login netbird-axcz_management.0.ppa7fo29wbvz@vm1s | 2024-09-01T11:12:59Z INFO management/server/peer.go:636: Peer needs login While on the Self hosted server displays the error above. When i try to connect gets stuck on connecting. Do any of you guys have an idea of what could be missing? Thank you all in advance.
saavagebueno commented 2025-11-20 05:12:39 -05:00
Author
Owner
Copy Link

@archibaldodlc commented on GitHub (Sep 21, 2024):

Hi, I setup a self hosted Netbird, Authentik and Traefik and when I tried to login with Authentik in Windows 11 I got :

failed logging in peer xxxxxx no peer auth method provided, please use a setup key or interactive SSO login

So I tried with a docker compose in another machine to see if I can connect and I got

2024-09-21T09:34:12Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080
2024-09-21T09:34:12Z INFO relay/client/picker.go:66: try to connecting to relay server: rel://netbird.domain.tld:33080
2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:165: create new relay connection: local peerID: 6lqfeXxUzq+HBl+/7Hbe0+T5Gu+tpS91PRyJ+sXh8BQ=, local peer hashedID: sha-Zu9YLL61iBcQ8t4xffpJZxE29HloNA8j818askRFgpA=
2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:171: connecting to relay server
2024-09-21T09:34:42Z ERRO client/internal/connect.go:254: failed to connect to any relay server: context deadline exceeded
2024-09-21T09:34:49Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080

Checking the management.json, I see that a Relay it was configured. But I never setup a Relay, the following variables were empty in setup.env

NETBIRD_RELAY_DOMAIN=""
NETBIRD_RELAY_PORT=""

even with that, in my management.json I got a Relay configured:

"Relay": {
    "Addresses": [
      "rel://netbird.domain.tldl:33080"
    ],
    "CredentialsTTL": "24h",
    "Secret": "kIq2ML3JQKtBIteO0M8DQ3H+RnD9aUDUt6ZNshYrOWQ"
  },

After removing the above lines from management.json, the issue was resolved.

Hope it helps.

@archibaldodlc commented on GitHub (Sep 21, 2024): Hi, I setup a self hosted Netbird, Authentik and Traefik and when I tried to login with Authentik in Windows 11 I got : ``` failed logging in peer xxxxxx no peer auth method provided, please use a setup key or interactive SSO login ``` So I tried with a docker compose in another machine to see if I can connect and I got ``` 2024-09-21T09:34:12Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080 2024-09-21T09:34:12Z INFO relay/client/picker.go:66: try to connecting to relay server: rel://netbird.domain.tld:33080 2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:165: create new relay connection: local peerID: 6lqfeXxUzq+HBl+/7Hbe0+T5Gu+tpS91PRyJ+sXh8BQ=, local peer hashedID: sha-Zu9YLL61iBcQ8t4xffpJZxE29HloNA8j818askRFgpA= 2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:171: connecting to relay server 2024-09-21T09:34:42Z ERRO client/internal/connect.go:254: failed to connect to any relay server: context deadline exceeded 2024-09-21T09:34:49Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080 ``` Checking the management.json, I see that a Relay it was configured. But I never setup a Relay, the following variables were empty in setup.env NETBIRD_RELAY_DOMAIN="" NETBIRD_RELAY_PORT="" even with that, in my management.json I got a Relay configured: ``` "Relay": { "Addresses": [ "rel://netbird.domain.tldl:33080" ], "CredentialsTTL": "24h", "Secret": "kIq2ML3JQKtBIteO0M8DQ3H+RnD9aUDUt6ZNshYrOWQ" }, ``` After removing the above lines from management.json, the issue was resolved. Hope it helps.
saavagebueno commented 2025-11-20 05:12:39 -05:00
Author
Owner
Copy Link

@excaliburzarau commented on GitHub (Sep 21, 2024):

Hi, I setup a self hosted Netbird, Authentik and Traefik and when I tried to login with Authentik in Windows 11 I got :

failed logging in peer xxxxxx no peer auth method provided, please use a setup key or interactive SSO login

So I tried with a docker compose in another machine to see if I can connect and I got

2024-09-21T09:34:12Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080
2024-09-21T09:34:12Z INFO relay/client/picker.go:66: try to connecting to relay server: rel://netbird.domain.tld:33080
2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:165: create new relay connection: local peerID: 6lqfeXxUzq+HBl+/7Hbe0+T5Gu+tpS91PRyJ+sXh8BQ=, local peer hashedID: sha-Zu9YLL61iBcQ8t4xffpJZxE29HloNA8j818askRFgpA=
2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:171: connecting to relay server
2024-09-21T09:34:42Z ERRO client/internal/connect.go:254: failed to connect to any relay server: context deadline exceeded
2024-09-21T09:34:49Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080

Checking the management.json, I see that a Relay it was configured. But I never setup a Relay, the following variables were empty in setup.env

NETBIRD_RELAY_DOMAIN="" NETBIRD_RELAY_PORT=""

even with that, in my management.json I got a Relay configured:

"Relay": {
    "Addresses": [
      "rel://netbird.domain.tldl:33080"
    ],
    "CredentialsTTL": "24h",
    "Secret": "kIq2ML3JQKtBIteO0M8DQ3H+RnD9aUDUt6ZNshYrOWQ"
  },

After removing the above lines from management.json, the issue was resolved.

Hope it helps.

Hey,

Thank you for the pointer, i do have the issue of no peer auth method provided, please use a setup key or interactive SSO login but in my case when i go on the management.json file i don t have those lines. Unfortunatelly it is something i am still unable to fix. I alrady opened a thread but at least for now, no reply. #2515

Even though this did not help me in particular, thank you.

Best Regards

@excaliburzarau commented on GitHub (Sep 21, 2024): > Hi, I setup a self hosted Netbird, Authentik and Traefik and when I tried to login with Authentik in Windows 11 I got : > > ``` > failed logging in peer xxxxxx no peer auth method provided, please use a setup key or interactive SSO login > ``` > > So I tried with a docker compose in another machine to see if I can connect and I got > > ``` > 2024-09-21T09:34:12Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080 > 2024-09-21T09:34:12Z INFO relay/client/picker.go:66: try to connecting to relay server: rel://netbird.domain.tld:33080 > 2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:165: create new relay connection: local peerID: 6lqfeXxUzq+HBl+/7Hbe0+T5Gu+tpS91PRyJ+sXh8BQ=, local peer hashedID: sha-Zu9YLL61iBcQ8t4xffpJZxE29HloNA8j818askRFgpA= > 2024-09-21T09:34:12Z INFO [relay: rel://netbird.domain.tld:33080] relay/client/client.go:171: connecting to relay server > 2024-09-21T09:34:42Z ERRO client/internal/connect.go:254: failed to connect to any relay server: context deadline exceeded > 2024-09-21T09:34:49Z INFO client/internal/connect.go:252: connecting to the Relay service(s): rel://netbird.domain.tld:33080 > ``` > > Checking the management.json, I see that a Relay it was configured. But I never setup a Relay, the following variables were empty in setup.env > > NETBIRD_RELAY_DOMAIN="" NETBIRD_RELAY_PORT="" > > even with that, in my management.json I got a Relay configured: > > ``` > "Relay": { > "Addresses": [ > "rel://netbird.domain.tldl:33080" > ], > "CredentialsTTL": "24h", > "Secret": "kIq2ML3JQKtBIteO0M8DQ3H+RnD9aUDUt6ZNshYrOWQ" > }, > ``` > > After removing the above lines from management.json, the issue was resolved. > > Hope it helps. Hey, Thank you for the pointer, i do have the issue of no peer auth method provided, please use a setup key or interactive SSO login but in my case when i go on the management.json file i don t have those lines. Unfortunatelly it is something i am still unable to fix. I alrady opened a thread but at least for now, no reply. [#2515](https://github.com/netbirdio/netbird/issues/2515) Even though this did not help me in particular, thank you. Best Regards
saavagebueno commented 2025-11-20 05:12:39 -05:00
Author
Owner
Copy Link

@nojeffrey commented on GitHub (Jan 30, 2025):

Double check relay port is open and listening(default 10000)

@nojeffrey commented on GitHub (Jan 30, 2025): Double check relay port is open and listening(default 10000)
saavagebueno commented 2025-11-20 05:12:39 -05:00
Author
Owner
Copy Link

@linx01 commented on GitHub (Feb 23, 2025):

I also meet this question.
"Setup of Authentik as SSO went well, I can login with SSO and see web management console as single user and I am able to add properly functioning peers with a setup key. But using SSO to add peers does not work correctly."
And I also configure the brand 's option "device-code-flow" with "default-device-code-flow".
When i add peers using SSO, the netbird client logs error

Image

@linx01 commented on GitHub (Feb 23, 2025): I also meet this question. "Setup of Authentik as SSO went well, I can login with SSO and see web management console as single user and I am able to add properly functioning peers with a setup key. But using SSO to add peers does not work correctly." And I also configure the brand 's option "device-code-flow" with "default-device-code-flow". When i add peers using SSO, the netbird client logs error ![Image](https://github.com/user-attachments/assets/8e919254-2779-447d-aeea-0c7b590fd671)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#502
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?