SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-11 09:52:11 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

failed to login after self-hosting netbird deployed with ip address #505

New Issue
Closed
opened 2025-11-20 05:12:39 -05:00 by saavagebueno · 4 comments
saavagebueno commented 2025-11-20 05:12:39 -05:00
Owner
Copy Link

Originally created by @UnknowViewer on GitHub (Nov 7, 2023).

Describe the problem

I deployed latest self-hosting Netbird in self-hosting mode, we have a public IP address but it's behind the firewall NAT, so I'm trying to install it with internal ip address and 80 port instead of domain name. I set NETBIRD_DOMAIN into 'use-ip' and installed successfully.

When I login the ip+port with init admin cred, it'll pending in seconds and return the error 'Login Error: User state: Unauthenticated'.

Checked in developer tools and notice that the POST request to 'http://addr/oauth/v2/token' was returned HTTP Code = 400 bad request error, version = HTTP/1.1, the resp body is:

{"error":"invalid_request","error_description":"code_challenge required"}
  • Request payload
grant_type=authorization_code&client_id=239527187013767172%40netbird&redirect_uri=http%3A%2F%2F{deleted_ip}%2Fnb-auth&code=Fv2xUQPGBsUFHdY7a8Yif5A6n13y0txtJXNQ-eaafSP_TQ
  • resp of .well-known/openid-configuration api request
{
  "issuer": "http://deleted_ip",
  "authorization_endpoint": "http://deleted_ip/oauth/v2/authorize",
  "token_endpoint": "http://deleted_ip/oauth/v2/token",
  "introspection_endpoint": "http://deleted_ip/oauth/v2/introspect",
  "userinfo_endpoint": "http://deleted_ip/oidc/v1/userinfo",
  "revocation_endpoint": "http://deleted_ip/oauth/v2/revoke",
  "end_session_endpoint": "http://deleted_ip/oidc/v1/end_session",
  "device_authorization_endpoint": "http://deleted_ip/oauth/v2/device_authorization",
  "jwks_uri": "http://deleted_ip/oauth/v2/keys",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "phone",
    "address",
    "offline_access"
  ],
  "response_types_supported": [
    "code",
    "id_token",
    "id_token token"
  ],
  "grant_types_supported": [
    "authorization_code",
    "implicit",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:jwt-bearer",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "request_object_signing_alg_values_supported": [
    "RS256"
  ],
  "token_endpoint_auth_methods_supported": [
    "none",
    "client_secret_basic",
    "client_secret_post",
    "private_key_jwt"
  ],
  "token_endpoint_auth_signing_alg_values_supported": [
    "RS256"
  ],
  "revocation_endpoint_auth_methods_supported": [
    "none",
    "client_secret_basic",
    "client_secret_post",
    "private_key_jwt"
  ],
  "revocation_endpoint_auth_signing_alg_values_supported": [
    "RS256"
  ],
  "introspection_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "private_key_jwt"
  ],
  "introspection_endpoint_auth_signing_alg_values_supported": [
    "RS256"
  ],
  "claims_supported": [
    "sub",
    "aud",
    "exp",
    "iat",
    "iss",
    "auth_time",
    "nonce",
    "acr",
    "amr",
    "c_hash",
    "at_hash",
    "act",
    "scopes",
    "client_id",
    "azp",
    "preferred_username",
    "name",
    "family_name",
    "given_name",
    "locale",
    "email",
    "email_verified",
    "phone_number",
    "phone_number_verified"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "ui_locales_supported": [
    "bg",
    "de",
    "en",
    "es",
    "fr",
    "it",
    "ja",
    "mk",
    "pl",
    "pt",
    "zh"
  ],
  "request_parameter_supported": true,
  "request_uri_parameter_supported": false
}

To Reproduce
Steps to reproduce the behavior:

  1. deploy self-hosting Netbird with IP address, instead of domain name
  2. visit in web site

Expected behavior
I should login to the Netbird dashboard after change the init password of admin account.

NetBird status -d output:
If applicable, add the output of the netbird status -d command

Screenshots

  • Error msg
    image

  • resp body
    image

Additional context

  • dashboard.env
# Endpoints
NETBIRD_MGMT_API_ENDPOINT=http://deleted_ip:80
NETBIRD_MGMT_GRPC_API_ENDPOINT=http://deleted_ip:80
# OIDC
AUTH_AUDIENCE=239527187013767172@netbird
AUTH_CLIENT_ID=239527187013767172@netbird
AUTH_AUTHORITY=http://deleted_ip:80
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES="openid profile email offline_access"
AUTH_REDIRECT_URI=/nb-auth
AUTH_SILENT_REDIRECT_URI=/nb-silent-auth
# SSL
NGINX_SSL_PORT=443
# Letsencrypt
LETSENCRYPT_DOMAIN=none
  • management.json
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:deleted_ip:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "0s",
        "Secret": "",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:deleted_ip:3478",
                "Username": "self",
                "Password": "SG+pSvzA6benRg4ISr3yMUa8al4mV2rohG0b4T82nKM"
            }
        ]
    },
    "Signal": {
        "Proto": "http",
        "URI": "deleted_ip:80",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "DfsnZOx7evaQewL/8ggZRY9CbEZCXuyqzfDQv1683vY=",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "239527187013767172@netbird",
        "AuthIssuer": "http://deleted_ip",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "http://deleted_ip/oauth/v2/keys",
        "OIDCConfigEndpoint": "http://deleted_ip/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": true
    },
    "IdpManagerConfig": {
        "ManagerType": "zitadel",
        "ClientConfig": {
            "Issuer": "http://deleted_ip:80",
            "TokenEndpoint": "http://deleted_ip:80/oauth/v2/token",
            "ClientID": "netbird-service-account",
            "ClientSecret": "FrJqRgyExhLnR5oBh3A2VAO1RtV3zWXXIfBGcX0nIZFja8M66YQXl54DZElgPKRm",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "ManagementEndpoint": "http://deleted_ip:80/management/v1"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": null,
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "239527189060587524@netbird",
            "ClientSecret": "",
            "Domain": "",
            "Audience": "239527189060587524@netbird",
            "TokenEndpoint": "http://deleted_ip/oauth/v2/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "http://deleted_ip/oauth/v2/authorize",
            "Scope": "openid profile email offline_access",
            "UseIDToken": false,
            "RedirectURLs": [
                "http://localhost:53000/",
                "http://localhost:54000/"
            ]
        }
    },
    "StoreConfig": {
        "Engine": ""
    }
}
Originally created by @UnknowViewer on GitHub (Nov 7, 2023). **Describe the problem** I deployed latest self-hosting Netbird in self-hosting mode, we have a public IP address but it's behind the firewall NAT, so I'm trying to install it with internal ip address and 80 port instead of domain name. I set `NETBIRD_DOMAIN` into 'use-ip' and installed successfully. When I login the ip+port with init admin cred, it'll pending in seconds and return the error **'Login Error: User state: Unauthenticated'**. Checked in developer tools and notice that the `POST` request to 'http://addr/oauth/v2/token' was returned HTTP Code = **400 bad request** error, version = HTTP/1.1, the resp body is: ```json {"error":"invalid_request","error_description":"code_challenge required"} ``` * Request payload ``` grant_type=authorization_code&client_id=239527187013767172%40netbird&redirect_uri=http%3A%2F%2F{deleted_ip}%2Fnb-auth&code=Fv2xUQPGBsUFHdY7a8Yif5A6n13y0txtJXNQ-eaafSP_TQ ``` * resp of `.well-known/openid-configuration` api request ```json { "issuer": "http://deleted_ip", "authorization_endpoint": "http://deleted_ip/oauth/v2/authorize", "token_endpoint": "http://deleted_ip/oauth/v2/token", "introspection_endpoint": "http://deleted_ip/oauth/v2/introspect", "userinfo_endpoint": "http://deleted_ip/oidc/v1/userinfo", "revocation_endpoint": "http://deleted_ip/oauth/v2/revoke", "end_session_endpoint": "http://deleted_ip/oidc/v1/end_session", "device_authorization_endpoint": "http://deleted_ip/oauth/v2/device_authorization", "jwks_uri": "http://deleted_ip/oauth/v2/keys", "scopes_supported": [ "openid", "profile", "email", "phone", "address", "offline_access" ], "response_types_supported": [ "code", "id_token", "id_token token" ], "grant_types_supported": [ "authorization_code", "implicit", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:ietf:params:oauth:grant-type:device_code" ], "subject_types_supported": [ "public" ], "id_token_signing_alg_values_supported": [ "RS256" ], "request_object_signing_alg_values_supported": [ "RS256" ], "token_endpoint_auth_methods_supported": [ "none", "client_secret_basic", "client_secret_post", "private_key_jwt" ], "token_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "revocation_endpoint_auth_methods_supported": [ "none", "client_secret_basic", "client_secret_post", "private_key_jwt" ], "revocation_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "introspection_endpoint_auth_methods_supported": [ "client_secret_basic", "private_key_jwt" ], "introspection_endpoint_auth_signing_alg_values_supported": [ "RS256" ], "claims_supported": [ "sub", "aud", "exp", "iat", "iss", "auth_time", "nonce", "acr", "amr", "c_hash", "at_hash", "act", "scopes", "client_id", "azp", "preferred_username", "name", "family_name", "given_name", "locale", "email", "email_verified", "phone_number", "phone_number_verified" ], "code_challenge_methods_supported": [ "S256" ], "ui_locales_supported": [ "bg", "de", "en", "es", "fr", "it", "ja", "mk", "pl", "pt", "zh" ], "request_parameter_supported": true, "request_uri_parameter_supported": false } ``` **To Reproduce** Steps to reproduce the behavior: 1. deploy self-hosting Netbird with IP address, instead of domain name 2. visit in web site **Expected behavior** I should login to the Netbird dashboard after change the init password of admin account. **NetBird status -d output:** If applicable, add the output of the `netbird status -d` command **Screenshots** * Error msg <img width="303" alt="image" src="https://github.com/netbirdio/netbird/assets/14183726/7cad161d-9489-44c8-939f-c284b38a2d53"> * resp body ![image](https://github.com/netbirdio/netbird/assets/14183726/e4be8d40-c703-49b5-b007-edc078cdb6a7) **Additional context** * dashboard.env ```ini # Endpoints NETBIRD_MGMT_API_ENDPOINT=http://deleted_ip:80 NETBIRD_MGMT_GRPC_API_ENDPOINT=http://deleted_ip:80 # OIDC AUTH_AUDIENCE=239527187013767172@netbird AUTH_CLIENT_ID=239527187013767172@netbird AUTH_AUTHORITY=http://deleted_ip:80 USE_AUTH0=false AUTH_SUPPORTED_SCOPES="openid profile email offline_access" AUTH_REDIRECT_URI=/nb-auth AUTH_SILENT_REDIRECT_URI=/nb-silent-auth # SSL NGINX_SSL_PORT=443 # Letsencrypt LETSENCRYPT_DOMAIN=none ``` * management.json ```json { "Stuns": [ { "Proto": "udp", "URI": "stun:deleted_ip:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "0s", "Secret": "", "Turns": [ { "Proto": "udp", "URI": "turn:deleted_ip:3478", "Username": "self", "Password": "SG+pSvzA6benRg4ISr3yMUa8al4mV2rohG0b4T82nKM" } ] }, "Signal": { "Proto": "http", "URI": "deleted_ip:80", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "DfsnZOx7evaQewL/8ggZRY9CbEZCXuyqzfDQv1683vY=", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "239527187013767172@netbird", "AuthIssuer": "http://deleted_ip", "AuthUserIDClaim": "", "AuthKeysLocation": "http://deleted_ip/oauth/v2/keys", "OIDCConfigEndpoint": "http://deleted_ip/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": true }, "IdpManagerConfig": { "ManagerType": "zitadel", "ClientConfig": { "Issuer": "http://deleted_ip:80", "TokenEndpoint": "http://deleted_ip:80/oauth/v2/token", "ClientID": "netbird-service-account", "ClientSecret": "FrJqRgyExhLnR5oBh3A2VAO1RtV3zWXXIfBGcX0nIZFja8M66YQXl54DZElgPKRm", "GrantType": "client_credentials" }, "ExtraConfig": { "ManagementEndpoint": "http://deleted_ip:80/management/v1" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": null, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "239527189060587524@netbird", "ClientSecret": "", "Domain": "", "Audience": "239527189060587524@netbird", "TokenEndpoint": "http://deleted_ip/oauth/v2/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "http://deleted_ip/oauth/v2/authorize", "Scope": "openid profile email offline_access", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000/", "http://localhost:54000/" ] } }, "StoreConfig": { "Engine": "" } } ```
saavagebueno added the waiting-feedbackidpconfig-issue labels 2025-11-20 05:12:39 -05:00
saavagebueno commented 2025-11-20 05:12:40 -05:00
Author
Owner
Copy Link

@0FiRE0 commented on GitHub (Feb 21, 2024):

Same issue for the login.
Please note that the Console Login is working fine.
image

@0FiRE0 commented on GitHub (Feb 21, 2024): Same issue for the login. Please note that the Console Login is working fine. ![image](https://github.com/netbirdio/netbird/assets/19993814/938cc2db-21cb-4a03-9c51-5d3bd1d59d64)
saavagebueno commented 2025-11-20 05:12:40 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Feb 21, 2024):

Hello,

Due to a limitation with our oidc lib this is not possible. The only URL without an SSL certificate it accepts is http://localhost.

See issue at https://github.com/AxaFrance/oidc-client/issues/1028

@mlsmaycon commented on GitHub (Feb 21, 2024): Hello, Due to a limitation with our oidc lib this is not possible. The only URL without an SSL certificate it accepts is http://localhost. See issue at https://github.com/AxaFrance/oidc-client/issues/1028
saavagebueno commented 2025-11-20 05:12:40 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 18, 2025):

@UnknowViewer did you manage to resolve your issue?

@nazarewk commented on GitHub (Apr 18, 2025): @UnknowViewer did you manage to resolve your issue?
saavagebueno commented 2025-11-20 05:12:41 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jun 1, 2025):

closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.

@mlsmaycon commented on GitHub (Jun 1, 2025): closing issue due to no recent feedback. Feel free to open a new one if the issue persist or reopen if this was a feature request.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label config-issue idp waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#505
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?