SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Azure Auth failing - 404 on /auth after redirect back from Azure #623

New Issue
Closed
opened 2025-11-20 05:14:50 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:14:50 -05:00
Owner
Copy Link

Originally created by @karstennilsen on GitHub (Feb 11, 2024).

Describe the problem

Created a new setup and used the latest manual on the website: https://docs.netbird.io/selfhosted/identity-providers#azure-ad

The config I ended up with is:

## example file, you can copy this file to setup.env and update its values
##

# Image tags
# you can force specific tags for each component; will be set to latest if empty
NETBIRD_DASHBOARD_TAG=""
NETBIRD_SIGNAL_TAG=""
NETBIRD_MANAGEMENT_TAG=""
COTURN_TAG=""

# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="tunnel.xxxx.nl"

# TURN server domain. e.g. turn.mydomain.com
# if not specified it will assume NETBIRD_DOMAIN
NETBIRD_TURN_DOMAIN=""

# TURN server public IP address
# required for a connection involving peers in
# the same network as the server and external peers
# usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN
NETBIRD_TURN_EXTERNAL_IP=""

# -------------------------------------------
# OIDC
#  e.g., https://example.eu.auth0.com/.well-known/openid-configuration
# -------------------------------------------
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com/bca71bac-28f4-401d-b0c6-xxxxxxxxxxx/v2.0/.well-known/openid-configuration"
# The default setting is to transmit the audience to the IDP during authorization. However,
# if your IDP does not have this capability, you can turn this off by setting it to false.
#NETBIRD_DASH_AUTH_USE_AUDIENCE=false
NETBIRD_AUTH_AUDIENCE="ac72324a-c386-45d1-a738-6f0df47f696b"
# e.g. netbird-client
NETBIRD_AUTH_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b"
# indicates the scopes that will be requested to the IDP
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://ac72324a-c386-45d1-a738-6f0df47f696b/api"
# NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace.
# NETBIRD_AUTH_CLIENT_SECRET=""
# if you want to use a custom claim for the user ID instead of 'sub', set it here
NETBIRD_AUTH_USER_ID_CLAIM="oid"
# indicates whether to use Auth0 or not: true or false
NETBIRD_USE_AUTH0="false"
# if your IDP provider doesn't support fragmented URIs, configure custom
# redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain.
NETBIRD_AUTH_REDIRECT_URI="/auth"
NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"
# Updates the preference to use id tokens instead of access token on dashboard
# Okta and Gitlab IDPs can benefit from this
# NETBIRD_TOKEN_SOURCE="idToken"
# -------------------------------------------
# OIDC Device Authorization Flow
# -------------------------------------------
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b"
# Some IDPs requires different audience, scopes and to use id token for device authorization flow
# you can customize here:
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false
# -------------------------------------------
# OIDC PKCE Authorization Flow
# -------------------------------------------
# Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative
# eg. 53000,54000
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
# -------------------------------------------
# IDP Management
# -------------------------------------------
# eg. zitadel, auth0, azure, keycloak
NETBIRD_MGMT_IDP="azure"
# Some IDPs requires different client id and client secret for management api
NETBIRD_IDP_MGMT_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b"
NETBIRD_IDP_MGMT_CLIENT_SECRET="xxxx"
NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://graph.microsoft.com/v1.0"
NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="c55bbfe6-b61c-4287-8d8d-xxxxxxxxxx"

# Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird"
# NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT=
# With some IDPs may be needed enabling automatic refresh of signing keys on expire
# NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false
# NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice.
# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=false
# e.g. hello@mydomain.com
NETBIRD_LETSENCRYPT_EMAIL="xxxxx"
# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=false
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted

Like in the manual I run ./configure.sh and in the artifacts folder I bring docker compose up.
All containers start without any problem:

docker compose ps
NAME                     IMAGE                         COMMAND                  SERVICE      CREATED          STATUS          PORTS
artifacts-coturn-1       coturn/coturn:latest          "docker-entrypoint.s…"   coturn       36 minutes ago   Up 36 minutes
artifacts-dashboard-1    netbirdio/dashboard:latest    "/usr/bin/supervisor…"   dashboard    36 minutes ago   Up 36 minutes   0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp
artifacts-management-1   netbirdio/management:latest   "/go/bin/netbird-mgm…"   management   26 minutes ago   Up 26 minutes   0.0.0.0:33073->443/tcp, :::33073->443/tcp
artifacts-signal-1       netbirdio/signal:latest       "/go/bin/netbird-sig…"   signal       36 minutes ago   Up 36 minutes   0.0.0.0:10000->80/tcp, :::10000->80/tcp

After this I can navigate to the endpoint url and it redirects to Microsoft for authentication. After I authenticate it redirects back to /auth in my endpoint but it gives a 404 response.

image

After this all requests to Microsoft fail:
image

Expected behavior

After login Netbird uses the authentication information to authenticate the user.

Are you using NetBird Cloud?

No self-hosted

NetBird version

{
  "Id": "sha256:601694d507636b624155f3a72e14eec2e1d2b12b80cd84fbf5e95849a9977c9f",
  "Digest": null,
  "RepoDigests": [
    "netbirdio/management@sha256:ead72f552b9f3ec622db6a1c8b018dea20d95575b997af9cfb0bfd9196ec8877"
  ],
  "Labels": {
    "maintainer": "dev@netbird.io",
    "org.opencontainers.image.created": "2024-02-07T15:17:49Z",
    "org.opencontainers.image.ref.name": "ubuntu",
    "org.opencontainers.image.revision": "a7547b999001536902d70c226384b505be12431d",
    "org.opencontainers.image.title": "netbird",
    "org.opencontainers.image.version": "0.25.7"
  }
}

NetBird status -d output:

No client app yet involved

Originally created by @karstennilsen on GitHub (Feb 11, 2024). **Describe the problem** Created a new setup and used the latest manual on the website: https://docs.netbird.io/selfhosted/identity-providers#azure-ad The config I ended up with is: ``` ## example file, you can copy this file to setup.env and update its values ## # Image tags # you can force specific tags for each component; will be set to latest if empty NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="tunnel.xxxx.nl" # TURN server domain. e.g. turn.mydomain.com # if not specified it will assume NETBIRD_DOMAIN NETBIRD_TURN_DOMAIN="" # TURN server public IP address # required for a connection involving peers in # the same network as the server and external peers # usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN NETBIRD_TURN_EXTERNAL_IP="" # ------------------------------------------- # OIDC # e.g., https://example.eu.auth0.com/.well-known/openid-configuration # ------------------------------------------- NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://login.microsoftonline.com/bca71bac-28f4-401d-b0c6-xxxxxxxxxxx/v2.0/.well-known/openid-configuration" # The default setting is to transmit the audience to the IDP during authorization. However, # if your IDP does not have this capability, you can turn this off by setting it to false. #NETBIRD_DASH_AUTH_USE_AUDIENCE=false NETBIRD_AUTH_AUDIENCE="ac72324a-c386-45d1-a738-6f0df47f696b" # e.g. netbird-client NETBIRD_AUTH_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b" # indicates the scopes that will be requested to the IDP NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api://ac72324a-c386-45d1-a738-6f0df47f696b/api" # NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace. # NETBIRD_AUTH_CLIENT_SECRET="" # if you want to use a custom claim for the user ID instead of 'sub', set it here NETBIRD_AUTH_USER_ID_CLAIM="oid" # indicates whether to use Auth0 or not: true or false NETBIRD_USE_AUTH0="false" # if your IDP provider doesn't support fragmented URIs, configure custom # redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain. NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" # Updates the preference to use id tokens instead of access token on dashboard # Okta and Gitlab IDPs can benefit from this # NETBIRD_TOKEN_SOURCE="idToken" # ------------------------------------------- # OIDC Device Authorization Flow # ------------------------------------------- NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b" # Some IDPs requires different audience, scopes and to use id token for device authorization flow # you can customize here: NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false # ------------------------------------------- # OIDC PKCE Authorization Flow # ------------------------------------------- # Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative # eg. 53000,54000 NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" # ------------------------------------------- # IDP Management # ------------------------------------------- # eg. zitadel, auth0, azure, keycloak NETBIRD_MGMT_IDP="azure" # Some IDPs requires different client id and client secret for management api NETBIRD_IDP_MGMT_CLIENT_ID="ac72324a-c386-45d1-a738-6f0df47f696b" NETBIRD_IDP_MGMT_CLIENT_SECRET="xxxx" NETBIRD_IDP_MGMT_EXTRA_GRAPH_API_ENDPOINT="https://graph.microsoft.com/v1.0" NETBIRD_IDP_MGMT_EXTRA_OBJECT_ID="c55bbfe6-b61c-4287-8d8d-xxxxxxxxxx" # Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird" # NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT= # With some IDPs may be needed enabling automatic refresh of signing keys on expire # NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false # NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice. # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=false # e.g. hello@mydomain.com NETBIRD_LETSENCRYPT_EMAIL="xxxxx" # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=false # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted ```` Like in the manual I run `./configure.sh` and in the artifacts folder I bring docker compose up. All containers start without any problem: ``` docker compose ps NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS artifacts-coturn-1 coturn/coturn:latest "docker-entrypoint.s…" coturn 36 minutes ago Up 36 minutes artifacts-dashboard-1 netbirdio/dashboard:latest "/usr/bin/supervisor…" dashboard 36 minutes ago Up 36 minutes 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp artifacts-management-1 netbirdio/management:latest "/go/bin/netbird-mgm…" management 26 minutes ago Up 26 minutes 0.0.0.0:33073->443/tcp, :::33073->443/tcp artifacts-signal-1 netbirdio/signal:latest "/go/bin/netbird-sig…" signal 36 minutes ago Up 36 minutes 0.0.0.0:10000->80/tcp, :::10000->80/tcp ```` After this I can navigate to the endpoint url and it redirects to Microsoft for authentication. After I authenticate it redirects back to /auth in my endpoint but it gives a 404 response. ![image](https://github.com/netbirdio/netbird/assets/8917480/a56be827-b9af-4804-bb6f-c89d4b3386ed) After this all requests to Microsoft fail: ![image](https://github.com/netbirdio/netbird/assets/8917480/f29a7430-4795-4f0d-9120-f588857ab2c4) **Expected behavior** After login Netbird uses the authentication information to authenticate the user. **Are you using NetBird Cloud?** No self-hosted **NetBird version** ``` { "Id": "sha256:601694d507636b624155f3a72e14eec2e1d2b12b80cd84fbf5e95849a9977c9f", "Digest": null, "RepoDigests": [ "netbirdio/management@sha256:ead72f552b9f3ec622db6a1c8b018dea20d95575b997af9cfb0bfd9196ec8877" ], "Labels": { "maintainer": "dev@netbird.io", "org.opencontainers.image.created": "2024-02-07T15:17:49Z", "org.opencontainers.image.ref.name": "ubuntu", "org.opencontainers.image.revision": "a7547b999001536902d70c226384b505be12431d", "org.opencontainers.image.title": "netbird", "org.opencontainers.image.version": "0.25.7" } } ``` **NetBird status -d output:** No client app yet involved
saavagebueno added the idpconfig-idpconfig-issuetriage labels 2025-11-20 05:14:50 -05:00
saavagebueno commented 2025-11-20 05:14:50 -05:00
Author
Owner
Copy Link

@JPT62089 commented on GitHub (Feb 20, 2024):

Also having this same issue. Fresh install from today.

@JPT62089 commented on GitHub (Feb 20, 2024): Also having this same issue. Fresh install from today.
saavagebueno commented 2025-11-20 05:14:51 -05:00
Author
Owner
Copy Link

@JPT62089 commented on GitHub (Feb 20, 2024):

Ok, I think I resolved my issue at least. I needed to set NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true in the setup.env. This seems to have resolved my issue instantly. We'll see if it continues to work tho :)

@JPT62089 commented on GitHub (Feb 20, 2024): Ok, I think I resolved my issue at least. I needed to set `NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true` in the setup.env. This seems to have resolved my issue instantly. We'll see if it continues to work tho :)
saavagebueno commented 2025-11-20 05:14:51 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 18, 2025):

@karstennilsen I believe this can be closed?

@nazarewk commented on GitHub (Apr 18, 2025): @karstennilsen I believe this can be closed?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label config-idp config-issue idp triage
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#623
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?