SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Unable to login any client without a setup-key (android, macos) #677

New Issue
Closed
opened 2025-11-20 05:15:51 -05:00 by saavagebueno · 23 comments
saavagebueno commented 2025-11-20 05:15:51 -05:00
Owner
Copy Link

Originally created by @Autopilot9369 on GitHub (Mar 4, 2024).

Describe the problem

A clear and concise description of what the problem is.

Notes:
Netbird domain: netbird.example.com
Zitadel domain: auth.example.com

I am able to log into the netbird admin, but I cannot register any peer who is not using a setup-key - macos, android. Everytime I try to register a peer, the see the following errors - netbird-android. Similar error on macos login via browser.

Also, I am trying to login using the admin account.

on the server, I only see the following logs (docker):

netbird-management  | 2024-03-04T04:58:59Z DEBG management/server/grpcserver.go:324: Login request from peer [7+gqegJg0AQxbWeAx56n8nQ3MA1ZrCbW180+9vAzBSw=] [xx.xx.xx.xx] (IP of the client)

netbird-management  | 2024-03-04T04:58:59Z WARN management/server/grpcserver.go:363: failed logging in peer 7+gqegJg0AQxbWeAx56n8nQ3MA1ZrCbW180+9vAzBSw=

To Reproduce

Steps to reproduce the behavior:

  1. Click on Connect on android/macos UI.
  2. You get redirected to zitadel for auth, enter username, password and 2fa code.
  3. you get redirected back to netbird /auth?code=
  4. See error

Expected behavior

Peer is registered successfully.

Are you using NetBird Cloud?

I am using self-hosted NetBird with selfhosted Zitadel.

NetBird version:

netbird version- 0.26.2

Screenshots

netbird-android

Configs

  1. Docker compose
---
version: "3"

services:
  # UI dashboard
  netbird-dashboard:
    image: netbirdio/dashboard:v2.1.2
    container_name: netbird-dashboard
    restart: unless-stopped
    env_file:
      - ./dashboard.env
    networks:
      - caddy_proxy

  # Signal
  netbird-signal:
    image: netbirdio/signal:0.26.2
    container_name: netbird-signal
    restart: unless-stopped
    user: "1002:1002"
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - /deploy/data/netbird/signal:/var/lib/netbird
#     command: ["--letsencrypt-domain", "$NETBIRD_LETSENCRYPT_DOMAIN", "--log-file", "console"]
    networks:
      - caddy_proxy

  # Management
  netbird-management:
    image: netbirdio/management:0.26.2
    container_name: netbird-management
    restart: unless-stopped
    user: "1002:1002"
    depends_on:
      - netbird-dashboard
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - /deploy/data/netbird/management:/var/lib/netbird
      - ./management.json:/etc/netbird/management.json
    command: [
      "--port", "80",
      "--log-file", "console",
      "--log-level", "debug",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.example.com",
      "--dns-domain=net.netbird.example.com",
    ]
    networks:
      - caddy_proxy

  # Coturn
  netbird-coturn:
    image: coturn/coturn:4.6.2-alpine
    container_name: netbird-coturn
    restart: unless-stopped
    user: "1002:1002"
    domainname: netbird.example.com
    network_mode: host
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    command:
      - -c /etc/turnserver.conf

networks:
  caddy_proxy:
    external: true
  1. turnserver.conf (grep "^[^#;]" turnserver.conf)
listening-port=3478
tls-listening-port=5349
external-ip=<Public-IP>
min-port=49152
max-port=65535
fingerprint
lt-cred-mech
user=self:<password>
realm=wiretrustee.com
cert=/etc/coturn/certs/cert.pem
pkey=/etc/coturn/private/privkey.pem
log-file=stdout
no-software-attribute
pidfile="/var/tmp/turnserver.pid"
no-cli
  1. management.json
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:example.com:3478",
            "Username": "",
            "Password": null
        }
    ],
    "TURNConfig": {
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.example.com:3478",
                "Username": "self",
                "Password": "password"
            }
        ],
        "CredentialsTTL": "12h",
        "Secret": "secret",
        "TimeBasedCredentials": false
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.example.com:443",
        "Username": "",
        "Password": null
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
             "0.0.0.0/0"
        ]
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "db-key",
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "HttpConfig": {
        "Address": "0.0.0.0:443",
        "AuthIssuer": "https://auth.example.com",
        "AuthAudience": "client@netbird",
        "AuthKeysLocation": "https://auth.example.com/oauth/v2/keys",
        "AuthUserIDClaim": "",
        "CertFile": "",
        "CertKey": "",
        "IdpSignKeyRefreshEnabled": true,
        "OIDCConfigEndpoint": "https://auth.example.com/.well-known/openid-configuration"
    },
    "IdpManagerConfig": {
        "ManagerType": "zitadel",
        "ClientConfig": {
            "Issuer": "https://auth.example.com",
            "TokenEndpoint": "https://auth.example.com/oauth/v2/token",
            "ClientID": "netbird",
            "ClientSecret": "secret-key",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "ManagementEndpoint": "https://auth.example.com/management/v1"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
     },
    "DeviceAuthorizationFlow": {
        "Provider": "hosted",
        "ProviderConfig": {
          "Audience": "client@netbird",
          "AuthorizationEndpoint": "",
          "Domain": "",
          "ClientID": "client@netbird",
          "ClientSecret": "",
          "TokenEndpoint": "https://auth.example.com/oauth/v2/token",
          "DeviceAuthEndpoint": "https://auth.example.com/oauth/v2/device_authorization",
          "Scope": "openid",
          "UseIDToken": false,
          "RedirectURLs": null
         }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "Audience": "client@netbird",
            "ClientID": "client@netbird",
            "ClientSecret": "",
            "Domain": "",
            "AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize",
            "TokenEndpoint": "https://auth.example.com/oauth/v2/token",
            "Scope": "openid profile email offline_access api",
            "RedirectURLs": [
                "https://netbird.example.com/auth",
                "https://netbird.example.com/silent-auth"
            ],
            "UseIDToken": false
        }
    }
}
  1. dashboard.env
# Endpoints
NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:443
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:443

# OIDC
AUTH_AUDIENCE=client@netbird
AUTH_CLIENT_ID=client@netbird
AUTH_CLIENT_SECRET=
AUTH_AUTHORITY=https://auth.example.com
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
AUTH_REDIRECT_URI=/auth
AUTH_SILENT_REDIRECT_URI=/silent-auth
NETBIRD_TOKEN_SOURCE=accessToken

# SSL
NGINX_SSL_PORT=443

# Letsencrypt
LETSENCRYPT_DOMAIN=
LETSENCRYPT_EMAIL=
Originally created by @Autopilot9369 on GitHub (Mar 4, 2024). **Describe the problem** A clear and concise description of what the problem is. Notes: Netbird domain: `netbird.example.com` Zitadel domain: `auth.example.com` I am able to log into the netbird admin, but I cannot register any peer who is not using a setup-key - macos, android. Everytime I try to register a peer, the see the following errors - [netbird-android](https://github.com/netbirdio/netbird/assets/7915409/f7ec5b33-9a93-429a-b0e0-fbca96ebf048). Similar error on macos login via browser. Also, I am trying to login using the admin account. on the server, I only see the following logs (docker): ``` netbird-management | 2024-03-04T04:58:59Z DEBG management/server/grpcserver.go:324: Login request from peer [7+gqegJg0AQxbWeAx56n8nQ3MA1ZrCbW180+9vAzBSw=] [xx.xx.xx.xx] (IP of the client) netbird-management | 2024-03-04T04:58:59Z WARN management/server/grpcserver.go:363: failed logging in peer 7+gqegJg0AQxbWeAx56n8nQ3MA1ZrCbW180+9vAzBSw= ``` **To Reproduce** Steps to reproduce the behavior: 1. Click on `Connect` on android/macos UI. 2. You get redirected to zitadel for auth, enter username, password and 2fa code. 3. you get redirected back to netbird `/auth?code=` 4. See error **Expected behavior** Peer is registered successfully. **Are you using NetBird Cloud?** I am using self-hosted NetBird with selfhosted Zitadel. **NetBird version**: `netbird version`- 0.26.2 **Screenshots** [netbird-android](https://github.com/netbirdio/netbird/assets/7915409/f7ec5b33-9a93-429a-b0e0-fbca96ebf048) **Configs** 1. Docker compose ``` --- version: "3" services: # UI dashboard netbird-dashboard: image: netbirdio/dashboard:v2.1.2 container_name: netbird-dashboard restart: unless-stopped env_file: - ./dashboard.env networks: - caddy_proxy # Signal netbird-signal: image: netbirdio/signal:0.26.2 container_name: netbird-signal restart: unless-stopped user: "1002:1002" volumes: - /etc/passwd:/etc/passwd:ro - /deploy/data/netbird/signal:/var/lib/netbird # command: ["--letsencrypt-domain", "$NETBIRD_LETSENCRYPT_DOMAIN", "--log-file", "console"] networks: - caddy_proxy # Management netbird-management: image: netbirdio/management:0.26.2 container_name: netbird-management restart: unless-stopped user: "1002:1002" depends_on: - netbird-dashboard volumes: - /etc/passwd:/etc/passwd:ro - /deploy/data/netbird/management:/var/lib/netbird - ./management.json:/etc/netbird/management.json command: [ "--port", "80", "--log-file", "console", "--log-level", "debug", "--disable-anonymous-metrics=false", "--single-account-mode-domain=netbird.example.com", "--dns-domain=net.netbird.example.com", ] networks: - caddy_proxy # Coturn netbird-coturn: image: coturn/coturn:4.6.2-alpine container_name: netbird-coturn restart: unless-stopped user: "1002:1002" domainname: netbird.example.com network_mode: host volumes: - /etc/passwd:/etc/passwd:ro - ./turnserver.conf:/etc/turnserver.conf:ro # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro command: - -c /etc/turnserver.conf networks: caddy_proxy: external: true ``` 2. turnserver.conf (`grep "^[^#;]" turnserver.conf`) ``` listening-port=3478 tls-listening-port=5349 external-ip=<Public-IP> min-port=49152 max-port=65535 fingerprint lt-cred-mech user=self:<password> realm=wiretrustee.com cert=/etc/coturn/certs/cert.pem pkey=/etc/coturn/private/privkey.pem log-file=stdout no-software-attribute pidfile="/var/tmp/turnserver.pid" no-cli ``` 3. management.json ``` { "Stuns": [ { "Proto": "udp", "URI": "stun:example.com:3478", "Username": "", "Password": null } ], "TURNConfig": { "Turns": [ { "Proto": "udp", "URI": "turn:netbird.example.com:3478", "Username": "self", "Password": "password" } ], "CredentialsTTL": "12h", "Secret": "secret", "TimeBasedCredentials": false }, "Signal": { "Proto": "https", "URI": "netbird.example.com:443", "Username": "", "Password": null }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "db-key", "StoreConfig": { "Engine": "sqlite" }, "HttpConfig": { "Address": "0.0.0.0:443", "AuthIssuer": "https://auth.example.com", "AuthAudience": "client@netbird", "AuthKeysLocation": "https://auth.example.com/oauth/v2/keys", "AuthUserIDClaim": "", "CertFile": "", "CertKey": "", "IdpSignKeyRefreshEnabled": true, "OIDCConfigEndpoint": "https://auth.example.com/.well-known/openid-configuration" }, "IdpManagerConfig": { "ManagerType": "zitadel", "ClientConfig": { "Issuer": "https://auth.example.com", "TokenEndpoint": "https://auth.example.com/oauth/v2/token", "ClientID": "netbird", "ClientSecret": "secret-key", "GrantType": "client_credentials" }, "ExtraConfig": { "ManagementEndpoint": "https://auth.example.com/management/v1" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "Audience": "client@netbird", "AuthorizationEndpoint": "", "Domain": "", "ClientID": "client@netbird", "ClientSecret": "", "TokenEndpoint": "https://auth.example.com/oauth/v2/token", "DeviceAuthEndpoint": "https://auth.example.com/oauth/v2/device_authorization", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "client@netbird", "ClientID": "client@netbird", "ClientSecret": "", "Domain": "", "AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize", "TokenEndpoint": "https://auth.example.com/oauth/v2/token", "Scope": "openid profile email offline_access api", "RedirectURLs": [ "https://netbird.example.com/auth", "https://netbird.example.com/silent-auth" ], "UseIDToken": false } } } ``` 4. dashboard.env ``` # Endpoints NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com:443 NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com:443 # OIDC AUTH_AUDIENCE=client@netbird AUTH_CLIENT_ID=client@netbird AUTH_CLIENT_SECRET= AUTH_AUTHORITY=https://auth.example.com USE_AUTH0=false AUTH_SUPPORTED_SCOPES="openid profile email offline_access api" AUTH_REDIRECT_URI=/auth AUTH_SILENT_REDIRECT_URI=/silent-auth NETBIRD_TOKEN_SOURCE=accessToken # SSL NGINX_SSL_PORT=443 # Letsencrypt LETSENCRYPT_DOMAIN= LETSENCRYPT_EMAIL= ```
saavagebueno added the clientmanagement-serviceself-hosting labels 2025-11-20 05:15:51 -05:00
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

Adding to above, I have used the configs generated by configure.sh script of the 0.26.2 branch.

@Autopilot9369 commented on GitHub (Mar 4, 2024): Adding to above, I have used the configs generated by `configure.sh` script of the 0.26.2 branch.
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

Hello @subhamagr, what happens when you're redirected back to the dashboard after authentication? Is the client added to the dashboard, but the status is shown as offline?

@bcmmbaga commented on GitHub (Mar 4, 2024): Hello @subhamagr, what happens when you're redirected back to the dashboard after authentication? Is the client added to the dashboard, but the status is shown as offline?
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

The client/peer is not added after auth. it shows this screen netbird-android upon successful auth - I tried with both admin and non-admin user. Same behavior. If I use a setup-key on a linux/macos machine they work okay. but doesn't work with zitadel auth.

@Autopilot9369 commented on GitHub (Mar 4, 2024): The client/peer is not added after auth. it shows this screen [netbird-android](https://github.com/netbirdio/netbird/assets/7915409/f7ec5b33-9a93-429a-b0e0-fbca96ebf048) upon successful auth - I tried with both admin and non-admin user. Same behavior. If I use a setup-key on a linux/macos machine they work okay. but doesn't work with zitadel auth.
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

After more debugging.

The netbird-dashboard gave out this log on the /auth?code= route:

netbird-dashboard   | 172.30.0.2 - - [04/Mar/2024:10:36:51 +0000] "GET /auth?code=piFderuhdoUerXR6AiDhfcQGDAPeoc7dQh4h1YxDv8z6Fg&state=320fef1d24e3350f27a3126dd6cf80ec2ded16a321eb05a7 HTTP/1.1" 404 1664 "-" "Mozilla/5.0 (Windows NT 10.0; rv:122.0) Gecko/20100101 Firefox/122.0"

basically a HTTP 404 response.

also, my caddy reverse proxy config:

netbird.example.com {
    import "/etc/caddy/snippets/tls"
    import "/etc/caddy/snippets/app_log" netbird

    encode zstd gzip

    import "/etc/caddy/snippets/sec-headers"

    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80
    # Management
    reverse_proxy /api/* netbird-management:80
    reverse_proxy /management.ManagementService/* h2c://netbird-management:80
    # Dashboard
    reverse_proxy /* netbird-dashboard:80
}
@Autopilot9369 commented on GitHub (Mar 4, 2024): After more debugging. The `netbird-dashboard` gave out this log on the `/auth?code=` route: ``` netbird-dashboard | 172.30.0.2 - - [04/Mar/2024:10:36:51 +0000] "GET /auth?code=piFderuhdoUerXR6AiDhfcQGDAPeoc7dQh4h1YxDv8z6Fg&state=320fef1d24e3350f27a3126dd6cf80ec2ded16a321eb05a7 HTTP/1.1" 404 1664 "-" "Mozilla/5.0 (Windows NT 10.0; rv:122.0) Gecko/20100101 Firefox/122.0" ``` basically a HTTP 404 response. also, my caddy reverse proxy config: ``` netbird.example.com { import "/etc/caddy/snippets/tls" import "/etc/caddy/snippets/app_log" netbird encode zstd gzip import "/etc/caddy/snippets/sec-headers" # Signal reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80 # Management reverse_proxy /api/* netbird-management:80 reverse_proxy /management.ManagementService/* h2c://netbird-management:80 # Dashboard reverse_proxy /* netbird-dashboard:80 } ```
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

The client/peer is not added after auth. it shows this screen netbird-android upon successful auth - I tried with both admin and non-admin user. Same behavior. If I use a setup-key on a linux/macos machine they work okay. but doesn't work with zitadel auth.

Could you please try running this command on macOS and share the result?

sudo netbird up --management-url <your_management_url> --log-level debug -F

@bcmmbaga commented on GitHub (Mar 4, 2024): > The client/peer is not added after auth. it shows this screen [netbird-android](https://github.com/netbirdio/netbird/assets/7915409/f7ec5b33-9a93-429a-b0e0-fbca96ebf048) upon successful auth - I tried with both admin and non-admin user. Same behavior. If I use a setup-key on a linux/macos machine they work okay. but doesn't work with zitadel auth. Could you please try running this command on macOS and share the result? `sudo netbird up --management-url <your_management_url> --log-level debug -F`
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

After more debugging.

The netbird-dashboard gave out this log on the /auth?code= route:

netbird-dashboard   | 172.30.0.2 - - [04/Mar/2024:10:36:51 +0000] "GET /auth?code=piFderuhdoUerXR6AiDhfcQGDAPeoc7dQh4h1YxDv8z6Fg&state=320fef1d24e3350f27a3126dd6cf80ec2ded16a321eb05a7 HTTP/1.1" 404 1664 "-" "Mozilla/5.0 (Windows NT 10.0; rv:122.0) Gecko/20100101 Firefox/122.0"

basically a HTTP 404 response.

also, my caddy reverse proxy config:

netbird.example.com {
    import "/etc/caddy/snippets/tls"
    import "/etc/caddy/snippets/app_log" netbird

    encode zstd gzip

    import "/etc/caddy/snippets/sec-headers"

    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80
    # Management
    reverse_proxy /api/* netbird-management:80
    reverse_proxy /management.ManagementService/* h2c://netbird-management:80
    # Dashboard
    reverse_proxy /* netbird-dashboard:80
}

We have a get started script for running a self-hosted Netbird with Zitadel here, but in case you want to proceed with a manual setup, also consider checking the Caddy reverse proxy config we used in the script here.

@bcmmbaga commented on GitHub (Mar 4, 2024): > After more debugging. > > The `netbird-dashboard` gave out this log on the `/auth?code=` route: > > ``` > netbird-dashboard | 172.30.0.2 - - [04/Mar/2024:10:36:51 +0000] "GET /auth?code=piFderuhdoUerXR6AiDhfcQGDAPeoc7dQh4h1YxDv8z6Fg&state=320fef1d24e3350f27a3126dd6cf80ec2ded16a321eb05a7 HTTP/1.1" 404 1664 "-" "Mozilla/5.0 (Windows NT 10.0; rv:122.0) Gecko/20100101 Firefox/122.0" > ``` > > basically a HTTP 404 response. > > also, my caddy reverse proxy config: > > ``` > netbird.example.com { > import "/etc/caddy/snippets/tls" > import "/etc/caddy/snippets/app_log" netbird > > encode zstd gzip > > import "/etc/caddy/snippets/sec-headers" > > # Signal > reverse_proxy /signalexchange.SignalExchange/* h2c://netbird-signal:80 > # Management > reverse_proxy /api/* netbird-management:80 > reverse_proxy /management.ManagementService/* h2c://netbird-management:80 > # Dashboard > reverse_proxy /* netbird-dashboard:80 > } > ``` We have a get started script for running a self-hosted Netbird with Zitadel [here](https://docs.netbird.io/selfhosted/selfhosted-quickstart#quick-self-hosting-with-zitadel-id-p), but in case you want to proceed with a manual setup, also consider checking the Caddy reverse proxy config we used in the script [here](https://github.com/netbirdio/netbird/blob/17f5abc6537c79fb36f4afc7c74b7670108123be/infrastructure_files/getting-started-with-zitadel.sh#L495).
saavagebueno commented 2025-11-20 05:15:52 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

sudo netbird up --management-url https://netbird.example.com:443 --log-level debug -F

2024-03-04T16:20:25+05:30 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.example.com:443
2024-03-04T16:20:30+05:30 ERRO management/client/grpc.go:64: failed creating connection to Management Service context deadline exceeded
2024-03-04T16:20:30+05:30 ERRO client/internal/login.go:96: failed connecting to the Management service https://netbird.example.com:443 context deadline exceeded
2024-03-04T16:20:30+05:30 WARN client/cmd/root.go:204: retrying Login to the Management service in 523.31441ms due to error context deadline exceeded
2024-03-04T16:20:31+05:30 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.example.com:443
2024-03-04T16:20:32+05:30 DEBG client/internal/login.go:63: connected to the Management service https://netbird.example.com:443
2024-03-04T16:20:34+05:30 DEBG client/internal/login.go:72: peer registration required
2024-03-04T16:20:34+05:30 DEBG client/internal/pkce_auth.go:55: connecting to Management Service https://netbird.example.com:443
2024-03-04T16:20:34+05:30 DEBG client/internal/pkce_auth.go:61: connected to the Management service https://netbird.example.com:443
Please do the SSO login in your browser.
If your browser didn't open automatically, use this URL to log in:

https://auth.example.com/oauth/v2/authorize?audience=256637449055305731%40netbird&client_id=256637449055305731%40netbird&code_challenge=djKuPec59QynOazStfiFMiaC6-Hwe_UprxUtf5LHS1E&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fnetbird.example.com%2Fauth&response_type=code&scope=openid+profile+email+offline_access+api&state=479d240033ef9a669d09f20d365c43311ac03679154693f5

EDIT:

after the browser load, I see the same error : image

@Autopilot9369 commented on GitHub (Mar 4, 2024): ``` sudo netbird up --management-url https://netbird.example.com:443 --log-level debug -F 2024-03-04T16:20:25+05:30 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.example.com:443 2024-03-04T16:20:30+05:30 ERRO management/client/grpc.go:64: failed creating connection to Management Service context deadline exceeded 2024-03-04T16:20:30+05:30 ERRO client/internal/login.go:96: failed connecting to the Management service https://netbird.example.com:443 context deadline exceeded 2024-03-04T16:20:30+05:30 WARN client/cmd/root.go:204: retrying Login to the Management service in 523.31441ms due to error context deadline exceeded 2024-03-04T16:20:31+05:30 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.example.com:443 2024-03-04T16:20:32+05:30 DEBG client/internal/login.go:63: connected to the Management service https://netbird.example.com:443 2024-03-04T16:20:34+05:30 DEBG client/internal/login.go:72: peer registration required 2024-03-04T16:20:34+05:30 DEBG client/internal/pkce_auth.go:55: connecting to Management Service https://netbird.example.com:443 2024-03-04T16:20:34+05:30 DEBG client/internal/pkce_auth.go:61: connected to the Management service https://netbird.example.com:443 Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://auth.example.com/oauth/v2/authorize?audience=256637449055305731%40netbird&client_id=256637449055305731%40netbird&code_challenge=djKuPec59QynOazStfiFMiaC6-Hwe_UprxUtf5LHS1E&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fnetbird.example.com%2Fauth&response_type=code&scope=openid+profile+email+offline_access+api&state=479d240033ef9a669d09f20d365c43311ac03679154693f5 ``` EDIT: after the browser load, I see the same error : [image](https://github.com/netbirdio/netbird/assets/7915409/9da50fb8-2d2e-42a6-bd6c-c905d8e16def)
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

your getting started with zitadel script didn't work for me. I had manually setup zitadel and now I am trying to setup netbird with it. and I followed the above mentioned links to come up with the caddy config, and I am able to open netbird portal, with admin and non-admin users. but I am not able to register any peer. Could this be related to the HTTP 404 error on the dashboard?

@Autopilot9369 commented on GitHub (Mar 4, 2024): your getting started with zitadel script didn't work for me. I had manually setup zitadel and now I am trying to setup netbird with it. and I followed the above mentioned links to come up with the caddy config, and I am able to open netbird portal, with admin and non-admin users. but I am not able to register any peer. Could this be related to the HTTP 404 error on the dashboard?
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

your getting started with zitadel script didn't work for me. I had manually setup zitadel and now I am trying to setup netbird with it. and I followed the above mentioned links to come up with the caddy config, and I am able to open netbird portal, with admin and non-admin users. but I am not able to register any peer. Could this be related to the HTTP 404 error on the dashboard?

This is due to incorrect Caddy configuration. After running the command up and opening the browser for authentication, you should not be redirected back to the dashboard since the authentication flow was never initiated by the dashboard. Please check our Caddy configuration on how to configure it properly here.

@bcmmbaga commented on GitHub (Mar 4, 2024): > your getting started with zitadel script didn't work for me. I had manually setup zitadel and now I am trying to setup netbird with it. and I followed the above mentioned links to come up with the caddy config, and I am able to open netbird portal, with admin and non-admin users. but I am not able to register any peer. Could this be related to the HTTP 404 error on the dashboard? This is due to incorrect Caddy configuration. After running the command up and opening the browser for authentication, you should not be redirected back to the dashboard since the authentication flow was never initiated by the dashboard. Please check our Caddy configuration on how to configure it properly [here](https://github.com/netbirdio/netbird/blob/17f5abc6537c79fb36f4afc7c74b7670108123be/infrastructure_files/getting-started-with-zitadel.sh#L495).
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

yes, it doesn't. but it will redirect back to /auth endpoint as it is the redirect_uri. And then the dashboard will interact with the management API to add the peer. and then call back the client to process the connection. Right?

@Autopilot9369 commented on GitHub (Mar 4, 2024): yes, it doesn't. but it will redirect back to `/auth` endpoint as it is the redirect_uri. And then the dashboard will interact with the management API to add the peer. and then call back the client to process the connection. Right?
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

Yes, it will be directed to /auth, but this should not be handled by the dashboard. Instead, Zitadel should handle it and redirect to the caller, which in this case is the localhost server initiated when you run the netbird up command

Here are some of missing zitadel redirect in your caddy config:

# Zitadel
    reverse_proxy /zitadel.admin.v1.AdminService/* h2c://zitadel:8080
    reverse_proxy /admin/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.auth.v1.AuthService/* h2c://zitadel:8080
    reverse_proxy /auth/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.management.v1.ManagementService/* h2c://zitadel:8080
    reverse_proxy /management/v1/* h2c://zitadel:8080
    reverse_proxy /zitadel.system.v1.SystemService/* h2c://zitadel:8080
    reverse_proxy /system/v1/* h2c://zitadel:8080
    reverse_proxy /assets/v1/* h2c://zitadel:8080
    reverse_proxy /ui/* h2c://zitadel:8080

For more context please take a look at: 17f5abc653/infrastructure_files/getting-started-with-zitadel.sh (L551)

@bcmmbaga commented on GitHub (Mar 4, 2024): Yes, it will be directed to `/auth`, but this should not be handled by the dashboard. Instead, Zitadel should handle it and redirect to the caller, which in this case is the localhost server initiated when you run the `netbird up` command Here are some of missing zitadel redirect in your caddy config: ```sh # Zitadel reverse_proxy /zitadel.admin.v1.AdminService/* h2c://zitadel:8080 reverse_proxy /admin/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.auth.v1.AuthService/* h2c://zitadel:8080 reverse_proxy /auth/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.management.v1.ManagementService/* h2c://zitadel:8080 reverse_proxy /management/v1/* h2c://zitadel:8080 reverse_proxy /zitadel.system.v1.SystemService/* h2c://zitadel:8080 reverse_proxy /system/v1/* h2c://zitadel:8080 reverse_proxy /assets/v1/* h2c://zitadel:8080 reverse_proxy /ui/* h2c://zitadel:8080 ``` For more context please take a look at: https://github.com/netbirdio/netbird/blob/17f5abc6537c79fb36f4afc7c74b7670108123be/infrastructure_files/getting-started-with-zitadel.sh#L551
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

But there is not rule for /auth in your above config. Your config is to be used only when zitadel and netbird are served on the same domain. but in my case, both of them are on two different domains. Heres the guide that I followed to setup netbird with zitadel manually. https://docs.netbird.io/selfhosted/identity-providers#zitadel

here the docs says:

Fill in the form with the following values and click Continue
Redirect URIs: https://<domain>/auth and click +
Redirect URIs: https://<domain>/silent-auth and click +

where what should be the value of <domain> then - zitadel's or netbird's?

@Autopilot9369 commented on GitHub (Mar 4, 2024): But there is not rule for `/auth` in your above config. Your config is to be used only when zitadel and netbird are served on the same domain. but in my case, both of them are on two different domains. Heres the guide that I followed to setup netbird with zitadel manually. https://docs.netbird.io/selfhosted/identity-providers#zitadel here the docs says: ``` Fill in the form with the following values and click Continue Redirect URIs: https://<domain>/auth and click + Redirect URIs: https://<domain>/silent-auth and click + ``` where what should be the value of `<domain>` then - zitadel's or netbird's?
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

"PKCEAuthorizationFlow": {
"ProviderConfig": {
"Audience": "client@netbird",
"ClientID": "client@netbird",
"ClientSecret": "",
"Domain": "",
"AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize",
"TokenEndpoint": "https://auth.example.com/oauth/v2/token",
"Scope": "openid profile email offline_access api",
"RedirectURLs": [
"https://netbird.example.com/auth",
"https://netbird.example.com/silent-auth"
],
"UseIDToken": false
}
}

^ My redirect URIs configured in management.json

@Autopilot9369 commented on GitHub (Mar 4, 2024): > "PKCEAuthorizationFlow": { > "ProviderConfig": { > "Audience": "client@netbird", > "ClientID": "client@netbird", > "ClientSecret": "", > "Domain": "", > "AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize", > "TokenEndpoint": "https://auth.example.com/oauth/v2/token", > "Scope": "openid profile email offline_access api", > "RedirectURLs": [ > "https://netbird.example.com/auth", > "https://netbird.example.com/silent-auth" > ], > "UseIDToken": false > } > } ^ My redirect URIs configured in management.json
saavagebueno commented 2025-11-20 05:15:53 -05:00
Author
Owner
Copy Link

@bcmmbaga commented on GitHub (Mar 4, 2024):

"PKCEAuthorizationFlow": {
"ProviderConfig": {
"Audience": "client@netbird",
"ClientID": "client@netbird",
"ClientSecret": "",
"Domain": "",
"AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize",
"TokenEndpoint": "https://auth.example.com/oauth/v2/token",
"Scope": "openid profile email offline_access api",
"RedirectURLs": [
"https://netbird.example.com/auth",
"https://netbird.example.com/silent-auth"
],
"UseIDToken": false
}
}

^ My redirect URIs configured in management.json

Sorry, I overlooked that. Please ensure that the redirect URL is configured as http://localhost:53000

@bcmmbaga commented on GitHub (Mar 4, 2024): > > "PKCEAuthorizationFlow": { > > "ProviderConfig": { > > "Audience": "client@netbird", > > "ClientID": "client@netbird", > > "ClientSecret": "", > > "Domain": "", > > "AuthorizationEndpoint": "https://auth.example.com/oauth/v2/authorize", > > "TokenEndpoint": "https://auth.example.com/oauth/v2/token", > > "Scope": "openid profile email offline_access api", > > "RedirectURLs": [ > > "https://netbird.example.com/auth", > > "https://netbird.example.com/silent-auth" > > ], > > "UseIDToken": false > > } > > } > > ^ My redirect URIs configured in management.json Sorry, I overlooked that. Please ensure that the redirect URL is configured as `http://localhost:53000`
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

okay, I will try it right away. but http won't work in non dev mode. so how do we ensure http with non dev mode? also was I right to set the to be netbird's domain?

@Autopilot9369 commented on GitHub (Mar 4, 2024): okay, I will try it right away. but `http` won't work in non dev mode. so how do we ensure http with non dev mode? also was I right to set the <domain> to be netbird's domain?
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Mar 4, 2024):

@subhamagr please enable dev mode as this is for a localhost redirect, you can also create a dedicated application for the CLI login, where you can enable dev mode with these redirect URLs.

@mlsmaycon commented on GitHub (Mar 4, 2024): @subhamagr please enable dev mode as this is for a localhost redirect, you can also create a dedicated application for the CLI login, where you can enable dev mode with these redirect URLs.
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

Okay, after I updated zitadel with the above config, i see the following warning:

image

@Autopilot9369 commented on GitHub (Mar 4, 2024): Okay, after I updated zitadel with the above config, i see the following warning: [image](https://github.com/netbirdio/netbird/assets/7915409/3aede91a-7aa2-4a2b-be19-b2d7ac195088)
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Mar 4, 2024):

That's normal because of the dev-mode and http URLs

@mlsmaycon commented on GitHub (Mar 4, 2024): That's normal because of the dev-mode and http URLs
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

I skipped the dev mode part because the docs say the following:

This step is intended for setup running in development mode with no SSL

so it is a bit confusing..

@Autopilot9369 commented on GitHub (Mar 4, 2024): I skipped the dev mode part because the docs say the following: `This step is intended for setup running in development mode with no SSL` so it is a bit confusing..
saavagebueno commented 2025-11-20 05:15:54 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

also was I right to set the to be netbird's domain?

also, what about this?

@Autopilot9369 commented on GitHub (Mar 4, 2024): > also was I right to set the to be netbird's domain? also, what about this?
saavagebueno commented 2025-11-20 05:15:55 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Mar 4, 2024):

You should set the netbird's domain in Zitadel too, but not as part of PKCEAuthorizationFlow configuration.

@mlsmaycon commented on GitHub (Mar 4, 2024): You should set the netbird's domain in Zitadel too, but not as part of PKCEAuthorizationFlow configuration.
saavagebueno commented 2025-11-20 05:15:55 -05:00
Author
Owner
Copy Link

@Autopilot9369 commented on GitHub (Mar 4, 2024):

okay, it finally worked. I would request you to please update the docs to say that http://localhost:53000 redirect_uri is required for clients to log in. I thought that was required only for localhost deployments. Also, make a note that dev mode also be avoided by creating a separate application for CLI only. That would really help. I spent 2 days figuring out the issue, but failed.

Thanks, again!

@Autopilot9369 commented on GitHub (Mar 4, 2024): okay, it finally worked. I would request you to please update the docs to say that `http://localhost:53000` redirect_uri is required for clients to log in. I thought that was required only for localhost deployments. Also, make a note that dev mode also be avoided by creating a separate application for CLI only. That would really help. I spent 2 days figuring out the issue, but failed. Thanks, again!
saavagebueno commented 2025-11-20 05:15:55 -05:00
Author
Owner
Copy Link

@thefiredragon commented on GitHub (Mar 15, 2024):

Here I have a big question, when using on linux with gui and without gui I got different URLs using authentik as sso provider

netbird up --management-url https://netbird.domain.net:3307

Response form my linux notebook with gui (not using sudo):

Please do the SSO login in your browser. 
If your browser didn't open automatically, use this URL to log in:

https://auth.domain.net/application/o/authorize/?audience=8IABMCBpQErgUFGS5Wzjtwy9RMEWjRYUzKoyfQOj&client_id=8IABMCBpQErgUFGS5Wzjtwy9RMEWjRYUzKoyfQOj&code_challenge=5-0oO_ruu5yk7BCREL5y4SIy7MiWuuLCU3llOyRRXzM&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A53000&response_type=code&scope=openid+profile+email+offline_access+api&state=d6c7c7863a002e405fb85dc324153e61041ab47b4c6e832e

And its open automatically the browser.

output from linux without gui (server vm)

netbird up --management-url https://netbird.domain.net:33073 --log-level debug -F

2024-03-15T14:54:11+01:00 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.domain.net:33073
2024-03-15T14:54:12+01:00 DEBG client/internal/login.go:63: connected to the Management service https://netbird.domain.net:33073
2024-03-15T14:54:12+01:00 DEBG client/internal/login.go:72: peer registration required
2024-03-15T14:54:12+01:00 DEBG client/internal/device_auth.go:57: connecting to Management Service https://netbird.domain.net:33073
2024-03-15T14:54:12+01:00 DEBG client/internal/device_auth.go:63: connected to the Management service https://netbird.domain.net:33073
Please do the SSO login in your browser. 
If your browser didn't open automatically, use this URL to log in:

https://auth.domain.net/device?code=011478112 


Alternatively, you may want to use a setup key, see:

When I try to open this link: https://auth.domain.net/device?code=011478112 on my browser I'm getting 404 error page not found.

@thefiredragon commented on GitHub (Mar 15, 2024): Here I have a big question, when using on linux with gui and without gui I got different URLs using authentik as sso provider ``` netbird up --management-url https://netbird.domain.net:3307 ``` Response form my linux notebook with gui (not using sudo): ``` Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://auth.domain.net/application/o/authorize/?audience=8IABMCBpQErgUFGS5Wzjtwy9RMEWjRYUzKoyfQOj&client_id=8IABMCBpQErgUFGS5Wzjtwy9RMEWjRYUzKoyfQOj&code_challenge=5-0oO_ruu5yk7BCREL5y4SIy7MiWuuLCU3llOyRRXzM&code_challenge_method=S256&redirect_uri=http%3A%2F%2Flocalhost%3A53000&response_type=code&scope=openid+profile+email+offline_access+api&state=d6c7c7863a002e405fb85dc324153e61041ab47b4c6e832e ``` And its open automatically the browser. output from linux without gui (server vm) ``` netbird up --management-url https://netbird.domain.net:33073 --log-level debug -F 2024-03-15T14:54:11+01:00 DEBG client/internal/login.go:93: connecting to the Management service https://netbird.domain.net:33073 2024-03-15T14:54:12+01:00 DEBG client/internal/login.go:63: connected to the Management service https://netbird.domain.net:33073 2024-03-15T14:54:12+01:00 DEBG client/internal/login.go:72: peer registration required 2024-03-15T14:54:12+01:00 DEBG client/internal/device_auth.go:57: connecting to Management Service https://netbird.domain.net:33073 2024-03-15T14:54:12+01:00 DEBG client/internal/device_auth.go:63: connected to the Management service https://netbird.domain.net:33073 Please do the SSO login in your browser. If your browser didn't open automatically, use this URL to log in: https://auth.domain.net/device?code=011478112 Alternatively, you may want to use a setup key, see: ``` When I try to open this link: https://auth.domain.net/device?code=011478112 on my browser I'm getting 404 error page not found.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label client management-service self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#677
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?