SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-06-11 01:41:55 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Netbird can't reach Zitadel's oidc config #955

New Issue
Open
opened 2025-11-20 05:20:34 -05:00 by saavagebueno · 12 comments
saavagebueno commented 2025-11-20 05:20:34 -05:00
Owner
Copy Link

Originally created by @zackenbaron on GitHub (Jun 4, 2024).

Netbird can't reach Zitadel's oidc config

After install via the getting-started-with-zitadel.sh script, the only thing that isn't working is the management panel which can't access ZITADEL's oidc config via the url https://example.com/.well-known/openid-configuration

To Reproduce

Steps to reproduce the behavior:

  1. Go to https://docs.netbird.io/selfhosted/selfhosted-quickstart
  2. Follow the setup instructions showed on the site.

Expected behavior

Clean working install of Netbird in combination with ZITADEL using docker.

Are you using NetBird Cloud?

I'm using self-hosted Netbird on docker.

NetBird version

latest (current date: 4th June 2024)

NetBird status

Docker:

[root@nb netbird]# docker compose ps
WARN[0000] /root/netbird/docker-compose.yml: `version` is obsolete 
NAME                   IMAGE                             COMMAND                  SERVICE      CREATED          STATUS                          PORTS
netbird-caddy-1        caddy                             "caddy run --config …"   caddy        32 minutes ago   Up 32 minutes                   0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8080->8080/tcp, :::8080->8080/tcp, 443/udp, 2019/tcp
netbird-coturn-1       coturn/coturn                     "docker-entrypoint.s…"   coturn       30 minutes ago   Up 30 minutes                   
netbird-crdb-1         cockroachdb/cockroach:v22.2.2     "/cockroach/cockroac…"   crdb         32 minutes ago   Up 32 minutes (healthy)         8080/tcp, 26257/tcp
netbird-dashboard-1    netbirdio/dashboard:latest        "/usr/bin/supervisor…"   dashboard    30 minutes ago   Up 30 minutes                   80/tcp, 443/tcp
netbird-management-1   netbirdio/management:latest       "/go/bin/netbird-mgm…"   management   30 minutes ago   Restarting (1) 13 seconds ago   
netbird-signal-1       netbirdio/signal:latest           "/go/bin/netbird-sig…"   signal       30 minutes ago   Up 30 minutes                   
netbird-zitadel-1      ghcr.io/zitadel/zitadel:v2.31.3   "/app/zitadel start-…"   zitadel      32 minutes ago   Up 32 minutes

Docker logs of netbird-management-1:

[root@nb netbird]# docker logs netbird-management-1
2024-06-04T16:31:12Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://example.com/.well-known/openid-configuration
Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://example.com/.well-known/openid-configuration Get "https://example.com/.well-known/openid-configuration": dial tcp [::1]:443: connect: connection refused

Edit: I'm sorry if this is a duplicate. I haven't looked up in the issues yet.

Originally created by @zackenbaron on GitHub (Jun 4, 2024). **Netbird can't reach Zitadel's oidc config** After install via the getting-started-with-zitadel.sh script, the only thing that isn't working is the management panel which can't access ZITADEL's oidc config via the url https://example.com/.well-known/openid-configuration **To Reproduce** Steps to reproduce the behavior: 1. Go to https://docs.netbird.io/selfhosted/selfhosted-quickstart 2. Follow the setup instructions showed on the site. **Expected behavior** Clean working install of Netbird in combination with ZITADEL using docker. **Are you using NetBird Cloud?** I'm using self-hosted Netbird on docker. **NetBird version** `latest` (current date: 4th June 2024) **NetBird status** Docker: ```bash [root@nb netbird]# docker compose ps WARN[0000] /root/netbird/docker-compose.yml: `version` is obsolete NAME IMAGE COMMAND SERVICE CREATED STATUS PORTS netbird-caddy-1 caddy "caddy run --config …" caddy 32 minutes ago Up 32 minutes 0.0.0.0:80->80/tcp, :::80->80/tcp, 0.0.0.0:443->443/tcp, :::443->443/tcp, 0.0.0.0:8080->8080/tcp, :::8080->8080/tcp, 443/udp, 2019/tcp netbird-coturn-1 coturn/coturn "docker-entrypoint.s…" coturn 30 minutes ago Up 30 minutes netbird-crdb-1 cockroachdb/cockroach:v22.2.2 "/cockroach/cockroac…" crdb 32 minutes ago Up 32 minutes (healthy) 8080/tcp, 26257/tcp netbird-dashboard-1 netbirdio/dashboard:latest "/usr/bin/supervisor…" dashboard 30 minutes ago Up 30 minutes 80/tcp, 443/tcp netbird-management-1 netbirdio/management:latest "/go/bin/netbird-mgm…" management 30 minutes ago Restarting (1) 13 seconds ago netbird-signal-1 netbirdio/signal:latest "/go/bin/netbird-sig…" signal 30 minutes ago Up 30 minutes netbird-zitadel-1 ghcr.io/zitadel/zitadel:v2.31.3 "/app/zitadel start-…" zitadel 32 minutes ago Up 32 minutes ``` Docker logs of netbird-management-1: ```bash [root@nb netbird]# docker logs netbird-management-1 2024-06-04T16:31:12Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://example.com/.well-known/openid-configuration Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://example.com/.well-known/openid-configuration Get "https://example.com/.well-known/openid-configuration": dial tcp [::1]:443: connect: connection refused ``` Edit: I'm sorry if this is a duplicate. I haven't looked up in the issues yet.
saavagebueno added the waiting-feedbacktriage-needed labels 2025-11-20 05:20:34 -05:00
saavagebueno commented 2025-11-20 05:20:34 -05:00
Author
Owner
Copy Link

@ChristianLavigne commented on GitHub (Jun 17, 2024):

Same here, new install on new linode VM:

2024-06-17T03:24:39Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://myvalidurl.net/.well-known/openid-configuration
Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://myvalidurl.net/.well-known/openid-configuration Get "https://myvalidurl.net/.well-known/openid-configuration": dial tcp [valid resolved ip address]:443: i/o timeout

  • I have full access to the Zitadel console.
  • openid-configuration is publicly available.
  • when trying to access netbird: https://myvalidurl.net/peers just spins
  • ssl certificate is valid
@ChristianLavigne commented on GitHub (Jun 17, 2024): Same here, new install on new linode VM: 2024-06-17T03:24:39Z INFO management/cmd/management.go:455: loading OIDC configuration from the provided IDP configuration endpoint https://myvalidurl.net/.well-known/openid-configuration Error: failed reading provided config file: /etc/netbird/management.json: failed fetching OIDC configuration from endpoint https://myvalidurl.net/.well-known/openid-configuration Get "https://myvalidurl.net/.well-known/openid-configuration": dial tcp [valid resolved ip address]:443: i/o timeout - I have full access to the Zitadel console. - openid-configuration is publicly available. - when trying to access netbird: https://myvalidurl.net/peers just spins - ssl certificate is valid
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@zackenbaron commented on GitHub (Jul 6, 2024):

Update: It somehow is now working for me.
I have following docker image IDs:

root@NetBird:~/netbird# docker image ls 
REPOSITORY                TAG         IMAGE ID       CREATED        SIZE
netbirdio/dashboard       latest      5a7297f4000f   44 hours ago   121MB
netbirdio/management      latest      d3e11dfbb72e   2 days ago     158MB
netbirdio/signal          latest      3bb7e215e8bb   2 days ago     45.5MB
coturn/coturn             latest      fb92b2191e80   2 weeks ago    168MB
ghcr.io/zitadel/zitadel   v2.54.3     2279e42e55ec   3 weeks ago    116MB
caddy                     latest      45a3686fbe0f   4 weeks ago    49.4MB
postgres                  16-alpine   4186c86cb8e8   4 weeks ago    252MB

@ChristianLavigne could you try that again too?

@zackenbaron commented on GitHub (Jul 6, 2024): Update: It somehow is now working for me. I have following docker image IDs: ```bash root@NetBird:~/netbird# docker image ls REPOSITORY TAG IMAGE ID CREATED SIZE netbirdio/dashboard latest 5a7297f4000f 44 hours ago 121MB netbirdio/management latest d3e11dfbb72e 2 days ago 158MB netbirdio/signal latest 3bb7e215e8bb 2 days ago 45.5MB coturn/coturn latest fb92b2191e80 2 weeks ago 168MB ghcr.io/zitadel/zitadel v2.54.3 2279e42e55ec 3 weeks ago 116MB caddy latest 45a3686fbe0f 4 weeks ago 49.4MB postgres 16-alpine 4186c86cb8e8 4 weeks ago 252MB ``` @ChristianLavigne could you try that again too?
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@ChristianLavigne commented on GitHub (Jul 23, 2024):

@zackenbaron
The solution I found was to run Zitadel on a separate server.

I wanted to use Zitadel for a number of other things, so it made sense to me to have Zitadel on it's own.

@ChristianLavigne commented on GitHub (Jul 23, 2024): @zackenbaron The solution I found was to run Zitadel on a separate server. I wanted to use Zitadel for a number of other things, so it made sense to me to have Zitadel on it's own.
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@zackenbaron commented on GitHub (Jan 6, 2025):

Great News!
I've managed to get Netbird up and running via the Script!

On my side it was the a misconfigured entry in the /etc/hosts

127.0.0.1 netbird.mydomain.com netbird

Well. I inserted my servers' public ip instead of 127.0.0.1 like in the example above..
And look at that.. it works!

@zackenbaron commented on GitHub (Jan 6, 2025): Great News! I've managed to get Netbird up and running via the Script! On my side it was the a misconfigured entry in the /etc/hosts ``` 127.0.0.1 netbird.mydomain.com netbird ``` Well. I inserted my servers' public ip instead of 127.0.0.1 like in the example above.. And look at that.. it works!
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@nazarewk commented on GitHub (Apr 28, 2025):

Hello @zackenbaron,

We're currently reviewing our open issues and would like to verify if this problem still exists in the latest NetBird version.

Could you please confirm if the issue is still there?

We may close this issue temporarily if we don't hear back from you within 2 weeks, but feel free to reopen it with updated information.

Thanks for your contribution to improving the project!

@nazarewk commented on GitHub (Apr 28, 2025): Hello @zackenbaron, We're currently reviewing our open issues and would like to verify if this problem still exists in the [latest NetBird version](https://github.com/netbirdio/netbird/releases). Could you please confirm if the issue is still there? We may close this issue temporarily if we don't hear back from you within **2 weeks**, but feel free to reopen it with updated information. Thanks for your contribution to improving the project!
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@zackenbaron commented on GitHub (May 2, 2025):

@nazarewk Thank you for your reply. Please feel free to close this issue for now, temporarily. I will repeat a setup if I got time.

@zackenbaron commented on GitHub (May 2, 2025): @nazarewk Thank you for your reply. Please feel free to close this issue for now, temporarily. I will repeat a setup if I got time.
saavagebueno commented 2025-11-20 05:20:35 -05:00
Author
Owner
Copy Link

@Kenji0510 commented on GitHub (May 3, 2025):

(I am Japanese and not very good at English, but I will translate.)
I am in the same situation.
I am using Docker on Ubuntu 24.04 and have set up a self-hosted version of Netbird.
However, after completing the Netbird administrator account settings (password reset), when I access https://<my_public_domain>/peers, it gets stuck in loading mode.
The following is my environment.

docker ps
CONTAINER ID   IMAGE                             COMMAND                  CREATED          STATUS                   PORTS                                                                                                                                                                          NAMES
cda20e8a355e   [ghcr.io/zitadel/zitadel:v2.64.1](http://ghcr.io/zitadel/zitadel:v2.64.1)   "/app/zitadel start-…"   3 seconds ago    Up 2 seconds                                                                                                                                                                                            kenji-zitadel-1
d176599091ff   netbirdio/management:latest       "/go/bin/netbird-mgm…"   25 minutes ago   Up 19 seconds                                                                                                                                                                                           kenji-management-1
83c671d72f37   netbirdio/dashboard:latest        "/usr/bin/supervisor…"   25 minutes ago   Up 3 minutes             80/tcp, 443/tcp                                                                                                                                                                kenji-dashboard-1
0b4348e5fc5b   netbirdio/signal:latest           "/go/bin/netbird-sig…"   25 minutes ago   Up 3 minutes                                                                                                                                                                                            kenji-signal-1
abe5640550b1   coturn/coturn                     "docker-entrypoint.s…"   25 minutes ago   Up 3 minutes                                                                                                                                                                                            kenji-coturn-1
e664f5d07907   netbirdio/relay:latest            "/go/bin/netbird-rel…"   25 minutes ago   Up 3 minutes                                                                                                                                                                                            kenji-relay-1
57419d1f7d01   caddy                             "caddy run --config …"   25 minutes ago   Up 3 minutes             0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp, 2019/tcp   kenji-caddy-1
6f06aa1d0557   postgres:16-alpine                "docker-entrypoint.s…"   25 minutes ago   Up 3 minutes (healthy)   5432/tcp                                                                                                                                                                       kenji-zdb-1
  • Error view
    Image

I think Netbird is a very useful tool, but it's a shame that I can't use it properly due to the settings screen. I would like to find a way to solve this problem.
If you have any ideas, please let me know. Thank you in advance.

@Kenji0510 commented on GitHub (May 3, 2025): (I am Japanese and not very good at English, but I will translate.) I am in the same situation. I am using Docker on Ubuntu 24.04 and have set up a self-hosted version of Netbird. However, after completing the Netbird administrator account settings (password reset), when I access https://<my_public_domain>/peers, it gets stuck in loading mode. The following is my environment. ```bash docker ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES cda20e8a355e [ghcr.io/zitadel/zitadel:v2.64.1](http://ghcr.io/zitadel/zitadel:v2.64.1) "/app/zitadel start-…" 3 seconds ago Up 2 seconds kenji-zitadel-1 d176599091ff netbirdio/management:latest "/go/bin/netbird-mgm…" 25 minutes ago Up 19 seconds kenji-management-1 83c671d72f37 netbirdio/dashboard:latest "/usr/bin/supervisor…" 25 minutes ago Up 3 minutes 80/tcp, 443/tcp kenji-dashboard-1 0b4348e5fc5b netbirdio/signal:latest "/go/bin/netbird-sig…" 25 minutes ago Up 3 minutes kenji-signal-1 abe5640550b1 coturn/coturn "docker-entrypoint.s…" 25 minutes ago Up 3 minutes kenji-coturn-1 e664f5d07907 netbirdio/relay:latest "/go/bin/netbird-rel…" 25 minutes ago Up 3 minutes kenji-relay-1 57419d1f7d01 caddy "caddy run --config …" 25 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, [::]:80->80/tcp, 0.0.0.0:443->443/tcp, [::]:443->443/tcp, 0.0.0.0:8080->8080/tcp, [::]:8080->8080/tcp, 0.0.0.0:443->443/udp, [::]:443->443/udp, 2019/tcp kenji-caddy-1 6f06aa1d0557 postgres:16-alpine "docker-entrypoint.s…" 25 minutes ago Up 3 minutes (healthy) 5432/tcp kenji-zdb-1 ``` - Error view <img width="507" alt="Image" src="https://github.com/user-attachments/assets/6404f760-63e7-4ba7-9fda-b0991a488792" /> I think Netbird is a very useful tool, but it's a shame that I can't use it properly due to the settings screen. I would like to find a way to solve this problem. If you have any ideas, please let me know. Thank you in advance.
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@Truongvt2 commented on GitHub (May 17, 2025):

hello @zackenbaron , i am experiencing the same issue with OIDC configure after restarting my Netbird server

please kindly help to fix

@Truongvt2 commented on GitHub (May 17, 2025): hello @zackenbaron , i am experiencing the same issue with OIDC configure after restarting my Netbird server please kindly help to fix
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@zackenbaron commented on GitHub (May 18, 2025):

Great News! I've managed to get Netbird up and running via the Script!

On my side it was the a misconfigured entry in the /etc/hosts

127.0.0.1 netbird.mydomain.com netbird

Well. I inserted my servers' public ip instead of 127.0.0.1 like in the example above.. And look at that.. it works!

@Kenji0510 @Truongvt2
Could you please try this.

@zackenbaron commented on GitHub (May 18, 2025): > Great News! I've managed to get Netbird up and running via the Script! > > On my side it was the a misconfigured entry in the /etc/hosts > > ``` > 127.0.0.1 netbird.mydomain.com netbird > ``` > > Well. I inserted my servers' public ip instead of 127.0.0.1 like in the example above.. And look at that.. it works! @Kenji0510 @Truongvt2 Could you please try this.
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@Truongvt2 commented on GitHub (May 19, 2025):

thank @zackenbaron for your quick reply
However, the issue still persists event after adding the record to my /etc/hosts

Image

Image

i have already opened all inbound/outbound network traffic
please kindly help to advise

@Truongvt2 commented on GitHub (May 19, 2025): thank @zackenbaron for your quick reply However, the issue still persists event after adding the record to my /etc/hosts ![Image](https://github.com/user-attachments/assets/8d48f7ad-2b1d-4206-99a9-df211c613961) ![Image](https://github.com/user-attachments/assets/bbd47e41-6c0b-4260-b3b8-0ed643e4778f) i have already opened all inbound/outbound network traffic please kindly help to advise
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@plygrnd commented on GitHub (Jul 10, 2025):

If you're using a cloud-based VM/VPS/instance, disable the host firewall and use the service provider's managed firewall if you haven't done so already. I hit the "unable to hit the OIDC endpoint from management container" error last night. Root cause was that the VPS I was using came with ufw enabled, and it + Docker's weird chains messed up the VPS's ability to talk to itself.

@plygrnd commented on GitHub (Jul 10, 2025): If you're using a cloud-based VM/VPS/instance, _disable the host firewall and use the service provider's managed firewall_ if you haven't done so already. I hit the "unable to hit the OIDC endpoint from management container" error last night. Root cause was that the VPS I was using came with `ufw` enabled, and it + Docker's weird chains messed up the VPS's ability to talk to itself.
saavagebueno commented 2025-11-20 05:20:36 -05:00
Author
Owner
Copy Link

@cmmh commented on GitHub (Nov 12, 2025):

I can confirm that I had the same issue, and the firewall rules were the problem. Unfortunately, my VPS provider doesn't supply "out of band" firewall rules, so I'll be digging in and trying to determine a sensible set of rules that allows for proper functioning.

@cmmh commented on GitHub (Nov 12, 2025): I can confirm that I had the same issue, and the firewall rules were the problem. Unfortunately, my VPS provider doesn't supply "out of band" firewall rules, so I'll be digging in and trying to determine a sensible set of rules that allows for proper functioning.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label triage-needed waiting-feedback
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#955
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?