SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-05-18 14:11:56 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Google Auth Failing As 404 After Redirect from /auth #971

New Issue
Closed
opened 2025-11-20 05:20:50 -05:00 by saavagebueno · 3 comments
saavagebueno commented 2025-11-20 05:20:50 -05:00
Owner
Copy Link

Originally created by @majordwarf on GitHub (Jun 12, 2024).

Describe the problem

I have setup a self-hosted server as per the guide on AWS using ALB as reverse proxy. But after the consent screen it fails after the callback request from accounts.google.com to $DOMAIN/auth as 404.

Screenshot 2024-06-12 at 12 21 53 PM

$DOMAIN = Sub domain I use
xxx = redacted sensitive information

setup.env File 
NETBIRD_DASHBOARD_TAG=""
NETBIRD_SIGNAL_TAG=""
NETBIRD_MANAGEMENT_TAG=""
COTURN_TAG=""
NETBIRD_DOMAIN="$DOMAIN"

NETBIRD_TURN_DOMAIN=""

NETBIRD_TURN_EXTERNAL_IP=""


NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://accounts.google.com/.well-known/openid-configuration"

NETBIRD_AUTH_AUDIENCE="xxx.apps.googleusercontent.com"

NETBIRD_AUTH_CLIENT_ID="xxx.apps.googleusercontent.com"

NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email"

NETBIRD_AUTH_CLIENT_SECRET="xxx"

NETBIRD_USE_AUTH0=false

NETBIRD_AUTH_REDIRECT_URI="/auth"

NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth"

NETBIRD_TOKEN_SOURCE="idToken"


NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"

NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""

NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE

NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"

NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false


NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"


NETBIRD_MGMT_IDP="google"

NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true

NETBIRD_IDP_MGMT_EXTRA_SERVICE_ACCOUNT_KEY="xxx"

NETBIRD_IDP_MGMT_EXTRA_CUSTOMER_ID="xxx"


NETBIRD_DISABLE_LETSENCRYPT=true

NETBIRD_LETSENCRYPT_EMAIL=""


NETBIRD_DISABLE_ANONYMOUS_METRICS=false

NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted


NETBIRD_MGMT_API_PORT="33073"

NETBIRD_SIGNAL_PORT="10000"

I run ./configure.sh and in the artifacts folder I bring docker compose up. All containers start without any problem.

Generated management.json 
{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:$DOMAIN:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:$DOMAIN:3478",
                "Username": "self",
                "Password": "xxx"
            }
        ]
    },
    "Signal": {
        "Proto": "https",
        "URI": "$DOMAIN:10000",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "xxx",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "xxx.apps.googleusercontent.com",
        "AuthIssuer": "https://accounts.google.com",
        "AuthUserIDClaim": "",
        "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs",
        "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": true
    },
    "IdpManagerConfig": {
        "ManagerType": "google",
        "ClientConfig": {
            "Issuer": "https://accounts.google.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "ClientID": "xxx.apps.googleusercontent.com",
            "ClientSecret": "xxx",
            "GrantType": "client_credentials"
        },
        "ExtraConfig": {
            "CustomerId": "xxx",
            "ServiceAccountKey": "xxx"
        },
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "none",
        "ProviderConfig": {
            "ClientID": "xxx.apps.googleusercontent.com",
            "ClientSecret": "xxx",
            "Domain": "",
            "Audience": "xxx.apps.googleusercontent.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code",
            "AuthorizationEndpoint": "",
            "Scope": "openid",
            "UseIDToken": false,
            "RedirectURLs": null
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "xxx.apps.googleusercontent.com",
            "ClientSecret": "xxx",
            "Domain": "",
            "Audience": "xxx.apps.googleusercontent.com",
            "TokenEndpoint": "https://oauth2.googleapis.com/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": [
        "https://$DOMAIN/auth",
        "https://$DOMAIN/silent-auth",
                "http://localhost:53000"
            ]
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}

Expected behavior

After login Netbird uses the authentication information to authenticate the user.

Are you using NetBird Cloud?

No, self-hosted.

NetBird version

Using latest docker image, which is version v0.27.10

NetBird status -d output:

No client app yet involved

Originally created by @majordwarf on GitHub (Jun 12, 2024). **Describe the problem** I have setup a self-hosted server as per the guide on AWS using ALB as reverse proxy. But after the consent screen it fails after the callback request from `accounts.google.com` to `$DOMAIN/auth` as 404. ![Screenshot 2024-06-12 at 12 21 53 PM](https://github.com/netbirdio/netbird/assets/23737560/1fec4f2c-905a-4fff-b863-e8ffd737c50e) `$DOMAIN` = Sub domain I use `xxx` = redacted sensitive information <details> <summary><b><i>setup.env File</i></b></summary> <pre> NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" NETBIRD_DOMAIN="$DOMAIN" NETBIRD_TURN_DOMAIN="" NETBIRD_TURN_EXTERNAL_IP="" NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://accounts.google.com/.well-known/openid-configuration" NETBIRD_AUTH_AUDIENCE="xxx.apps.googleusercontent.com" NETBIRD_AUTH_CLIENT_ID="xxx.apps.googleusercontent.com" NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email" NETBIRD_AUTH_CLIENT_SECRET="xxx" NETBIRD_USE_AUTH0=false NETBIRD_AUTH_REDIRECT_URI="/auth" NETBIRD_AUTH_SILENT_REDIRECT_URI="/silent-auth" NETBIRD_TOKEN_SOURCE="idToken" NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" NETBIRD_MGMT_IDP="google" NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true NETBIRD_IDP_MGMT_EXTRA_SERVICE_ACCOUNT_KEY="xxx" NETBIRD_IDP_MGMT_EXTRA_CUSTOMER_ID="xxx" NETBIRD_DISABLE_LETSENCRYPT=true NETBIRD_LETSENCRYPT_EMAIL="" NETBIRD_DISABLE_ANONYMOUS_METRICS=false NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted NETBIRD_MGMT_API_PORT="33073" NETBIRD_SIGNAL_PORT="10000"</pre> </details> I run ./configure.sh and in the artifacts folder I bring docker compose up. All containers start without any problem. <details> <summary><b><i>Generated management.json</i></b></summary> <pre> { "Stuns": [ { "Proto": "udp", "URI": "stun:$DOMAIN:3478", "Username": "", "Password": "" } ], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [ { "Proto": "udp", "URI": "turn:$DOMAIN:3478", "Username": "self", "Password": "xxx" } ] }, "Signal": { "Proto": "https", "URI": "$DOMAIN:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "xxx", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "", "CertKey": "", "AuthAudience": "xxx.apps.googleusercontent.com", "AuthIssuer": "https://accounts.google.com", "AuthUserIDClaim": "", "AuthKeysLocation": "https://www.googleapis.com/oauth2/v3/certs", "OIDCConfigEndpoint": "https://accounts.google.com/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": true }, "IdpManagerConfig": { "ManagerType": "google", "ClientConfig": { "Issuer": "https://accounts.google.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "ClientID": "xxx.apps.googleusercontent.com", "ClientSecret": "xxx", "GrantType": "client_credentials" }, "ExtraConfig": { "CustomerId": "xxx", "ServiceAccountKey": "xxx" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "none", "ProviderConfig": { "ClientID": "xxx.apps.googleusercontent.com", "ClientSecret": "xxx", "Domain": "", "Audience": "xxx.apps.googleusercontent.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "DeviceAuthEndpoint": "https://oauth2.googleapis.com/device/code", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "xxx.apps.googleusercontent.com", "ClientSecret": "xxx", "Domain": "", "Audience": "xxx.apps.googleusercontent.com", "TokenEndpoint": "https://oauth2.googleapis.com/token", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://accounts.google.com/o/oauth2/v2/auth", "Scope": "openid profile email", "UseIDToken": true, "RedirectURLs": [ "https://$DOMAIN/auth", "https://$DOMAIN/silent-auth", "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } } </pre> </details> --- **Expected behavior** After login Netbird uses the authentication information to authenticate the user. **Are you using NetBird Cloud?** No, self-hosted. **NetBird version** Using latest docker image, which is version `v0.27.10` **NetBird status -d output:** No client app yet involved
saavagebueno added the idpself-hosting labels 2025-11-20 05:20:50 -05:00
saavagebueno commented 2025-11-20 05:20:50 -05:00
Author
Owner
Copy Link

@ergleb78 commented on GitHub (Jun 19, 2024):

I'm having the same issue after latest update:
Logs of the dashboard container:

"GET /silent-auth HTTP/1.1" 404 1663 "https:///peers?state=......

@ergleb78 commented on GitHub (Jun 19, 2024): I'm having the same issue after latest update: Logs of the dashboard container: "GET /silent-auth HTTP/1.1" 404 1663 "https://<our-domain-here>/peers?state=......
saavagebueno commented 2025-11-20 05:20:51 -05:00
Author
Owner
Copy Link

@RadeJR commented on GitHub (Jun 19, 2024):

I have the same problem, couldnt get more info

@RadeJR commented on GitHub (Jun 19, 2024): I have the same problem, couldnt get more info
saavagebueno commented 2025-11-20 05:20:51 -05:00
Author
Owner
Copy Link

@majordwarf commented on GitHub (Jun 20, 2024):

I resolved the issue by exposing the service on ALB Listener port 33073 for Management instead of adjusting the Target Group's resolution port.

Ps: I'm on AWS.

@majordwarf commented on GitHub (Jun 20, 2024): I resolved the issue by exposing the service on ALB Listener port 33073 for Management instead of adjusting the Target Group's resolution port. Ps: I'm on AWS.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label idp self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#971
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?