SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 19:55:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Request failed with status code 401. Error: token invalid #986

New Issue
Open
opened 2025-11-20 05:21:02 -05:00 by saavagebueno · 36 comments
saavagebueno commented 2025-11-20 05:21:02 -05:00
Owner
Copy Link

Originally created by @Unreeling8562 on GitHub (Jun 16, 2024).

Describe the problem

I installed Netbird with keycloak as idp. When I try to login I get the following error:
Request failed with status code 401. Error: token invalid

In docker logs:

management-1  | 2024-06-16T15:25:56Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: invalid audience
management-1  | 2024-06-16T15:25:56Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
management-1  | 2024-06-16T15:25:56Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2776902179: GET /api/users status 401

To Reproduce

Steps to reproduce the behavior:

  1. Go to Netbird
  2. Try to login using Keycloak
  3. Get error message

Expected behavior

I should see the dashboard after logging in

Are you using NetBird Cloud?

No, selfhosted on Hetzner X22

NetBird version

0.27.10

Screenshots

Screenshot from 2024-06-16 17-25-56

Additional context

Here is my setup.env:

## example file, you can copy this file to setup.env and update its values
##

# Image tags
# you can force specific tags for each component; will be set to latest if empty
NETBIRD_DASHBOARD_TAG=""
NETBIRD_SIGNAL_TAG=""
NETBIRD_MANAGEMENT_TAG=""
COTURN_TAG=""

# Dashboard domain. e.g. app.mydomain.com
NETBIRD_DOMAIN="netbird.example.com"

# TURN server domain. e.g. turn.mydomain.com
# if not specified it will assume NETBIRD_DOMAIN
NETBIRD_TURN_DOMAIN=""

# TURN server public IP address
# required for a connection involving peers in
# the same network as the server and external peers
# usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN
NETBIRD_TURN_EXTERNAL_IP="xx.xx.xxx.xx"

# -------------------------------------------
# OIDC
#  e.g., https://example.eu.auth0.com/.well-known/openid-configuration
# -------------------------------------------
NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://auth.example.com/realms/myrealm/.well-known/openid-configuration"
# The default setting is to transmit the audience to the IDP during authorization. However,
# if your IDP does not have this capability, you can turn this off by setting it to false.
#NETBIRD_DASH_AUTH_USE_AUDIENCE=false
NETBIRD_AUTH_AUDIENCE="netbird-client"
# e.g. netbird-client
NETBIRD_AUTH_CLIENT_ID="netbird-client"
# indicates the scopes that will be requested to the IDP
NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api"
# NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace.
# NETBIRD_AUTH_CLIENT_SECRET=""
# if you want to use a custom claim for the user ID instead of 'sub', set it here
# NETBIRD_AUTH_USER_ID_CLAIM=""
# indicates whether to use Auth0 or not: true or false
NETBIRD_USE_AUTH0="false"
# if your IDP provider doesn't support fragmented URIs, configure custom
# redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain.
# NETBIRD_AUTH_REDIRECT_URI="/peers"
# NETBIRD_AUTH_SILENT_REDIRECT_URI="/add-peers"
# Updates the preference to use id tokens instead of access token on dashboard
# Okta and Gitlab IDPs can benefit from this
# NETBIRD_TOKEN_SOURCE="idToken"
# -------------------------------------------
# OIDC Device Authorization Flow
# -------------------------------------------
NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none"
NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID=""
# Some IDPs requires different audience, scopes and to use id token for device authorization flow
# you can customize here:
NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE
NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid"
NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false
# -------------------------------------------
# OIDC PKCE Authorization Flow
# -------------------------------------------
# Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative
# eg. 53000,54000
NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000"
# -------------------------------------------
# IDP Management
# -------------------------------------------
# eg. zitadel, auth0, azure, keycloak
NETBIRD_MGMT_IDP="keycloak"
# Some IDPs requires different client id and client secret for management api
NETBIRD_IDP_MGMT_CLIENT_ID="netbird-backend"
NETBIRD_IDP_MGMT_CLIENT_SECRET="MySuperSecureClientSecret"
# Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird"
NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT="https://auth.example.com/admin/realms/myrealm"
# With some IDPs may be needed enabling automatic refresh of signing keys on expire
# NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false
# NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice.
# -------------------------------------------
# Letsencrypt
# -------------------------------------------
# Disable letsencrypt
#  if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead
NETBIRD_DISABLE_LETSENCRYPT=false
# e.g. hello@mydomain.com
NETBIRD_LETSENCRYPT_EMAIL="mail@example.com"
# -------------------------------------------
# Extra settings
# -------------------------------------------
# Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection
NETBIRD_DISABLE_ANONYMOUS_METRICS=true
# DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted
NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted
Originally created by @Unreeling8562 on GitHub (Jun 16, 2024). **Describe the problem** I installed Netbird with keycloak as idp. When I try to login I get the following error: Request failed with status code 401. Error: token invalid In docker logs: ``` management-1 | 2024-06-16T15:25:56Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: invalid audience management-1 | 2024-06-16T15:25:56Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-06-16T15:25:56Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2776902179: GET /api/users status 401 ``` **To Reproduce** Steps to reproduce the behavior: 1. Go to Netbird 2. Try to login using Keycloak 3. Get error message **Expected behavior** I should see the dashboard after logging in **Are you using NetBird Cloud?** No, selfhosted on Hetzner X22 **NetBird version** 0.27.10 **Screenshots** ![Screenshot from 2024-06-16 17-25-56](https://github.com/netbirdio/netbird/assets/156370247/4747d37b-9902-4f11-978e-67d486324a9c) **Additional context** Here is my setup.env: ``` ## example file, you can copy this file to setup.env and update its values ## # Image tags # you can force specific tags for each component; will be set to latest if empty NETBIRD_DASHBOARD_TAG="" NETBIRD_SIGNAL_TAG="" NETBIRD_MANAGEMENT_TAG="" COTURN_TAG="" # Dashboard domain. e.g. app.mydomain.com NETBIRD_DOMAIN="netbird.example.com" # TURN server domain. e.g. turn.mydomain.com # if not specified it will assume NETBIRD_DOMAIN NETBIRD_TURN_DOMAIN="" # TURN server public IP address # required for a connection involving peers in # the same network as the server and external peers # usually matches the IP for the domain set in NETBIRD_TURN_DOMAIN NETBIRD_TURN_EXTERNAL_IP="xx.xx.xxx.xx" # ------------------------------------------- # OIDC # e.g., https://example.eu.auth0.com/.well-known/openid-configuration # ------------------------------------------- NETBIRD_AUTH_OIDC_CONFIGURATION_ENDPOINT="https://auth.example.com/realms/myrealm/.well-known/openid-configuration" # The default setting is to transmit the audience to the IDP during authorization. However, # if your IDP does not have this capability, you can turn this off by setting it to false. #NETBIRD_DASH_AUTH_USE_AUDIENCE=false NETBIRD_AUTH_AUDIENCE="netbird-client" # e.g. netbird-client NETBIRD_AUTH_CLIENT_ID="netbird-client" # indicates the scopes that will be requested to the IDP NETBIRD_AUTH_SUPPORTED_SCOPES="openid profile email offline_access api" # NETBIRD_AUTH_CLIENT_SECRET is required only by Google workspace. # NETBIRD_AUTH_CLIENT_SECRET="" # if you want to use a custom claim for the user ID instead of 'sub', set it here # NETBIRD_AUTH_USER_ID_CLAIM="" # indicates whether to use Auth0 or not: true or false NETBIRD_USE_AUTH0="false" # if your IDP provider doesn't support fragmented URIs, configure custom # redirect and silent redirect URIs, these will be concatenated into your NETBIRD_DOMAIN domain. # NETBIRD_AUTH_REDIRECT_URI="/peers" # NETBIRD_AUTH_SILENT_REDIRECT_URI="/add-peers" # Updates the preference to use id tokens instead of access token on dashboard # Okta and Gitlab IDPs can benefit from this # NETBIRD_TOKEN_SOURCE="idToken" # ------------------------------------------- # OIDC Device Authorization Flow # ------------------------------------------- NETBIRD_AUTH_DEVICE_AUTH_PROVIDER="none" NETBIRD_AUTH_DEVICE_AUTH_CLIENT_ID="" # Some IDPs requires different audience, scopes and to use id token for device authorization flow # you can customize here: NETBIRD_AUTH_DEVICE_AUTH_AUDIENCE=$NETBIRD_AUTH_AUDIENCE NETBIRD_AUTH_DEVICE_AUTH_SCOPE="openid" NETBIRD_AUTH_DEVICE_AUTH_USE_ID_TOKEN=false # ------------------------------------------- # OIDC PKCE Authorization Flow # ------------------------------------------- # Comma separated port numbers. if already in use, PKCE flow will choose an available port from the list as an alternative # eg. 53000,54000 NETBIRD_AUTH_PKCE_REDIRECT_URL_PORTS="53000" # ------------------------------------------- # IDP Management # ------------------------------------------- # eg. zitadel, auth0, azure, keycloak NETBIRD_MGMT_IDP="keycloak" # Some IDPs requires different client id and client secret for management api NETBIRD_IDP_MGMT_CLIENT_ID="netbird-backend" NETBIRD_IDP_MGMT_CLIENT_SECRET="MySuperSecureClientSecret" # Required when setting up with Keycloak "https://<YOUR_KEYCLOAK_HOST_AND_PORT>/admin/realms/netbird" NETBIRD_IDP_MGMT_EXTRA_ADMIN_ENDPOINT="https://auth.example.com/admin/realms/myrealm" # With some IDPs may be needed enabling automatic refresh of signing keys on expire # NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=false # NETBIRD_IDP_MGMT_EXTRA_ variables. See https://docs.netbird.io/selfhosted/identity-providers for more information about your IDP of choice. # ------------------------------------------- # Letsencrypt # ------------------------------------------- # Disable letsencrypt # if disabled, cannot use HTTPS anymore and requires setting up a reverse-proxy to do it instead NETBIRD_DISABLE_LETSENCRYPT=false # e.g. hello@mydomain.com NETBIRD_LETSENCRYPT_EMAIL="mail@example.com" # ------------------------------------------- # Extra settings # ------------------------------------------- # Disable anonymous metrics collection, see more information at https://netbird.io/docs/FAQ/metrics-collection NETBIRD_DISABLE_ANONYMOUS_METRICS=true # DNS DOMAIN configures the domain name used for peer resolution. By default it is netbird.selfhosted NETBIRD_MGMT_DNS_DOMAIN=netbird.selfhosted ```
saavagebueno added the idpself-hosting labels 2025-11-20 05:21:02 -05:00
saavagebueno commented 2025-11-20 05:21:03 -05:00
Author
Owner
Copy Link

@Unreeling8562 commented on GitHub (Jun 16, 2024):

I've followed the official advanced docs from Netbird

@Unreeling8562 commented on GitHub (Jun 16, 2024): I've followed the official advanced docs from Netbird
saavagebueno commented 2025-11-20 05:21:03 -05:00
Author
Owner
Copy Link

@Cikaros commented on GitHub (Jun 16, 2024):

It requires the Geo database to be installed. Check whether the database is installed.
https://docs.netbird.io/selfhosted/geo-support

@Cikaros commented on GitHub (Jun 16, 2024): It requires the Geo database to be installed. Check whether the database is installed. https://docs.netbird.io/selfhosted/geo-support
saavagebueno commented 2025-11-20 05:21:03 -05:00
Author
Owner
Copy Link

@Unreeling8562 commented on GitHub (Jun 17, 2024):

It requires the Geo database to be installed. Check whether the database is installed. https://docs.netbird.io/selfhosted/geo-support

I've installed this, but still the same error unfortunately

@Unreeling8562 commented on GitHub (Jun 17, 2024): > It requires the Geo database to be installed. Check whether the database is installed. https://docs.netbird.io/selfhosted/geo-support I've installed this, but still the same error unfortunately
saavagebueno commented 2025-11-20 05:21:03 -05:00
Author
Owner
Copy Link

@allroundtechie commented on GitHub (Jun 17, 2024):

I can imagine this is the same issue like this one (except this one is about Zitadel as an IDP): https://github.com/netbirdio/netbird/pull/2089

I doubt a 401 token invalid error has something to do with the geo database.

@allroundtechie commented on GitHub (Jun 17, 2024): I can imagine this is the same issue like this one (except this one is about Zitadel as an IDP): https://github.com/netbirdio/netbird/pull/2089 I doubt a 401 token invalid error has something to do with the geo database.
saavagebueno commented 2025-11-20 05:21:03 -05:00
Author
Owner
Copy Link

@Cikaros commented on GitHub (Jun 17, 2024):

Check the logs of the management service

@Cikaros commented on GitHub (Jun 17, 2024): Check the logs of the management service
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@HansAschauer commented on GitHub (Jun 21, 2024):

I had a problem with quite similar symptoms. This is possibly a bug in recent versions of keycloak, but I am not an expert with it.

However, I could work around the issue in the following way:

In the setup guide (https://docs.netbird.io/selfhosted/identity-providers#step-6-create-a-net-bird-client-scope), go to step 6 ("Create a NetBird client scope"). But instead of adding "netbird-client" to "Included Client Audience", add it to "Included Custom Audience"

In fact, I have created a second mapper with these settings, but I guess just changing the first one should be enough.
If you want to check if the audience is set correctly, go to Clients -> netbird-client, go to tab "Client Scopes", subtab (one line below) "evaluate". Choose the user netbird and select "Generated access tokens" in the list on the right. Check if the "aud" claim contains "netbird-client".

@HansAschauer commented on GitHub (Jun 21, 2024): I had a problem with quite similar symptoms. This is possibly a bug in recent versions of keycloak, but I am not an expert with it. However, I could **work around** the issue in the following way: In the setup guide (https://docs.netbird.io/selfhosted/identity-providers#step-6-create-a-net-bird-client-scope), go to step 6 ("Create a NetBird client scope"). But instead of adding "netbird-client" to "Included **Client** Audience", add it to "Included **Custom** Audience" In fact, I have created a second mapper with these settings, but I guess just changing the first one should be enough. If you want to check if the audience is set correctly, go to Clients -> netbird-client, go to tab "Client Scopes", subtab (one line below) "evaluate". Choose the user netbird and select "Generated access tokens" in the list on the right. Check if the "aud" claim contains "netbird-client".
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@ergleb78 commented on GitHub (Jun 27, 2024):

We are experiencing the same issue on Google Auth. Management logs:

2024-06-27T16:56:41Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key
2024-06-27T16:56:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key
2024-06-27T16:56:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
2024-06-27T16:56:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 798438459: GET /api/users status 401
2024-06-27T16:56:43Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key
2024-06-27T16:56:43Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key
2024-06-27T16:56:43Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
2024-06-27T16:56:43Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 404750189: GET /api/users status 401

It's inconsistent: sometimes restart of docker-compose helps, sometimes it required to remove the containers and recreate

UPDATE: Downloading and updating GEO database fixed the issue.

Ask: It would be incredibly helpful to see some pointers to the root cause of the problem in the err logs.

@ergleb78 commented on GitHub (Jun 27, 2024): We are experiencing the same issue on Google Auth. Management logs: ``` 2024-06-27T16:56:41Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key 2024-06-27T16:56:41Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key 2024-06-27T16:56:41Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid 2024-06-27T16:56:41Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 798438459: GET /api/users status 401 2024-06-27T16:56:43Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key 2024-06-27T16:56:43Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key 2024-06-27T16:56:43Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid 2024-06-27T16:56:43Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 404750189: GET /api/users status 401 ``` It's inconsistent: sometimes restart of docker-compose helps, sometimes it required to remove the containers and recreate UPDATE: Downloading and updating GEO database fixed the issue. Ask: It would be incredibly helpful to see some pointers to the root cause of the problem in the err logs.
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@Vandaahl commented on GitHub (Jun 28, 2024):

I had a problem with quite similar symptoms. This is possibly a bug in recent versions of keycloak, but I am not an expert with it.

However, I could work around the issue in the following way:

In the setup guide (https://docs.netbird.io/selfhosted/identity-providers#step-6-create-a-net-bird-client-scope), go to step 6 ("Create a NetBird client scope"). But instead of adding "netbird-client" to "Included Client Audience", add it to "Included Custom Audience"

In fact, I have created a second mapper with these settings, but I guess just changing the first one should be enough. If you want to check if the audience is set correctly, go to Clients -> netbird-client, go to tab "Client Scopes", subtab (one line below) "evaluate". Choose the user netbird and select "Generated access tokens" in the list on the right. Check if the "aud" claim contains "netbird-client".

Just wanted to say thank you for this comment. I wasted so many hours getting this to work with Keycloak and now it finally works :)

@Vandaahl commented on GitHub (Jun 28, 2024): > I had a problem with quite similar symptoms. This is possibly a bug in recent versions of keycloak, but I am not an expert with it. > > However, I could **work around** the issue in the following way: > > In the setup guide (https://docs.netbird.io/selfhosted/identity-providers#step-6-create-a-net-bird-client-scope), go to step 6 ("Create a NetBird client scope"). But instead of adding "netbird-client" to "Included **Client** Audience", add it to "Included **Custom** Audience" > > In fact, I have created a second mapper with these settings, but I guess just changing the first one should be enough. If you want to check if the audience is set correctly, go to Clients -> netbird-client, go to tab "Client Scopes", subtab (one line below) "evaluate". Choose the user netbird and select "Generated access tokens" in the list on the right. Check if the "aud" claim contains "netbird-client". Just wanted to say thank you for this comment. I wasted so many hours getting this to work with Keycloak and now it finally works :)
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@Pshemas commented on GitHub (Jul 2, 2024):

I have similar problem with Authentik. Initially the setup worked, but after restarting the containers for both Netbird and Authentik I get this dreaded 401: token invalid error.

After restarting the containers (both for Authentik and Netbird) I can't log in to management portal. Any suggestions what to do are greatly appreciated.

Error logs found in management component:

management-1  | 2024-07-02T15:39:41Z DEBG management/server/grpcserver.go:130: Sync request from peer [YvVW8g9sDDcUNhigOOW2SlIZBHj5Lj//mfMP2WAgzkg=] [56.67.17.123]
management-1  | 2024-07-02T15:39:41Z DEBG management/server/updatechannel.go:87: opened updates channel for a peer cpk3l2f7g7ts738pqbh0
management-1  | 2024-07-02T15:39:41Z DEBG management/server/telemetry/http_api_metrics.go:201: request OPTIONS /api/users took 0 ms and finished with status 204
management-1  | 2024-07-02T15:39:41Z DEBG management/server/account.go:1661: overriding JWT Domain and DomainCategory claims since single account mode is enabled
management-1  | 2024-07-02T15:39:41Z DEBG management/server/account.go:1810: Acquired global lock in 77.978µs for user 7
management-1  | 2024-07-02T15:39:42Z DEBG management/server/sql_store.go:194: took 12 ms to persist an account to the store
management-1  | 2024-07-02T15:39:42Z DEBG management/server/account.go:1296: looking up user 7 of account cpk3ikv7g7ts73c049h0 in cache
management-1  | 2024-07-02T15:39:42Z DEBG management/server/account.go:1234: account cpk3ikv7g7ts73c049h0 not found in cache, reloading
management-1  | 2024-07-02T15:39:42Z DEBG management/server/idp/authentik.go:134: requesting new jwt token for authentik idp manager
management-1  | 2024-07-02T15:39:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get authentik token, statusCode 400
management-1  | 2024-07-02T15:39:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
management-1  | 2024-07-02T15:39:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2496285363: GET /api/users status 401
management-1  | 2024-07-02T15:39:42Z DEBG management/server/telemetry/http_api_metrics.go:201: request GET /api/users took 101 ms and finished with status 401
management-1  | 2024-07-02T15:39:42Z DEBG management/server/account.go:1661: overriding JWT Domain and DomainCategory claims since single account mode is enabled

Docker Compose file:

services:
  #UI dashboard
  dashboard:
    image: netbirdio/dashboard:v2.4.0
    restart: unless-stopped
    ports:
      - 80:80
      - 443:443
    env_file:
      - /home/uslugi/.ENV/.nbird
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt

  # Signal
  signal:
    image: netbirdio/signal:0.28.3
    restart: unless-stopped
    volumes:
      - netbird-signal:/var/lib/netbird
    ports:
      - 10000:80
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "net.mysite.com", "--log-file", "console"]

  # Management
  management:
    image: netbirdio/management:0.28.3
    restart: unless-stopped
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - /home/uslugi/management.json:/etc/netbird/management.json:z
    ports:
      - 33073:443 #API port
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "net.mysite.com", "--log-file", "console"]
    command: [
      "--port", "443",
      "--log-file", "console",
      "--log-level", "debug",
      "--disable-anonymous-metrics=true",
      "--single-account-mode-domain=net.mysite.com",
      "--dns-domain=netbird.selfhosted"
      ]

  # Coturn
  coturn:
    image: coturn/coturn:4.6.2
    restart: unless-stopped
    domainname: net.mysite.com
    volumes:
      - /home/uslugi/turnserver.conf:/etc/turnserver.conf:z
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:

Environment variables file:

# Endpoints
NETBIRD_MGMT_API_ENDPOINT=https://net.mysite.com:33073
NETBIRD_MGMT_GRPC_API_ENDPOINT=https://net.mysite.com:33073
# OIDC
AUTH_AUDIENCE=wbuBlzoRj/c5sn/xVXk0omZULBGChzyoCAhAR1NLgzs=
AUTH_CLIENT_ID=wbuBlzoRj/c5sn/xVXk0omZULBGChzyoCAhAR1NLgzs=
AUTH_CLIENT_SECRET=
AUTH_AUTHORITY=https://auth.mysite.com/application/o/netbird/
USE_AUTH0=false
AUTH_SUPPORTED_SCOPES=openid profile email offline_access api
AUTH_REDIRECT_URI=
AUTH_SILENT_REDIRECT_URI=
NETBIRD_TOKEN_SOURCE=accessToken
# SSL
NGINX_SSL_PORT=443
# Letsencrypt
LETSENCRYPT_DOMAIN=net.mysite.com
LETSENCRYPT_EMAIL=myemail@mysite.com

I've also checked Authentik and I found "application authorized" event:

{
    "user": {
        "pk": 7,
        "email": "mymail@mydomain.com",
        "username": "myusername"
    },
    "action": "authorize_application",
    "app": "authentik.providers.oauth2.views.authorize",
    "context": {
        "flow": "82fcc99a48664ec494ce06c38327c3b7",
        "scopes": "profile email openid",
        "http_request": {
            "args": {
                "scope": "openid profile email offline_access api",
                "state": "hdKCFMF3p9",
                "audience": "someid",
                "client_id": "someid",
                "redirect_uri": "https://net.mydomain.com/#callback",
                "response_type": "code",
                "code_challenge": "somecodechallenge",
                "code_challenge_method": "S256"
            },
            "path": "/api/v3/flows/executor/default-provider-authorization-explicit-consent/",
            "method": "GET",
            "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0"
        },
        "authorized_application": {
            "pk": "somepk",
            "app": "authentik_core",
            "name": "Netbird",
            "model_name": "application"
        }
    },
    "client_ip": "some.ip",
    "expires": "2025-07-02T16:12:31.981Z",
    "brand": {
        "pk": "somepk",
        "app": "authentik_brands",
        "name": "Default brand",
        "model_name": "brand"
    }
}
@Pshemas commented on GitHub (Jul 2, 2024): I have similar problem with Authentik. Initially the setup worked, but after restarting the containers for both Netbird and Authentik I get this dreaded `401: token invalid` error. After restarting the containers (both for Authentik and Netbird) I can't log in to management portal. Any suggestions what to do are greatly appreciated. Error logs found in management component: ``` management-1 | 2024-07-02T15:39:41Z DEBG management/server/grpcserver.go:130: Sync request from peer [YvVW8g9sDDcUNhigOOW2SlIZBHj5Lj//mfMP2WAgzkg=] [56.67.17.123] management-1 | 2024-07-02T15:39:41Z DEBG management/server/updatechannel.go:87: opened updates channel for a peer cpk3l2f7g7ts738pqbh0 management-1 | 2024-07-02T15:39:41Z DEBG management/server/telemetry/http_api_metrics.go:201: request OPTIONS /api/users took 0 ms and finished with status 204 management-1 | 2024-07-02T15:39:41Z DEBG management/server/account.go:1661: overriding JWT Domain and DomainCategory claims since single account mode is enabled management-1 | 2024-07-02T15:39:41Z DEBG management/server/account.go:1810: Acquired global lock in 77.978µs for user 7 management-1 | 2024-07-02T15:39:42Z DEBG management/server/sql_store.go:194: took 12 ms to persist an account to the store management-1 | 2024-07-02T15:39:42Z DEBG management/server/account.go:1296: looking up user 7 of account cpk3ikv7g7ts73c049h0 in cache management-1 | 2024-07-02T15:39:42Z DEBG management/server/account.go:1234: account cpk3ikv7g7ts73c049h0 not found in cache, reloading management-1 | 2024-07-02T15:39:42Z DEBG management/server/idp/authentik.go:134: requesting new jwt token for authentik idp manager management-1 | 2024-07-02T15:39:42Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: unable to get authentik token, statusCode 400 management-1 | 2024-07-02T15:39:42Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid management-1 | 2024-07-02T15:39:42Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 2496285363: GET /api/users status 401 management-1 | 2024-07-02T15:39:42Z DEBG management/server/telemetry/http_api_metrics.go:201: request GET /api/users took 101 ms and finished with status 401 management-1 | 2024-07-02T15:39:42Z DEBG management/server/account.go:1661: overriding JWT Domain and DomainCategory claims since single account mode is enabled ``` Docker Compose file: ``` services: #UI dashboard dashboard: image: netbirdio/dashboard:v2.4.0 restart: unless-stopped ports: - 80:80 - 443:443 env_file: - /home/uslugi/.ENV/.nbird volumes: - netbird-letsencrypt:/etc/letsencrypt # Signal signal: image: netbirdio/signal:0.28.3 restart: unless-stopped volumes: - netbird-signal:/var/lib/netbird ports: - 10000:80 # # port and command for Let's Encrypt validation # - 443:443 # command: ["--letsencrypt-domain", "net.mysite.com", "--log-file", "console"] # Management management: image: netbirdio/management:0.28.3 restart: unless-stopped depends_on: - dashboard volumes: - netbird-mgmt:/var/lib/netbird - netbird-letsencrypt:/etc/letsencrypt:ro - /home/uslugi/management.json:/etc/netbird/management.json:z ports: - 33073:443 #API port # # command for Let's Encrypt validation without dashboard container # command: ["--letsencrypt-domain", "net.mysite.com", "--log-file", "console"] command: [ "--port", "443", "--log-file", "console", "--log-level", "debug", "--disable-anonymous-metrics=true", "--single-account-mode-domain=net.mysite.com", "--dns-domain=netbird.selfhosted" ] # Coturn coturn: image: coturn/coturn:4.6.2 restart: unless-stopped domainname: net.mysite.com volumes: - /home/uslugi/turnserver.conf:/etc/turnserver.conf:z # - ./privkey.pem:/etc/coturn/private/privkey.pem:ro # - ./cert.pem:/etc/coturn/certs/cert.pem:ro network_mode: host command: - -c /etc/turnserver.conf volumes: netbird-mgmt: netbird-signal: netbird-letsencrypt: ``` Environment variables file: ``` # Endpoints NETBIRD_MGMT_API_ENDPOINT=https://net.mysite.com:33073 NETBIRD_MGMT_GRPC_API_ENDPOINT=https://net.mysite.com:33073 # OIDC AUTH_AUDIENCE=wbuBlzoRj/c5sn/xVXk0omZULBGChzyoCAhAR1NLgzs= AUTH_CLIENT_ID=wbuBlzoRj/c5sn/xVXk0omZULBGChzyoCAhAR1NLgzs= AUTH_CLIENT_SECRET= AUTH_AUTHORITY=https://auth.mysite.com/application/o/netbird/ USE_AUTH0=false AUTH_SUPPORTED_SCOPES=openid profile email offline_access api AUTH_REDIRECT_URI= AUTH_SILENT_REDIRECT_URI= NETBIRD_TOKEN_SOURCE=accessToken # SSL NGINX_SSL_PORT=443 # Letsencrypt LETSENCRYPT_DOMAIN=net.mysite.com LETSENCRYPT_EMAIL=myemail@mysite.com ``` I've also checked Authentik and I found "application authorized" event: ``` { "user": { "pk": 7, "email": "mymail@mydomain.com", "username": "myusername" }, "action": "authorize_application", "app": "authentik.providers.oauth2.views.authorize", "context": { "flow": "82fcc99a48664ec494ce06c38327c3b7", "scopes": "profile email openid", "http_request": { "args": { "scope": "openid profile email offline_access api", "state": "hdKCFMF3p9", "audience": "someid", "client_id": "someid", "redirect_uri": "https://net.mydomain.com/#callback", "response_type": "code", "code_challenge": "somecodechallenge", "code_challenge_method": "S256" }, "path": "/api/v3/flows/executor/default-provider-authorization-explicit-consent/", "method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0" }, "authorized_application": { "pk": "somepk", "app": "authentik_core", "name": "Netbird", "model_name": "application" } }, "client_ip": "some.ip", "expires": "2025-07-02T16:12:31.981Z", "brand": { "pk": "somepk", "app": "authentik_brands", "name": "Default brand", "model_name": "brand" } } ```
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@vsavovski commented on GitHub (Jul 3, 2024):

Regarding Keycloak, it is possible to use the original setup; however, you cannot provide netbird-client as the ID. Instead, you must use the generated GUID that Keycloak creates for each client ID.

You can find the GUID in the URL: https://keycloak.mysite.com/admin/master/console/#/{realm}/clients/{client-id}.

Alternatively, as @HansAschauer mentioned, you can generate access tokens and locate the client ID in the aud field. This client ID should then be used in the .env file.

@vsavovski commented on GitHub (Jul 3, 2024): Regarding Keycloak, it is possible to use the original setup; however, you cannot provide `netbird-client` as the ID. Instead, you must use the generated GUID that Keycloak creates for each client ID. You can find the GUID in the URL: `https://keycloak.mysite.com/admin/master/console/#/{realm}/clients/{client-id}`. Alternatively, as @HansAschauer mentioned, you can generate access tokens and locate the client ID in the `aud` field. This client ID should then be used in the .env file.
saavagebueno commented 2025-11-20 05:21:04 -05:00
Author
Owner
Copy Link

@Pshemas commented on GitHub (Jul 3, 2024):

so far I've tried:

  • NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true added to .env

https://github.com/netbirdio/netbird/issues/1531#issuecomment-1929102315

  • copied geo database

https://github.com/netbirdio/netbird/issues/2142#issuecomment-2172029587

This doesn't help sadly. IWhen I look into developer console I see this:

obraz

And token invaild in netbird management logs as posted above.

I wonder - can it be something with Authentik being behind Cloudflare? But on the other hand it does not cause any issues on other apps I use with Authentik (and the super annoying thing is that it worked for a couple of weeks without a hitch).

@Pshemas commented on GitHub (Jul 3, 2024): so far I've tried: - `NETBIRD_MGMT_IDP_SIGNKEY_REFRESH=true` added to .env https://github.com/netbirdio/netbird/issues/1531#issuecomment-1929102315 - copied geo database https://github.com/netbirdio/netbird/issues/2142#issuecomment-2172029587 This doesn't help sadly. IWhen I look into developer console I see this: ![obraz](https://github.com/netbirdio/netbird/assets/6144330/af05dd7f-2d93-4ba9-8009-c3487293c3c9) And token invaild in netbird management logs as posted above. I wonder - can it be something with Authentik being behind Cloudflare? But on the other hand it does not cause any issues on other apps I use with Authentik (and the super annoying thing is that it worked for a couple of weeks without a hitch).
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@Pshemas commented on GitHub (Jul 4, 2024):

on my end it "autmagically" started working - thus suggesting something to do with Authentik config, not Netbird itself.

@Pshemas commented on GitHub (Jul 4, 2024): on my end it "autmagically" started working - thus suggesting something to do with Authentik config, not Netbird itself.
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@identw commented on GitHub (Jul 4, 2024):

I have the same problem but with Dex. Right after starting netbird-management, everything works and the login succeeds. However, if I wait a couple of hours, I get the same error upon login:

2024-07-04T20:36:48Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key
2024-07-04T20:36:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key
2024-07-04T20:36:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
2024-07-04T20:36:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4269949527: GET /api/users status 401
@identw commented on GitHub (Jul 4, 2024): I have the same problem but with Dex. Right after starting netbird-management, everything works and the login succeeds. However, if I wait a couple of hours, I get the same error upon login: ``` 2024-07-04T20:36:48Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key 2024-07-04T20:36:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key 2024-07-04T20:36:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid 2024-07-04T20:36:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4269949527: GET /api/users status 401 ```
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jul 4, 2024):

I have the same problem but with Dex. Right after starting netbird-management, everything works and the login succeeds. However, if I wait a couple of hours, I get the same error upon login:

2024-07-04T20:36:48Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key
2024-07-04T20:36:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key
2024-07-04T20:36:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid
2024-07-04T20:36:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4269949527: GET /api/users status 401

@identw you need to enable sign key refresh with --idp-sign-key-refresh-enabled

    command: [
     ...
      "--idp-sign-key-refresh-enabled",

After that run docker compose up -d

@mlsmaycon commented on GitHub (Jul 4, 2024): > I have the same problem but with Dex. Right after starting netbird-management, everything works and the login succeeds. However, if I wait a couple of hours, I get the same error upon login: > > ``` > 2024-07-04T20:36:48Z ERRO management/server/jwtclaims/jwtValidator.go:160: error parsing token: unable to find appropriate key > 2024-07-04T20:36:48Z ERRO management/server/http/middleware/auth_middleware.go:88: Error when validating JWT claims: Error parsing token: unable to find appropriate key > 2024-07-04T20:36:48Z ERRO management/server/http/util/util.go:80: got a handler error: token invalid > 2024-07-04T20:36:48Z ERRO management/server/telemetry/http_api_metrics.go:181: HTTP response 4269949527: GET /api/users status 401 > ``` @identw you need to enable sign key refresh with `--idp-sign-key-refresh-enabled` ```yaml command: [ ... "--idp-sign-key-refresh-enabled", ``` After that run `docker compose up -d`
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@identw commented on GitHub (Jul 5, 2024):

@mlsmaycon Thank you very much. This helped me

@identw commented on GitHub (Jul 5, 2024): @mlsmaycon Thank you very much. This helped me
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@singhera-ilmiya commented on GitHub (Jul 5, 2024):

I'm still getting same issue please help me @mlsmaycon @identw

@singhera-ilmiya commented on GitHub (Jul 5, 2024): I'm still getting same issue please help me @mlsmaycon @identw
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@mlsmaycon commented on GitHub (Jul 5, 2024):

@singhera-ilmiya can you check your management logs for error logs and share them with us?

@mlsmaycon commented on GitHub (Jul 5, 2024): @singhera-ilmiya can you check your management logs for error logs and share them with us?
saavagebueno commented 2025-11-20 05:21:05 -05:00
Author
Owner
Copy Link

@bl0way commented on GitHub (Jul 6, 2024):

Regarding Keycloak, it is possible to use the original setup; however, you cannot provide netbird-client as the ID. Instead, you must use the generated GUID that Keycloak creates for each client ID.

You can find the GUID in the URL: https://keycloak.mysite.com/admin/master/console/#/{realm}/clients/{client-id}.

Alternatively, as @HansAschauer mentioned, you can generate access tokens and locate the client ID in the aud field. This client ID should then be used in the .env file.

Indeed, this worked for me. The previous proposed solution unfortunately was not working for me (keycloak didn't add the provided Included Custom Audience in the generated token for X or Y reasons). I modified the management.json to update the AuthAudience by the generated GUID of keycloak.

@bl0way commented on GitHub (Jul 6, 2024): > Regarding Keycloak, it is possible to use the original setup; however, you cannot provide `netbird-client` as the ID. Instead, you must use the generated GUID that Keycloak creates for each client ID. > > You can find the GUID in the URL: `https://keycloak.mysite.com/admin/master/console/#/{realm}/clients/{client-id}`. > > Alternatively, as @HansAschauer mentioned, you can generate access tokens and locate the client ID in the `aud` field. This client ID should then be used in the .env file. Indeed, this worked for me. The previous proposed solution unfortunately was not working for me (keycloak didn't add the provided `Included Custom Audience` in the generated token for X or Y reasons). I modified the `management.json` to update the `AuthAudience` by the generated GUID of keycloak.
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@adriangabura commented on GitHub (Jul 11, 2024):

Is it possible these 401 issues are related to this? I have triple checked my Azure config. There is no error on my part. And far too many identity providers cause similar symptoms.

@adriangabura commented on GitHub (Jul 11, 2024): Is it possible these 401 issues are related to [this](https://github.com/netbirdio/netbird/issues/1663#issuecomment-1981501378)? I have triple checked my Azure config. There is no error on my part. And far too many identity providers cause similar symptoms.
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@loso2255 commented on GitHub (Jul 20, 2024):

i think i found the same problem with zitadel

note: i'm using the latest version, docker stack

2024-07-20T18:04:13Z ERRO [requestID: 0c185520-9b12-49bc-bbb8-3589329c90d4, context: HTTP] management/server/http/util/util.go:81: got a handler error: token invalid
2024-07-20T18:04:13Z ERRO [context: HTTP, requestID: 0c185520-9b12-49bc-bbb8-3589329c90d4] management/server/telemetry/http_api_metrics.go:191: HTTP response 0c185520-9b12-49bc-bbb8-3589329c90d4: GET /api/users status 401
2024-07-20T18:04:30Z ERRO [context: HTTP, requestID: 70ea143e-a6f2-4963-ab18-e83d31a247e1] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: unable to get zitadel token, statusCode 400
@loso2255 commented on GitHub (Jul 20, 2024): i think i found the same problem with zitadel note: i'm using the latest version, docker stack ``` 2024-07-20T18:04:13Z ERRO [requestID: 0c185520-9b12-49bc-bbb8-3589329c90d4, context: HTTP] management/server/http/util/util.go:81: got a handler error: token invalid 2024-07-20T18:04:13Z ERRO [context: HTTP, requestID: 0c185520-9b12-49bc-bbb8-3589329c90d4] management/server/telemetry/http_api_metrics.go:191: HTTP response 0c185520-9b12-49bc-bbb8-3589329c90d4: GET /api/users status 401 2024-07-20T18:04:30Z ERRO [context: HTTP, requestID: 70ea143e-a6f2-4963-ab18-e83d31a247e1] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: unable to get zitadel token, statusCode 400 ```
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@mannp commented on GitHub (Jul 20, 2024):

For me it was resolved by changing the type of jwt signature being used.

@mannp commented on GitHub (Jul 20, 2024): For me it was resolved by changing the type of jwt signature being used.
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@maslyankov commented on GitHub (Aug 3, 2024):

For me this issue was fixed with this:
https://github.com/netbirdio/netbird/issues/2142#issuecomment-2182390323

Basically In keycloak I configured :

Client scopes > Client scope details > Mapper details
Move "netbird-client" from "Included Client Audience ()" to "Included Custom Audience" leaving "Included Client Audience ()" .

@maslyankov commented on GitHub (Aug 3, 2024): For me this issue was fixed with this: https://github.com/netbirdio/netbird/issues/2142#issuecomment-2182390323 Basically In keycloak I configured : Client scopes > Client scope details > Mapper details Move "netbird-client" from "Included Client Audience (*)" to "Included Custom Audience" leaving "Included Client Audience (*)" .
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@maze-st commented on GitHub (Oct 1, 2024):

Anyone found a solution with Zitadel?

@maze-st commented on GitHub (Oct 1, 2024): Anyone found a solution with Zitadel?
saavagebueno commented 2025-11-20 05:21:06 -05:00
Author
Owner
Copy Link

@dark-vex commented on GitHub (Nov 18, 2024):

@maze-st not sure if it could be the same issue for you but in my case the problem was due to ufw firewall.

Basically it was preventing netbird-management container to reach zitadel. Only during the reboot of the host netbird management container was able to reach zitatel (most likely because ufw was not yet started) but during the renewal of the token since ufw was blocking the connection, the token could not be renewed an causing the issue.

I didn't had the time to investigate further but I've ended-up in disabling ufw firewall and manually creating the firewall rules that I need with iptables.

@dark-vex commented on GitHub (Nov 18, 2024): @maze-st not sure if it could be the same issue for you but in my case the problem was due to ufw firewall. Basically it was preventing `netbird-management` container to reach `zitadel`. Only during the reboot of the host netbird management container was able to reach zitatel (most likely because ufw was not yet started) but during the renewal of the token since ufw was blocking the connection, the token could not be renewed an causing the issue. I didn't had the time to investigate further but I've ended-up in disabling ufw firewall and manually creating the firewall rules that I need with iptables.
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@PapaZigE commented on GitHub (Nov 18, 2024):

Anyone found a solution with Zitadel?

@maze-st, After updating, upgrading and restarting my server, I too was receiving the 401 "Invalid Token" & "Invalid Client" issue. Now, I'm not sure if my fix is applicable but I realized that my Service Account User in Zitadel was appended with the domain of my instance. This (I believe) is what broke the connection between the two. So I deleted the old SA User, followed the instructions to set it back up here: https://docs.netbird.io/selfhosted/identity-providers#zitadel and updated my management.json file in the following section:

    "IdpManagerConfig": {
        "ManagerType": "zitadel",
        "ClientConfig": {
            "Issuer": "https://auth.example.com",
            "TokenEndpoint": "https://auth.example.com/oauth/v2/token",
            "ClientID": "netbird",
            "ClientSecret": "NEW SECRET HERE",
            "GrantType": "client_credentials"
        },

After that, the issue went away, but so did all my data since I removed the volumes :(

I do think this was all because I clicked on check box in Domain Settings that says "Add organization domain as suffix to loginnames". I realized I didn't actually want that so I unchecked it but Zitadel didn't revert things back to normal hence recreating the SA User. Hopefully that's a fix for you! Luckly it didn't require reinstalling everything but just the SA User.

@PapaZigE commented on GitHub (Nov 18, 2024): > Anyone found a solution with Zitadel? @maze-st, After updating, upgrading and restarting my server, I too was receiving the 401 "Invalid Token" & "Invalid Client" issue. Now, I'm not sure if my fix is applicable but I realized that my Service Account User in Zitadel was appended with the domain of my instance. This (I believe) is what broke the connection between the two. So I deleted the old SA User, followed the instructions to set it back up here: [https://docs.netbird.io/selfhosted/identity-providers#zitadel](url) and updated my management.json file in the following section: ``` "IdpManagerConfig": { "ManagerType": "zitadel", "ClientConfig": { "Issuer": "https://auth.example.com", "TokenEndpoint": "https://auth.example.com/oauth/v2/token", "ClientID": "netbird", "ClientSecret": "NEW SECRET HERE", "GrantType": "client_credentials" }, ``` After that, the issue went away, but so did all my data since I removed the volumes :( I do think this was all because I clicked on check box in Domain Settings that says "Add organization domain as suffix to loginnames". I realized I didn't actually want that so I unchecked it but Zitadel didn't revert things back to normal hence recreating the SA User. Hopefully that's a fix for you! Luckly it didn't require reinstalling everything but just the SA User.
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@wbarnard81 commented on GitHub (Nov 22, 2024):

Netbird and Authentik here.
Updated to Authentik 2024.10.4 this morning and now I am faced with the same error.

2024-11-22T14:04:04Z ERRO [context: HTTP, requestID: 0b96d0df-5391-4083-b654-554e28c5cf10] management/server/http/util/util.go:81: got a handler error: token invalid
2024-11-22T14:04:04Z ERRO [context: HTTP, requestID: 0b96d0df-5391-4083-b654-554e28c5cf10] management/server/telemetry/http_api_metrics.go:168: HTTP response 0b96d0df-5391-4083-b654-554e28c5cf10: GET /api/users status 401
@wbarnard81 commented on GitHub (Nov 22, 2024): Netbird and Authentik here. Updated to Authentik 2024.10.4 this morning and now I am faced with the same error. ``` 2024-11-22T14:04:04Z ERRO [context: HTTP, requestID: 0b96d0df-5391-4083-b654-554e28c5cf10] management/server/http/util/util.go:81: got a handler error: token invalid 2024-11-22T14:04:04Z ERRO [context: HTTP, requestID: 0b96d0df-5391-4083-b654-554e28c5cf10] management/server/telemetry/http_api_metrics.go:168: HTTP response 0b96d0df-5391-4083-b654-554e28c5cf10: GET /api/users status 401 ```
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@Hutch79 commented on GitHub (Nov 26, 2024):

I also use Authentik and get the same error as @wbarnard81

2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: unable to get authentik token, statusCode 400
2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/http/util/util.go:81: got a handler error: token invalid
2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/telemetry/http_api_metrics.go:168: HTTP response 43acbdb4-54b0-4d2d-8565-1223af2e2bc7: GET /api/users status 401

I already needed to change the redirect uri since the UI changed.
image
It works with regex, but NOT with strict (which seams to be the default).

After that everything worked agains untill i updated netbird.
Unfortunatelly i don't know my old Netbird version.

@Hutch79 commented on GitHub (Nov 26, 2024): I also use Authentik and get the same error as @wbarnard81 ``` 2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/http/middleware/auth_middleware.go:89: Error when validating JWT claims: unable to get authentik token, statusCode 400 2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/http/util/util.go:81: got a handler error: token invalid 2024-11-26T12:01:46Z ERRO [context: HTTP, requestID: 43acbdb4-54b0-4d2d-8565-1223af2e2bc7] management/server/telemetry/http_api_metrics.go:168: HTTP response 43acbdb4-54b0-4d2d-8565-1223af2e2bc7: GET /api/users status 401 ```` I already needed to change the redirect uri since the UI changed. ![image](https://github.com/user-attachments/assets/90fc7c74-15c7-476a-aeb1-7d3f6a179717) It works with regex, but NOT with strict (which seams to be the default). After that everything worked agains untill i updated netbird. Unfortunatelly i don't know my old Netbird version.
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@wbarnard81 commented on GitHub (Nov 26, 2024):

@Hutch79 Check here, it helped me solve the problem.

@wbarnard81 commented on GitHub (Nov 26, 2024): @Hutch79 Check [here](https://github.com/netbirdio/netbird/issues/2338#issuecomment-2496916851), it helped me solve the problem.
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@Hutch79 commented on GitHub (Nov 26, 2024):

@Hutch79 Check here, it helped me solve the problem.

Thanks for the link @wbarnard81 !
Unfortunately, adding the API to scopes did not solve it for me...

@Hutch79 commented on GitHub (Nov 26, 2024): > @Hutch79 Check [here](https://github.com/netbirdio/netbird/issues/2338#issuecomment-2496916851), it helped me solve the problem. Thanks for the link @wbarnard81 ! Unfortunately, adding the API to scopes did not solve it for me...
saavagebueno commented 2025-11-20 05:21:07 -05:00
Author
Owner
Copy Link

@ne0YT commented on GitHub (Dec 16, 2024):

this fixed it for me (1st part):

https://github.com/netbirdio/netbird/issues/1657#issuecomment-2127732511

@ne0YT commented on GitHub (Dec 16, 2024): this fixed it for me (1st part): https://github.com/netbirdio/netbird/issues/1657#issuecomment-2127732511
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@krawiec commented on GitHub (Mar 23, 2025):

OMG i was struggling with this token issue for past 2 days
but i am using authentik, not keykloak
finally i figured there is issue with provider configuration
in documentation there is no mention about mappings, at all

so default ones are

authentik default OAuth Mapping: OpenID 'email'
authentik default OAuth Mapping: OpenID 'openid'
authentik default OAuth Mapping: OpenID 'profile'

i also added those two and suddenly everything started to work as expected

authentik default OAuth Mapping: OpenID 'offline_access'
authentik default OAuth Mapping: authentik API access

Please update documentation

@krawiec commented on GitHub (Mar 23, 2025): OMG i was struggling with this token issue for past 2 days but i am using authentik, not keykloak finally i figured there is issue with provider configuration in documentation there is no mention about mappings, at all so default ones are authentik default OAuth Mapping: OpenID 'email' authentik default OAuth Mapping: OpenID 'openid' authentik default OAuth Mapping: OpenID 'profile' i also added those two and suddenly everything started to work as expected authentik default OAuth Mapping: OpenID 'offline_access' authentik default OAuth Mapping: authentik API access Please update documentation
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@HammyHavoc commented on GitHub (May 27, 2025):

Still seeing this problem after adding authentik default OAuth Mapping: OpenID 'offline_access' and authentik default OAuth Mapping: authentik API access.

Was working great until it wasn't. The tunnel is still running as I can connect to it via the Android phone app, but can't seem to sign into the web dashboard. Switching from strict to regex fixed the Redirect URI Error. The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri). problem I was seeing on Authentik, but now I'm stuck on getting a Request failed with status code 401. Error: Token invalid error when attempting to access the web dashboard after authenticating via Authentik.

@HammyHavoc commented on GitHub (May 27, 2025): Still seeing this problem after adding `authentik default OAuth Mapping: OpenID 'offline_access'` and `authentik default OAuth Mapping: authentik API access`. Was working great until it wasn't. The tunnel is still running as I can connect to it via the Android phone app, but can't seem to sign into the web dashboard. Switching from `strict` to `regex` fixed the `Redirect URI Error. The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).` problem I was seeing on Authentik, but now I'm stuck on getting a `Request failed with status code 401. Error: Token invalid` error when attempting to access the web dashboard after authenticating via Authentik.
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@HammyHavoc commented on GitHub (May 28, 2025):

11h of troubleshooting later. Heh!

Silliest thing in the world. The management.json has the following:

"ExtraConfig": {
            "Password":

Essentially, don't put the NetBird service account login password in there that you set when creating the service account. Set an app password (service-account-netbird-password) in Authentik for the service account then add that to your config and give the container stack a restart. Boom. Back up and running now! :- ) Chuffed.

@HammyHavoc commented on GitHub (May 28, 2025): 11h of troubleshooting later. Heh! Silliest thing in the world. The `management.json` has the following: ``` "ExtraConfig": { "Password": ``` Essentially, don't put the NetBird service account login password in there that you set when creating the service account. Set an app password (`service-account-netbird-password`) in Authentik for the service account then add that to your config and give the container stack a restart. Boom. Back up and running now! :- ) Chuffed.
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@darwinmktech commented on GitHub (Jun 2, 2025):

Hi guys, for the token authencation issues for the zitadel, here's how i solve it without delete the volume and restart back.

Problem Description:
After enabling "Add organization domain as suffix to loginnames" in Zitadel, NetBird shows:

❌ 401 Unauthorized
❌ client not found
❌ token invalid

Root Cause:
The setting changes service account username from netbird-service-account to netbird-service-account@yourdomain.com, breaking the connection.

🛠️ Solution Steps:
Step 1: Generate New Client Credentials in Zitadel

Access Zitadel Console: https://your-netbird-domain.com/ui/console

Navigate to: Users → Service Accounts

Find your NetBird service account (likely named netbird-service-account@yourdomain.com)

Go to: Action -> Generate new Client Secret

Copy the new credentials:
ClientID: netbird-service-account@yourdomain.com
ClientSecret: [generated-secret]

Step 2: Update NetBird Management Configuration
cd /path/to/netbird

find . -name "management.json" -o -name "*.json" | xargs grep -l "ClientID"

nano management.json

Update the configuration:

{
"IdpManagerConfig": {
"ManagerType": "zitadel",
"ClientConfig": {
"Issuer": "https://your-netbird-domain.com",
"TokenEndpoint": "https://your-netbird-domain.com/oauth/v2/token",
"ClientID": "netbird-service-account@yourdomain.com", -- this part change with your new client id
"ClientSecret": "YOUR-NEW-CLIENT-SECRET-HERE", -- same goes to here
"GrantType": "client_credentials"
}
}
}

management.json

Step 3: Restart NetBird Services
docker-compose restart management

docker-compose restart dashboard

Step 4: Clear Cache & Test

Clear Cloudflare cache (if using Cloudflare)

Clear browser cookies for your NetBird domain

Test access: https://your-netbird-domain.com
🔍 Verification:
Check logs for success:

docker-compose logs management | tail -10

Copy
Should see: ✅ management server version X.X.X ✅ warmed up IDP cache with X entries ✅ No 401 or "client not found" errors

⚠️ Prevention:
To avoid this issue:

Don't enable "Add organization domain as suffix to loginnames" unless you have multiple organizations
If you must enable it, update NetBird config immediately after.

🆘 Alternative: Fresh Setup
If the above doesn't work:

docker-compose down
docker volume rm $(docker volume ls -q | grep netbird)
./setup.sh # Re-run initial setup

Note: This will reset all NetBird data.

This solution worked for: NetBird v0.45.2 + Zitadel Tested on: Ubuntu 22.04, Docker Compose

Hope this helps the community! 🚀

@darwinmktech commented on GitHub (Jun 2, 2025): Hi guys, for the token authencation issues for the zitadel, here's how i solve it without delete the volume and restart back. Problem Description: After enabling "Add organization domain as suffix to loginnames" in Zitadel, NetBird shows: ❌ 401 Unauthorized ❌ client not found ❌ token invalid Root Cause: The setting changes service account username from netbird-service-account to netbird-service-account@yourdomain.com, breaking the connection. 🛠️ Solution Steps: Step 1: Generate New Client Credentials in Zitadel Access Zitadel Console: https://your-netbird-domain.com/ui/console Navigate to: Users → Service Accounts Find your NetBird service account (likely named netbird-service-account@yourdomain.com) Go to: Action -> Generate new Client Secret Copy the new credentials: ClientID: netbird-service-account@yourdomain.com ClientSecret: [generated-secret] Step 2: Update NetBird Management Configuration cd /path/to/netbird find . -name "management.json" -o -name "*.json" | xargs grep -l "ClientID" nano management.json Update the configuration: { "IdpManagerConfig": { "ManagerType": "zitadel", "ClientConfig": { "Issuer": "https://your-netbird-domain.com", "TokenEndpoint": "https://your-netbird-domain.com/oauth/v2/token", "ClientID": "netbird-service-account@yourdomain.com", -- this part change with your new client id "ClientSecret": "YOUR-NEW-CLIENT-SECRET-HERE", -- same goes to here "GrantType": "client_credentials" } } } management.json Step 3: Restart NetBird Services docker-compose restart management docker-compose restart dashboard Step 4: Clear Cache & Test Clear Cloudflare cache (if using Cloudflare) Clear browser cookies for your NetBird domain Test access: https://your-netbird-domain.com 🔍 Verification: Check logs for success: docker-compose logs management | tail -10 Copy Should see: ✅ management server version X.X.X ✅ warmed up IDP cache with X entries ✅ No 401 or "client not found" errors ⚠️ Prevention: To avoid this issue: Don't enable "Add organization domain as suffix to loginnames" unless you have multiple organizations If you must enable it, update NetBird config immediately after. 🆘 Alternative: Fresh Setup If the above doesn't work: docker-compose down docker volume rm $(docker volume ls -q | grep netbird) ./setup.sh # Re-run initial setup Note: This will reset all NetBird data. This solution worked for: NetBird v0.45.2 + Zitadel Tested on: Ubuntu 22.04, Docker Compose Hope this helps the community! 🚀
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@hanfelt commented on GitHub (Aug 28, 2025):

Don't forget to add the User Netbird to the Application as well

Image
@hanfelt commented on GitHub (Aug 28, 2025): Don't forget to add the User Netbird to the Application as well <img width="1342" height="1026" alt="Image" src="https://github.com/user-attachments/assets/b2945e5f-a8f6-4e64-a210-c764b4331ba7" />
saavagebueno commented 2025-11-20 05:21:08 -05:00
Author
Owner
Copy Link

@wbarnard81 commented on GitHub (Nov 19, 2025):

We use Authentik and Netbird. Updated to the latest version this morning and now I am getting this again...

management-1  | 2025-11-19T05:46:39Z ERRO [context: HTTP, requestID: cdec7c46-ceb9-41f7-aaa4-496e53aa4519] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400
management-1  | 2025-11-19T05:46:39Z ERRO [context: HTTP, requestID: cdec7c46-ceb9-41f7-aaa4-496e53aa4519] shared/management/http/util/util.go:85: got a handler error: token invalid```

Previously the fix for me was changing Redirect URIs/Origins from Strick to Regex, but this time even changing it back is not helping.

None of these has worked for me thus far:
https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043
https://github.com/netbirdio/netbird/issues/2142#issuecomment-2915471588
https://github.com/netbirdio/netbird/issues/2142#issuecomment-3233355002
@wbarnard81 commented on GitHub (Nov 19, 2025): We use Authentik and Netbird. Updated to the latest version this morning and now I am getting this again... ```management-1 | 2025-11-19T05:46:38Z ERRO [context: HTTP, requestID: 9c841899-efec-4c73-b7e5-cfb1aaf3c022] management/server/telemetry/http_api_metrics.go:189: HTTP response 9c841899-efec-4c73-b7e5-cfb1aaf3c022: GET /api/users status 401 management-1 | 2025-11-19T05:46:39Z ERRO [context: HTTP, requestID: cdec7c46-ceb9-41f7-aaa4-496e53aa4519] management/server/http/middleware/auth_middleware.go:78: Error when validating JWT: unable to get authentik token, statusCode 400 management-1 | 2025-11-19T05:46:39Z ERRO [context: HTTP, requestID: cdec7c46-ceb9-41f7-aaa4-496e53aa4519] shared/management/http/util/util.go:85: got a handler error: token invalid``` Previously the fix for me was changing Redirect URIs/Origins from Strick to Regex, but this time even changing it back is not helping. None of these has worked for me thus far: https://github.com/netbirdio/netbird/issues/2142#issuecomment-2209552043 https://github.com/netbirdio/netbird/issues/2142#issuecomment-2915471588 https://github.com/netbirdio/netbird/issues/2142#issuecomment-3233355002
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
2021 Q4
2022 Q1
2022 Q1
accessibility
acl
agent
agent
Android
Android
api
authentik
automation
azure
battery-usage
bug
cache
client
client-ui
cloud
cloud-only
cloudflare
community
compatibility
config-idp
config-issue
connection
contribution
coturn
cross-vpn
dashboard
data-usage
distribution
dns
docker
documentation
duplicate
enhancement
enhancement
event-stream
feature-request
freebsd
getting-started
go
good first issue
gui
help wanted
home-assistant
idp
inconsistency
integration
integrations
ios
ipv6
jwt
k8s
keycloak
linux
login
macos
management-service
missing-docs
mobile
moved-internal
needs-review
netbird-ui
networking
new-platform
nginx
notification
okta
openwrt
packaging
peer-management
peer-management
peer-management
performance
postgres
posture-checks
psk
pull-request
Mirrored from GitHub Pull Request
 question
refactor
relay
release
rfc
routes
security
security-related
self-hosting
server
signal
sleep-issue
ssh
ssl
status
store
synology
system-compatibility-issue
test-suite
third-party-integration
triage
triage-needed
troubleshooting
UX
waiting-feedback
windows
wontfix
zitadel
No Label idp self-hosting
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
saavagebueno
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: SVI/netbird#986
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?