mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-06 09:09:38 +03:00
[Authentik OIDC] Missing 'keys' configuration #5111
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @kmccmk9 on GitHub (Jan 8, 2025).
Describe the Bug
I've been getting Authentik OpenID configuration setup and I keep getting the following error when trying to authenticate.
production.ERROR: Missing required configuration "keys" value {"exception":"[object] (InvalidArgumentException(code: 0): Missing required configuration \"keys\" value at /app/www/app/Access/Oidc/OidcProviderSettings.php:80)I'm not sure what keys it is looking for. I think it is referring to the jwks keys? But either way I have verified that the Issuer URL is reachable and that it contains the expected response. I also verified the jwks URL is valid and contains the expected response of "keys". From the code I believe it is supposed to run the loadSettingsFromIssuerDiscovery function which looks for the jwks_uri in the response from the issuer request. That all should be working from what I can tell when I verify in my browser. I also verified both the openid configuration url, and the jwks uri are resolvable and return response from within the docker container itself. Therfore I do not believe this is related to the container setup itself.
Steps to Reproduce
Deploy a docker setup with the following configuration:
image: linuxserver/bookstack:24.10.3additional env vars related to OIDC:
Expected Behaviour
Expected behavior is a successful login when the user matches or at least a logged error about why keys is empty/missing if there was an error retrieving it.
Screenshots or Additional Context
Stack Trace in logs:
Browser Details
Exact BookStack Version
linuxserver:24.10.3
@ssddanbrown commented on GitHub (Jan 9, 2025):
This could happen if the Auth system is not providing any RS256 singing keys in the response from the jwks_uri.
@kmccmk9 commented on GitHub (Jan 9, 2025):
Yes that was exactly it! I overlooked that in the requirements section. That or it was not required and after one of the updates, it was indeed required. Thank you again. Long term feature for this might be a more verbose logging output. Something like "Server did not respond with RS256 key". Just to aid troubleshooting in the future.