mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-09 14:42:59 +03:00
Portainer Unauthorized #487
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @javijuji on GitHub.
Reproduction steps
I've done initial setup and can log into pocket-id. After setting up portainer behind reverse proxy and setting up OAuth I keep getting unauthorized during login
OAuth Configuration
Client ID **************************
Client secret ************************
Authorization URL: https://auth.mydomain.xyz/authorize
Access token URL: https://auth.mydomain.xyz/api/oidc/token
Resource URL: https://auth.mydomain.xyz/api/oidc/userinfo
Redirect URL: https://portsyno.mydomain.xyz/
Logout URL: https://auth.mydomain.xyz/application/o/pgadmin/end-session/
User identifier: email
Scopes: openid profile email groups
Auth Style: Auto Detect
Callback URL: https://portsyno.mydomain.xyz/
Additional information:
Configured automatic user provisioning but not seeing any users imported into portainer. Tested turning off and created a user with matching username/email with the one in pocket-id. Same result.
Team membership is set to Off.
Also tried Enabling automatic user provisioning. Same result
Expected behavior
Should authorize correctly.
Actual Behavior
Unauthorized. Redirects seem to work correctly though.
@alec-hs commented on GitHub:
I have double checked the client secret and rotated it to make sure.
Portainer Logs:
PocketID Logs:
@stonith404 commented on GitHub:
@alec-hs Are you really sure that the client secret is valid because this error only gets thrown if the client secret doesn't match the one saved in the database:
I've added a line in the
stonith404/pocket-id:developmentimage that prints the received client secret. Could you run the image and check if the received client secret is correct and doesn't contain any whitespaces?@stonith404 commented on GitHub:
Thanks for reporting but I can't reproduce this. Can you enable the debug logs of Portainer (e.g
docker run -d -p 8000:8000 -p 9443:9443 -v /var/run/docker.sock:/var/run/docker.sock portainer/portainer-ce --log-level=DEBUG) and share the logs of Pocket ID and Portainer?My configuration looks like this:
@stonith404 commented on GitHub:
Any updates?
@alec-hs commented on GitHub:
I can confirm I have this same issue - will get the logs as requested above for a second source for you to look at.
@javijuji commented on GitHub:
Thank you both for following through on this. Sorry for not replying earlier. I decided to regenerate the secret and doublecheck the callback URL and it is working correctly now.
@UncleArya commented on GitHub:
Hey @alec-hs sorry for the random reply on a closed issue, but I have come across the same issue getting Pocket-ID working with Portainer the same way as you. Are you able to remember what you needed to change with your Portainer instance to get it working with Pocket-ID? Thanks!
@alec-hs commented on GitHub:
Sure, will give this a go later today. I'm hoping it is just me missing something but this is the only app that I'm using Pocket ID with that is having the issue.
@javijuji commented on GitHub:
I believe the issue to be that making changes to the OAuth settings on portainer and saving will save a blank client secret. I did a few more changes and ended up breaking it a couple more times until I realized that I had to enter the Client Secret again before hitting Save settings (Which meant generating a new one since I am not writing those down!)
@alec-hs commented on GitHub:
So the development branch helped since it showed that it was passing a secret but it was a completely different format to what would have been expected. I spun up a new test instance of Portainer and it worked fine there. Looks to be an issue with my Portainer instance. Can close this issue now.