mirror of
https://github.com/pocket-id/pocket-id.git
synced 2025-12-06 09:13:19 +03:00
🐛 Bug Report: OIDC with FreshRSS not working #492
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @bart268 on GitHub.
Reproduction steps
I try to login to FreshRSS with pocket-id. My current setup is authentik but I am trying to move to pocket-id.
Authentik is working fine but as soon as I configure pocket-id I am unable to login.
Steps:
FreshRSS logs shows this error:
[auth_openidc:error] [pid 55] [client x.x.x.x:0] oidc_proto_validate_code_response: requested flow is "code" but no "token_type" parameter found in the code response, referer: https://pocket-id.domain/
[auth_openidc:error] [pid 55] [client x.x.x.x:0] oidc_proto_resolve_code_and_validate_response: code response validation failed, referer: https://pocket-id.domain/
Client browser shows this error:
oidc_proto_resolve_code_and_validate_response: code response validation failed
FreshRSS OIDC config:
OIDC_ENABLED=1
OIDC_PROVIDER_METADATA_URL=https://pocket-id.domain/.well-known/openid-configuration
OIDC_CLIENT_ID=xxx
OIDC_CLIENT_SECRET=xxx
OIDC_X_FORWARDED_HEADERS=X-Forwarded-Proto
OIDC_SCOPES=openid email profile
Expected behavior
Client should be able to login using pocket-id and be redirected/authenticated in to freshrss.
Actual Behavior
Client browser shows "oidc_proto_resolve_code_and_validate_response: code response validation failed" after being authenticated in pocket-id.
@bart268 commented on GitHub:
Awesome, it's fixed!
@stonith404 commented on GitHub:
Thanks for your report. Would you mind to test it again with the
stonith404/pocket-id:developmentimage? I might have fixed it.@stonith404 commented on GitHub:
Great :) You can switch back to the normal image as soon as I've created the release.