peertube-plugin-auth-openid-connect: Using Authentik - no access token provided
Describe the current behavior
After setting up oidc authentication with the auth-openid-connect
plugin version 0.1.0
with Authentik as provider I get the following error:
[tube.koyax.org:443] 2022-07-04 11:44:55.098 debug: Checking getPluginValidator parameters {
"parameters": {
"pluginName": "auth-openid-connect",
"pluginVersion": "0.1.0",
"authName": "openid-connect"
}
}
[tube.koyax.org:443] 2022-07-04 11:44:55.099 debug: Checking getExternalAuthValidator parameters {
"parameters": {
"pluginName": "auth-openid-connect",
"pluginVersion": "0.1.0",
"authName": "openid-connect"
}
}
[tube.koyax.org:443] 2022-07-04 11:44:55.099 debug: Forwarding auth plugin request in openid-connect of plugin peertube-plugin-auth-openid-connect.
[tube.koyax.org:443] 2022-07-04 11:44:55.102 info: 2a02:: - - [04/Jul/2022:11:44:55 +0000] "GET /plugins/auth-openid-connect/0.1.0/auth/openid-connect HTTP/1.0" 302 908 "https://tube.koyax.org/login?externalAuthError=true" "Firefox"
[tube.koyax.org:443] 2022-07-04 11:44:56.548 debug: Checking getPluginValidator parameters {
"parameters": {
"pluginName": "auth-openid-connect"
}
}
[tube.koyax.org:443 peertube-plugin-auth-openid-connect] 2022-07-04 11:44:56.549 error: Error in handle callback. {
"err": {
"stack": "TypeError: no access token provided\n at Client.requestResource (/data/plugins/node_modules/openid-client/lib/client.js:1143:13)\n at Client.userinfo (/data/plugins/node_modules/openid-client/lib/client.js:1255:33)\n at handleCb (/data/plugins/node_modules/peertube-plugin-auth-openid-connect/main.js:276:41)\n at runMicrotasks (<anonymous>)\n at processTicksAndRejections (node:internal/process/task_queues:96:5)",
"message": "no access token provided"
}
}
[tube.koyax.org:443] 2022-07-04 11:44:56.551 info: 2a02:: - - [04/Jul/2022:11:44:56 +0000] "POST /plugins/auth-openid-connect/router/code-cb HTTP/1.0" 302 102 "-" "Firefox"
[tube.koyax.org:443] 2022-07-04 11:44:56.581 debug: Serving de-DE HTML language {
"paramLang": "login",
"acceptLanguage": "de,en-GB;q=0.8,en-US;q=0.5,en;q=0.3"
}
[tube.koyax.org:443] 2022-07-04 11:44:56.583 info: 2a02:: - - [04/Jul/2022:11:44:56 +0000] "GET /login?externalAuthError=true HTTP/1.0" 200 12046 "-" "Firefox"
[tube.koyax.org:443] 2022-07-04 11:44:56.732 debug: Executed SQL request - Executing (default): SELECT "id", "clientId", "clientSecret", "grants", "redirectUris", "createdAt", "updatedAt" FROM "oAuthClient" AS "OAuthClientModel" LIMIT 1;
[tube.koyax.org:443] 2022-07-04 11:44:56.736 info: 2a02:: - - [04/Jul/2022:11:44:56 +0000] "GET /api/v1/oauth-clients/local HTTP/1.0" 304 - "https://tube.koyax.org/login?externalAuthError=true" "Firefox"
[tube.koyax.org:443] 2022-07-04 11:44:56.743 info: 2a02:: - - [04/Jul/2022:11:44:56 +0000] "GET /api/v1/config/ HTTP/1.0" 304 - "https://tube.koyax.org/login?externalAuthError=true" "Firefox"
[tube.koyax.org:443] 2022-07-04 11:44:56.812 info: 2a02:: - - [04/Jul/2022:11:44:56 +0000] "GET /api/v1/videos/languages HTTP/1.0" 304 - "https://tube.koyax.org/login?externalAuthError=true" "Firefox"
Steps to reproduce
- Install Peertube and Authentik
- Create a oidc provider in Authentik and configure it
auth-openid-connect
- Try to log in via open id
Describe the expected behavior
Login succeeds.
Additional information
-
PeerTube instance:
- URL: https://tube.koyax.org
- Version: 4.2.2-bullseye
- Dockerized
-
Nginx Reverse Proxy
- Default reverse Proxy settings from peertube documentation without performance tuning
-
Browser name, version and platforms on which you could reproduce the bug: Firefox, Chrome, Edge, Gnome Web
Nginx access log:
2a02:XXXX - - [04/Jul/2022:13:44:55 +0200] "GET /plugins/auth-openid-connect/0.1.0/auth/openid-connect HTTP/2.0" 302 908 "https://tube.koyax.org/login?externalAuthError=true" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
2a02:XXXX - - [04/Jul/2022:13:44:56 +0200] "POST /plugins/auth-openid-connect/router/code-cb HTTP/2.0" 302 102 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
2a02:XXXX - - [04/Jul/2022:13:44:56 +0200] "GET /login?externalAuthError=true HTTP/2.0" 200 4950 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
2a02:XXXX - - [04/Jul/2022:13:44:56 +0200] "GET /api/v1/oauth-clients/local HTTP/2.0" 304 0 "https://tube.koyax.org/login?externalAuthError=true" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
2a02:XXXX - - [04/Jul/2022:13:44:56 +0200] "GET /api/v1/config/ HTTP/2.0" 304 0 "https://tube.koyax.org/login?externalAuthError=true" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
2a02:XXXX - - [04/Jul/2022:13:44:56 +0200] "GET /api/v1/videos/languages HTTP/2.0" 304 0 "https://tube.koyax.org/login?externalAuthError=true" "Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0"
Authentik Trace Logs Please pm me. I'm happy to share, but would rather not post them public.
Edited by Lars Buddenberg