Third-Party Login Failure via Authentik OIDC

[Eldiabolo21]

I've configured Authentik as OIDC provider. I'm fairly new to this whole SSO business, so I won't rule out its my fault.

What I've done:

• Deployment in K8s via Helm chart, latest app version 1.4.1
• External Postgres (CNPG)
• Authentik as SSO.
• Configure an Application and Provider in Authentik
• Map Required Options from HERE into the container via external secret. ENV vars are available when checking in the container
• Button for login appears inpdfding
• I can click the button, i'm being redirect to Authentik, and after that also returned to pdfding. However i'm shown ''Third-Party Login Failure
  An error occurred while attempting to login via your third-party account."

I did some googling, I checked all values three times. Unfortunately pdfding container logs are very sparse to nonexisitent, which is why i opened #224

I checked the authentik logs, that seems to be in order, there dont seem to be any problems afaik.

Any ideas how to debug or even fix this?

[mrmn2]

Hi, as written in #224 my hands are bound on OIDC related log problems. Can you provide me with a sample of your PdfDing OIDC config and the Authentik config. You can of course redact any confidential values.

And just to double check, there is nothing written inside PdfDing's logs at all? Third-Party Login Failure An error occurred while attempting to login via your third-party account. is shown inside the browser?

[Eldiabolo21]

thanks for the help!
Exactly, the message is from the browser, not the container log.

This is the Secret with the vars:

apiVersion: v1
kind: Secret
metadata:
  name: pdfding-secrets
type: Opaque
data:
  POSTGRES_PASSWORD: '<redacted>'
  SECRET_KEY: '<redacted>'
  OIDC_ENABLE: 'VFJVRQ=='
  OIDC_CLIENT_ID: '<redacted>'
  OIDC_CLIENT_SECRET: '<redacted>'
  OIDC_AUTH_URL: '<redacted>'
  OIDC_PROVIDER_NAME: 'QXV0aGVudGlr'
  OIDC_ADMIN_GROUP: 'aW5mcmEtYWRtaW4='

This is the section from the values.yaml

    oidc:
      # -- enables OIDC
      enabled: true
      ## -- PdfDing's OIDC client id.
      clientId: "qs2adchhmA8QdnwVngc4vFtZwTBp0aTgZnxoiz3s"
      ## -- PdfDing's OIDC client secret. Should be a large random value!
      ## -- Note: clientSecret will be overridden if existingSecret is set!
      # clientSecret: "some_secret"
      ## -- The URL to the OpenID configuration of the auth server.
      authUrl: "https://auth.example.com/application/o/pfding/.well-known/openid-configuration"
      ## -- Enable OIDC only authentication
      oidc_only:
        enabled: false
      ## -- The name of the OIDC provider. The name will be displayed on the login screen as
      ## -- `OIDC_LOG IN VIA <PROVIDER_NAME>`.
      providerName: "Authentik"

I'm not sure whats useful from the authentik side, so i uploaded the provider and the example JWT Data.

[mrmn2]

I don't think this will be the issue, but let's just to be sure. I would suggest only setting confidential env variables in the secret. Otherwise you'll have duplicate data in the secret and configmap:

apiVersion: v1
kind: Secret
metadata:
  name: pdfding-secrets
type: Opaque
data:
  POSTGRES_PASSWORD: '<redacted>'
  SECRET_KEY: '<redacted>'
  OIDC_CLIENT_SECRET: '<redacted>'

One could argue that OIDC_CLIENT_ID also belongs to the secret.

Can you verify that you https://auth.example.com/application/o/pfding/.well-known/openid-configuration exists?