Peertube OIDC issue

[cyberb]

I am trying to configure Peertube OIDC plugin with authelia but getting this error after the successful login to authelia and failed login to peertube (failed to call api/oidc/token).

error message: The provided client secret did not match the registered client secret

error log

authelia: time="2024-05-12T13:24:24Z" level=debug msg="Authorization Request with id '3cd68c49-c7e1-4502-a734-f7965c986bc7' on client with id 'peertube' was successfully processed, proceeding to build Authorization Response" caller="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:135 OpenIDConnectAuthorization" method=GET path=/api/oidc/authorization remote_ip="2a0d:3344:119:2400:3825:3fdb:bf55:7677"
authelia: time="2024-05-12T13:24:24Z" level=trace msg="Authorization Request with id '3cd68c49-c7e1-4502-a734-f7965c986bc7' on client with id 'peertube' creating session for Authorization Response for subject '40516998-641c-4d11-8610-9a75557cbaf6' with username 'test' with claims: &{JTI: Issuer:https://auth.[domain] Subject:40516998-641c-4d11-8610-9a75557cbaf6 Audience:[] Nonce: ExpiresAt:0001-01-01 00:00:00 +0000 UTC IssuedAt:2024-05-12 13:24:24.824162652 +0000 UTC RequestedAt:2024-05-12 13:24:21.552407983 +0000 UTC AuthTime:2024-05-12 13:24:20 +0000 UTC AccessTokenHash: AuthenticationContextClassReference: AuthenticationMethodsReferences:[pwd] CodeHash: StateHash: Extra:map[azp:peertube client_id:peertube email:test@[domain] email_verified:true name:test preferred_username:test]}" caller="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:139 OpenIDConnectAuthorization" method=GET path=/api/oidc/authorization remote_ip="2a0d:3344:119:2400:3825:3fdb:bf55:7677"
authelia: time="2024-05-12T13:24:24Z" level=trace msg="Authorization Request is using the following request parameters" aud="[]" caller="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_authorization.go:142 OpenIDConnectAuthorization" id=3cd68c49-c7e1-4502-a734-f7965c986bc7 method=GET path=/api/oidc/authorization redirect_uri="https://peertube.[domain]/plugins/auth-openid-connect/router/code-cb" remote_ip="2a0d:3344:119:2400:3825:3fdb:bf55:7677" response_mode=form_post response_type="[code]" scope="[openid email profile]" state=sDDwAR-MfJbv8WX6c1B1GOZtHVwNmBZWXwhqYWFQJkg
authelia: time="2024-05-12T13:24:24Z" level=trace msg="Replied (status=200)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handleRouter.LogRequest.func40" method=GET path=/api/oidc/authorization remote_ip="2a0d:3344:119:2400:3825:3fdb:bf55:7677"
nginx: syncloud nginx: 2a0d:3344:119:2400:3825:3fdb:bf55:7677 - - [12/May/2024:13:24:24 +0000] "GET /api/oidc/authorization?client_id=peertube&code_challenge=946hmpWaE2epODgoDXtoqKTC5G4wUaefEfqM6Bd4Ljc&code_challenge_method=S256&consent_id=80b00440-057c-4232-8d12-b0d1180c379d&redirect_uri=https%3A%2F%2Fpeertube.[domain]%2Fplugins%2Fauth-openid-connect%2Frouter%2Fcode-cb&response_mode=form_post&response_type=code&scope=openid+email+profile&state=sDDwAR-MfJbv8WX6c1B1GOZtHVwNmBZWXwhqYWFQJkg HTTP/2.0" 200 788 "https://auth.[domain]/consent?id=80b00440-057c-4232-8d12-b0d1180c379d" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0"
authelia: time="2024-05-12T13:24:25Z" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handleRouter.LogRequest.func40" method=POST path=/api/oidc/token remote_ip="2a0d:3344:119:2400:21e:6ff:fe49:169e"
authelia: time="2024-05-12T13:24:25Z" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret." caller="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go:25 OpenIDConnectTokenPOST" method=POST path=/api/oidc/token remote_ip="2a0d:3344:119:2400:21e:6ff:fe49:169e" stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go:25                   OpenIDConnectTokenPOST\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:114 handleRouter.NewHTTPToAutheliaHandlerAdaptor.func25\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54                            handleRouter.(*BridgeBuilder).Build.func16.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:91                           SecurityHeadersNoStore.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:75                           SecurityHeadersCSPNoneOpenIDConnect.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:30                           SecurityHeadersBase.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216                             handleRouter.(*CORSPolicy).Middleware.func26\ngithub.com/fasthttp/router@v1.5.0/router.go:441                                              (*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14                       handleRouter.LogRequest.func40\ngithub.com/authelia/authelia/v4/internal/middlewares/errors.go:38                            RecoverPanic.func1\ngithub.com/valyala/fasthttp@v1.52.0/server.go:2374                                           (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:224                                        (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:196                                        (*workerPool).getCh.func1\nruntime/asm_arm64.s:1222                                                                     goexit"
authelia: time="2024-05-12T13:24:25Z" level=trace msg="Replied (status=401)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handleRouter.LogRequest.func40" method=POST path=/api/oidc/token remote_ip="2a0d:3344:119:2400:21e:6ff:fe49:169e"
peertube: [peertube.[domain]:443 peertube-plugin-auth-openid-connect] 2024-05-12 13:24:25.018 error: Error in handle callback. {
peertube:   "err": {
peertube:     "stack": "OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)\n    at processResponse (/var/snap/peertube/x2/plugins/node_modules/openid-client/lib/helpers/process_response.js:38:13)\n    at Client.grant (/var/snap/peertube/x2/plugins/node_modules/openid-client/lib/client.js:1354:22)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async Client.callback (/var/snap/peertube/x2/plugins/node_modules/openid-client/lib/client.js:493:24)\n    at async handleCb (/var/snap/peertube/x2/plugins/node_modules/peertube-plugin-auth-openid-connect/main.js:270:22)",

authelia version: 4.38.8

authelia config

clients:
      - client_id: 'peertube'
        client_name: 'Peertube'
        client_secret: '$pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng'
        # The digest of 'insecure_secret'.
        public: false
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://peertube.[domain]/plugins/auth-openid-connect/router/code-cb'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment

peertube plugin: auth-openid-connect
plugin version: 0.1.1
plugin source: https://framagit.org/framasoft/peertube/official-plugins/tree/master/peertube-plugin-auth-openid-connect
plugin config

{
  "scope": "openid email profile",
  "client-id": "peertube",
  "discover-url": "https://auth.[domain]",
  "client-secret": "insecure_secret",
  "mail-property": "email",
  "auth-display-name": "OpenID Connect",
  "username-property": "preferred_username",
  "signature-algorithm": "RS256"
}

[glime-ai[bot]]

Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it.

---

The error message you are encountering, "The provided client secret did not match the registered client secret," typically indicates a mismatch between the client secret configured in your Peertube plugin and the one registered in Authelia. From the configuration details you provided, it appears that there is indeed a discrepancy:

1. Authelia Configuration: The client_secret is set as a hashed value ($pbkdf2-sha512$310000$c8p78n7pUMln0jzvd4aK4Q$JNRBzwAo0ek5qKn50cFzzvE9RXV88h1wJn5KGiHrD0YKtZaR/nCb2CJPOsKaPK0hjf.9yHxzQGZziziccp6Yng).
2. Peertube Plugin Configuration: The client-secret is set as insecure_secret.

To resolve this issue, you need to ensure that the client_secret used in the Peertube plugin configuration matches the one registered in Authelia. Since Authelia's configuration uses a hashed secret, you should use the plain text version of this secret in your Peertube plugin configuration, assuming it was originally insecure_secret before being hashed for storage in Authelia.

Here are the steps to correct the configuration:

1. Update Peertube Plugin Configuration: Change the client-secret in your Peertube plugin configuration to match the plain text version of the secret used in Authelia before it was hashed. Based on your configuration, it seems like it should be insecure_secret.

2. Verify Redirect URIs and Other Settings: Ensure that all other settings, such as redirect URIs and scopes, match between Authelia and the Peertube plugin.

3. Restart Services: After making these changes, restart both Authelia and Peertube services to ensure that the new configurations are loaded.

If you continue to experience issues, double-check that the hashing of the secret in Authelia's configuration is correctly implemented and that there are no typos or extra spaces in the secrets or other configuration entries.

This comment was generated by Glime.

[cyberb]

I think AI is not correct.
just in case generated a new hash with:

authelia crypto hash generate

same issue

[james-d-elliott]

The only two possible causes here is that pertube is not including the correct client secret or you're using the expandenv filter and not escaping the $ literals.

[cyberb]

Perfect, quck escaping test worked. Not sure why I have expand-env filter enabled as I only needed template.
Thank you!