Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] - Authentik not logging in correctly #3488

Open
5 of 6 tasks
joshoram80 opened this issue Apr 17, 2024 · 7 comments
Open
5 of 6 tasks

[BUG] - Authentik not logging in correctly #3488

joshoram80 opened this issue Apr 17, 2024 · 7 comments
Labels
bug Something isn't working OIDC triage

Comments

@joshoram80
Copy link

First Check

  • This is not a feature request.
  • I added a very descriptive title to this issue (title field is above this).
  • I used the GitHub search to find a similar issue and didn't find it.
  • I searched the Mealie documentation, with the integrated search.
  • I already read the docs and didn't find an answer.
  • This issue can be replicated on the demo site (https://demo.mealie.io/).

What is the issue you are experiencing?

I have Mealie setup to use OAuth via Authentik. When I access the site via mealie.my.domain, I am presented with my Authentik login page, I log in, and mealie loads up showing all my recipes, but I am not completely logged in somehow. There is still a Login button at the top right corner, and the Mealie menu is blank.

If you click Login, it takes you to the Mealie login page, but clicking Login with OAuth either says there is a problem, or you are presented with a Mealie 404 page. Login in via regular Username\Password is not possible as Mealie is set to use OAuth.

What is strange is if I access the site from my local LAN, or via Wireguard, my domain DNS is rewritten to my server LAN IP instead of my Public WAN IP, and Caddy is setup to bypass Authentik if accessing from a LAN IP, and in this case, OAuth is disabled, and I can login via username and password.

I have completely rebuilt the mealie container, and tried incognito mode and 3 different browsers and the result is the same.

Steps to Reproduce

  1. Visit Mealie URL
  2. Try and access Mealie menu

Please provide relevant logs

This is the log from a restart\login sequence. LOG_LEVEL=debug

18/04/2024
08:00:27
    "PRODUCTION": true,
18/04/2024
08:00:27
    "BASE_URL": "https://mealie.my.domain",
18/04/2024
08:00:27
    "STATIC_FILES": "/spa/static",
18/04/2024
08:00:27
    "IS_DEMO": false,
18/04/2024
08:00:27
    "HOST_IP": "*",
18/04/2024
08:00:27
    "API_HOST": "0.0.0.0",
18/04/2024
08:00:27
    "API_PORT": 9000,
18/04/2024
08:00:27
    "API_DOCS": true,
18/04/2024
08:00:27
    "TOKEN_TIME": 48,
18/04/2024
08:00:27
    "LOG_CONFIG_OVERRIDE": null,
18/04/2024
08:00:27
    "LOG_LEVEL": "debug",
18/04/2024
08:00:27
    "GIT_COMMIT_HASH": "faf716cb7e60b9e31451bdc1caec88e8a78f4db7",
18/04/2024
08:00:27
    "ALLOW_SIGNUP": true,
18/04/2024
08:00:27
    "SECURITY_MAX_LOGIN_ATTEMPTS": 5,
18/04/2024
08:00:27
    "SECURITY_USER_LOCKOUT_TIME": 24,
18/04/2024
08:00:27
    "DB_ENGINE": "sqlite",
18/04/2024
08:00:27
    "DEFAULT_GROUP": "Home",
18/04/2024
08:00:27
    "SMTP_HOST": null,
18/04/2024
08:00:27
    "SMTP_PORT": "587",
18/04/2024
08:00:27
    "SMTP_FROM_NAME": "Mealie",
18/04/2024
08:00:27
    "SMTP_FROM_EMAIL": null,
18/04/2024
08:00:27
    "SMTP_AUTH_STRATEGY": "TLS",
18/04/2024
08:00:27
    "LDAP_AUTH_ENABLED": false,
18/04/2024
08:00:27
    "LDAP_SERVER_URL": null,
18/04/2024
08:00:27
    "LDAP_TLS_INSECURE": false,
18/04/2024
08:00:27
    "LDAP_TLS_CACERTFILE": null,
18/04/2024
08:00:27
    "LDAP_ENABLE_STARTTLS": false,
18/04/2024
08:00:27
    "LDAP_BASE_DN": null,
18/04/2024
08:00:27
    "LDAP_QUERY_BIND": null,
18/04/2024
08:00:27
    "LDAP_QUERY_PASSWORD": null,
18/04/2024
08:00:27
    "LDAP_USER_FILTER": null,
18/04/2024
08:00:27
    "LDAP_ADMIN_FILTER": null,
18/04/2024
08:00:27
    "LDAP_ID_ATTRIBUTE": "uid",
18/04/2024
08:00:27
    "LDAP_MAIL_ATTRIBUTE": "mail",
18/04/2024
08:00:27
    "LDAP_NAME_ATTRIBUTE": "name",
18/04/2024
08:00:27
    "OIDC_AUTH_ENABLED": true,
18/04/2024
08:00:27
    "OIDC_CLIENT_ID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
18/04/2024
08:00:27
    "OIDC_CONFIGURATION_URL": "https://authentik.my.domain/application/o/mealie/.well-known/openid-configuration",
18/04/2024
08:00:27
    "OIDC_SIGNUP_ENABLED": true,
18/04/2024
08:00:27
    "OIDC_USER_GROUP": null,
18/04/2024
08:00:27
    "OIDC_ADMIN_GROUP": null,
18/04/2024
08:00:27
    "OIDC_AUTO_REDIRECT": false,
18/04/2024
08:00:27
    "OIDC_PROVIDER_NAME": "OAuth",
18/04/2024
08:00:27
    "OIDC_REMEMBER_ME": false,
18/04/2024
08:00:27
    "OIDC_SIGNING_ALGORITHM": "RS256",
18/04/2024
08:00:27
    "OIDC_USER_CLAIM": "email",
18/04/2024
08:00:27
    "TESTING": false
18/04/2024
08:00:27
}
18/04/2024
08:00:27
INFO     2024-04-18T08:00:27 - Application startup complete.
18/04/2024
08:00:27
INFO     2024-04-18T08:00:27 - Uvicorn running on http://0.0.0.0:9000 (Press CTRL+C to quit)
18/04/2024
08:00:51
INFO     2024-04-18T08:00:51 - [127.0.0.1:59880] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:01:21
INFO     2024-04-18T08:01:21 - [127.0.0.1:51342] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:01:51
INFO     2024-04-18T08:01:51 - [127.0.0.1:41072] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:02:22
INFO     2024-04-18T08:02:22 - [127.0.0.1:59894] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:02:52
INFO     2024-04-18T08:02:52 - [127.0.0.1:38866] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:03:22
INFO     2024-04-18T08:03:22 - [127.0.0.1:49250] 200 OK "GET /api/app/about HTTP/1.1"
18/04/2024
08:03:53
INFO     2024-04-18T08:03:53 - [127.0.0.1:59544] 200 OK "GET /api/app/about HTTP/1.1"

I have also noticed
/null?protocol=oauth2&response_type=code&access_type&client_id=XXXXXXXXXXXXXXXXXXXXX&redirect_uri=https%3A%2F%2Fmealie.my.domain%2Flogin&scope=openid%20profile%20email%20groups&state=UgTDTVHHai&code_challenge_method=S256&code_challenge=KPcEbyCTieF5gw5AIrX66nNxGJ55mU-9frZOxTRI4uE HTTP/1.1"

in the log from a previous attempt, and the browser actually trues to download a file called "null"

There are no errors in Authentik or Caddy logs at all.

Mealie Version

Docker image v1.5.1

Deployment

Docker (Linux)

Additional Deployment Details

Standard Caddy deployment

(auth) {
	reverse_proxy /outpost.goauthentik.io/* http://authentik_server:9000
	forward_auth http://authentik_server:9000 {
		uri /outpost.goauthentik.io/auth/caddy
		copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version authorization
		trusted_proxies private_ranges
	}
}

mealie.stalepopcorn.me {
	import auth
	reverse_proxy 172.20.0.27:9000
}
@joshoram80 joshoram80 added bug Something isn't working triage labels Apr 17, 2024
@cmintey
Copy link
Contributor

cmintey commented Apr 17, 2024

Are there any errors in the browser console or network tab?

I wonder if the forward auth is causing you issues. I think something similar caused someone else issues with Authelia. When you have OAuth set up, you don't really need forward auth. Can you try removing that from your Caddy config and try?

@joshoram80
Copy link
Author

With ForwardAuth disabled I still have the same issue.

https://mealie.stalepopcorn.me/null?

with a fresh browser cache, mealie container etc, When I visit the site URL, I am presented with all my recipes (It doesn't even ask me to login with OAuth, even in incognito mode), and the login button is visible which takes you to the login page.

Either the normal login page appears, but Login with OAuth throws an error, or I get a 404 page and the URL in the address bar starts with

https://mealie.my.domain/null?

In the browser console I can see

Access to XMLHttpRequest at 'https://authentik.my.domain/application/o/mealie/.well-known/openid-configuration' from origin 'https://mealie.my.domain/' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header contains multiple values '*, https://mealie.my.domain/', but only one is allowed.

I have added

mealie.stalepopcorn.me {
	reverse_proxy 172.20.0.27:9000 {
		header_down -Access-Control-Allow-Origin
	}
}

to my Caddyfile but it still seems to throw that error

@cmintey
Copy link
Contributor

cmintey commented Apr 18, 2024

So you're being blocked by Authentik's CORS policy. What browser is this happening in? Does it happen in other browsers?

@joshoram80
Copy link
Author

Firefox, Edge and Chrome

@cmintey
Copy link
Contributor

cmintey commented Apr 18, 2024

I don't use Authentik, so I'm not sure if it's just a configuration you're missing there. Maybe the guides and comments in #3334 can help

@ianr2
Copy link

ianr2 commented Apr 27, 2024

Following, as I have exactly the same issue with mealie and authentik

@joshoram80
Copy link
Author

joshoram80 commented Apr 28, 2024 •
edited

I have fixed the login issues with the latest nightly, but Recipe Create, or Import does not work on Mobile. Clicking the Create and choosing either option just reloads the main recipes page.

The only thing out of the ordinary I can see in the logs is

28/04/2024
17:34:15
INFO     2024-04-28T17:34:15 - [120.21.146.158:0] 304 Not Modified "GET /g/home HTTP/1.1"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working OIDC triage
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@joshoram80 @boc-the-git @ianr2 @cmintey