BUG_ "Caught an error in Firefly III"

[zkvvoob]

Describe the bug
Hello,

I've added an Oauth client in Firefly (first with and then I tried without a secret). I use Authentik for remote user authentication. These are the Docker environment variables:

AUTHENTICATION_GUARD=remote_user_guard
AUTHENTICATION_GUARD_HEADER=HTTP_X_AUTHENTIK_USERNAME

I've got no issues logging in the Firefly web interface. However, when I pass the Authentik login page, there's a blank grey page and Firefly sends me an email with the following content:

Firefly III v5.7.15 ran into an error: Laravel\Passport\Http\Controllers\AuthorizationController::__construct(): Argument #3 ($guard) must be of type Illuminate\Contracts\Auth\StatefulGuard, FireflyIII\Support\Authentication\RemoteUserGuard given.

The error was of type "TypeError".

The error occurred on/at: Tue, 08 Nov 2022 09:09:56 +0200.

This error occurred in file "/var/www/html/vendor/laravel/passport/src/Http/Controllers/AuthorizationController.php" on line 52 with code 0.

There was no user logged in for this error or no user was detected.

The full stacktrace:

#0 [internal function]: Laravel\Passport\Http\Controllers\AuthorizationController->__construct()
#1 /var/www/html/vendor/laravel/framework/src/Illuminate/Container/Container.php(915): ReflectionClass->newInstanceArgs()
#2 /var/www/html/vendor/laravel/framework/src/Illuminate/Container/Container.php(756): Illuminate\Container\Container->build()
#3 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Application.php(860): Illuminate\Container\Container->resolve()
#4 /var/www/html/vendor/laravel/framework/src/Illuminate/Container/Container.php(692): Illuminate\Foundation\Application->resolve()
#5 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Application.php(845): Illuminate\Container\Container->make()
#6 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Route.php(274): Illuminate\Foundation\Application->make()
#7 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Route.php(260): Illuminate\Routing\Route->getController()
#8 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Route.php(205): Illuminate\Routing\Route->runController()
#9 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(725): Illuminate\Routing\Route->run()
#10 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(141): Illuminate\Routing\Router->Illuminate\Routing\{closure}()
#11 /var/www/html/vendor/laravel/passport/src/Http/Middleware/CreateFreshApiToken.php(50): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#12 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Laravel\Passport\Http\Middleware\CreateFreshApiToken->handle()
#13 /var/www/html/vendor/laravel/framework/src/Illuminate/Session/Middleware/AuthenticateSession.php(40): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#14 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Session\Middleware\AuthenticateSession->handle()
#15 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/VerifyCsrfToken.php(78): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#16 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\VerifyCsrfToken->handle()
#17 /var/www/html/vendor/laravel/framework/src/Illuminate/View/Middleware/ShareErrorsFromSession.php(49): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#18 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\View\Middleware\ShareErrorsFromSession->handle()
#19 /var/www/html/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(121): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#20 /var/www/html/vendor/laravel/framework/src/Illuminate/Session/Middleware/StartSession.php(64): Illuminate\Session\Middleware\StartSession->handleStatefulRequest()
#21 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Session\Middleware\StartSession->handle()
#22 /var/www/html/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/AddQueuedCookiesToResponse.php(37): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#23 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse->handle()
#24 /var/www/html/vendor/laravel/framework/src/Illuminate/Cookie/Middleware/EncryptCookies.php(67): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#25 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Cookie\Middleware\EncryptCookies->handle()
#26 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(116): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#27 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(726): Illuminate\Pipeline\Pipeline->then()
#28 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(703): Illuminate\Routing\Router->runRouteWithinStack()
#29 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(667): Illuminate\Routing\Router->runRoute()
#30 /var/www/html/vendor/laravel/framework/src/Illuminate/Routing/Router.php(656): Illuminate\Routing\Router->dispatchToRoute()
#31 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(190): Illuminate\Routing\Router->dispatch()
#32 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(141): Illuminate\Foundation\Http\Kernel->Illuminate\Foundation\Http\{closure}()
#33 /var/www/html/app/Http/Middleware/InstallationId.php(52): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#34 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): FireflyIII\Http\Middleware\InstallationId->handle()
#35 /var/www/html/vendor/laravel/framework/src/Illuminate/Http/Middleware/TrustProxies.php(39): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#36 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Http\Middleware\TrustProxies->handle()
#37 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#38 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ConvertEmptyStringsToNull.php(31): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#39 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull->handle()
#40 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TransformsRequest.php(21): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#41 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/TrimStrings.php(40): Illuminate\Foundation\Http\Middleware\TransformsRequest->handle()
#42 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\TrimStrings->handle()
#43 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/ValidatePostSize.php(27): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#44 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\ValidatePostSize->handle()
#45 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Middleware/PreventRequestsDuringMaintenance.php(86): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#46 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance->handle()
#47 /var/www/html/app/Http/Middleware/SecureHeaders.php(51): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#48 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(180): FireflyIII\Http\Middleware\SecureHeaders->handle()
#49 /var/www/html/vendor/laravel/framework/src/Illuminate/Pipeline/Pipeline.php(116): Illuminate\Pipeline\Pipeline->Illuminate\Pipeline\{closure}()
#50 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(165): Illuminate\Pipeline\Pipeline->then()
#51 /var/www/html/vendor/laravel/framework/src/Illuminate/Foundation/Http/Kernel.php(134): Illuminate\Foundation\Http\Kernel->sendRequestThroughRouter()
#52 /var/www/html/public/index.php(75): Illuminate\Foundation\Http\Kernel->handle()
#53 {main}

The following headers may also be relevant:

- x-authentik-username: zkvvoob
- x-authentik-groups: All apps|authentik Admins
- x-authentik-email: zkvvoob@email.com
- x-authentik-name: Zkvv Ooob
- x-authentik-uid: 0***2
- x-forwarded-host: firefly.domain.com
- x-forwarded-server: firefly.domain.com
- x-forwarded-proto: https
- x-forwarded-for: 156.XXX.XXX.XXX, 172.68.50.214
- host: firefly.domain.com
- connection: close
- cf-ipcountry: XX
- cdn-loop: cloudflare
- accept-encoding: gzip
- cf-ray: 766c***
- cf-visitor: {"scheme":"https"}
- accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
- user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 16_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Mobile/15E148 Safari/604.1
- accept-language: ***;q=0.9
- cf-connecting-ip: 156.XXX.XXX.XXX

Smartphone (please complete the following information):

• Device: iPhone 13 Pro
• OS: iOS 16.0
• Version [e.g. 22]

I'm not sure whether this is the place to ask for help or over at Firefly III's Github page.

Thanks in advance for looking into this!

[victorbalssa]

Hi @zkvvoob,
I'm not familiar with Authentik but the error looks clear: FireflyIII\Support\Authentication\RemoteUserGuard should implement Illuminate\Contracts\Auth\StatefulGuard maybe a compatibility issue between Laravel and Authentik (?)

Victor

[zkvvoob]

Thanks, @victorbalssa . I'll ask over at Authentik's Github community.

[skuzzle]

Hey @victorbalssa,
your answer doesn't quite make sense to me. In my understanding the RemoteUserGuard should be agnostic to the actual authentication service being used. It should only care for the respective headers being present. In this case x-authentik-username which seems to be filled correctly.
I'm using Authentik + Firefly III myself (but not this iOS App, so I can not direclty relate). My Firefly config looks similar, except for the used header name. But that is due to the fact that I'm using a custom forward-auth proxy instead of the one built into Authentik. My settings:

AUTHENTICATION_GUARD=remote_user_guard
AUTHENTICATION_GUARD_HEADER=X-Forwarded-User

As the error seems to be generated on the server side, I'd go and ask the question over at the Firefly repository.

One more hint: I had prior problems with Authentik because it implements the OAuth authentication flow mostly in JavaScript instead of relying on pure browser redirects like for example keycloak does. I can imagine this might pose a problem when logging in from an app. I suggest you should try to make the login work from the browser first.

[zkvvoob]

Hello @skuzzle,

Thanks for taking the time to look into my issue. I've had no issues logging in Firefly III in the browser, which is why I thought I'd ask here (because the problem only presented itself after trying to log in from the app).

At any rate, I'll ask around over at Firefly's repo.

[skuzzle]

When browser login works as expected, it might indeed be an incompatibility with the app and the way that Authentik implements the Oauth flow. As mentioned before this gave me head aches a few times already and its pretty hard to debug. It might help to enable debug logging for authentik (AUTHENTIK_LOG_LEVEL=debug). I think you also need to investigate what the App expects from the Oauth flow.
I can also imagine that the App in general can not properly handle the forward-authentication stuff

[victorbalssa]

@zkvvoob
@skuzzle
A new version has been released: 0.7.0 with the Personal Access Token as a authentication option.
Let me know if that solves this issue.