Can't access dashboard - Token Invalid, Authentik #2338
Comments
|
for the time being I've created a new provider and service account to get into the dashboard, but I fully expect the problem to reappear when token expires. |
|
same issue: Error: Token invalid |
|
@Pshemas did you ever figure this out? |
|
I updated to Authentik 2024.10.4 this morning and now I am getting this error. All my netbird users can't work. :-( |
Yeah, same proble here |
|
@ne0YT sadly not. I created new provider and added it to NB. This made it work... until today. With Authentik 2024.10.4 I first couldn't launch at all - got redirection URI error. Initially the tip to change middle option for URI to regex didn't help, but later on it did... But then it brought me back to "Token Invalid" error. |
|
Here are the latest logs from management: |
|
Please see |
|
Thank you @Spiritreader That worked for me. |
I've been looking at similar reports - and I couldn't figure out which one would be best for this one, in the end decided on new one, hopefully all the appropriate ones will be merged.
So I had a working self hosted instance of Netbird with Authentik as a IdP provider. After a while it stopped working with
Token Invaliderror message... which "magically" fixed itself. But now it stopped working again and I can't access the dashboard (the service itself works, the agents can connect, but I can't do any management atm).Here's what I see in the logs:
Here's sanitized management.json:
{ "Stuns": [{ "Proto": "udp", "URI": "stun:mydomain.com:3478", "Username": "", "Password": "" }], "TURNConfig": { "TimeBasedCredentials": false, "CredentialsTTL": "12h0m0s", "Secret": "secret", "Turns": [{ "Proto": "udp", "URI": "turn:mydomain.com:3478", "Username": "self", "Password": "someturnpassword" }] }, "Signal": { "Proto": "http", "URI": "mydomain.com:10000", "Username": "", "Password": "" }, "Datadir": "/var/lib/netbird/", "DataStoreEncryptionKey": "somekey", "HttpConfig": { "LetsEncryptDomain": "", "CertFile": "/etc/letsencrypt/live/mydomain.com/fullchain.pem", "CertKey": "/etc/letsencrypt/live/mydomain.com/privkey.pem", "AuthAudience": "OauthProiderClientID", "AuthIssuer": "https://authentik.mydomain.com/application/o/netbird/", "AuthUserIDClaim": "", "AuthKeysLocation": "https://authentik.mydomain.com/application/o/netbird/jwks/", "OIDCConfigEndpoint": "https://authentik.mydomain.com/application/o/netbird/.well-known/openid-configuration", "IdpSignKeyRefreshEnabled": true }, "IdpManagerConfig": { "ManagerType": "authentik", "ClientConfig": { "Issuer": "https://authentik.mydomain.com/application/o/netbird", "TokenEndpoint": "https://authentik.mydomain.com/application/o/token/", "ClientID": "OauthProiderClientID", "ClientSecret": "", "GrantType": "client_credentials" }, "ExtraConfig": { "Password": "ServiceAccountToken", "Username": "Netbird" }, "Auth0ClientCredentials": null, "AzureClientCredentials": null, "KeycloakClientCredentials": null, "ZitadelClientCredentials": null }, "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "ClientID": "OauthProiderClientID", "ClientSecret": "", "Domain": "authentik.mydomain.com", "Audience": "OauthProiderClientID", "TokenEndpoint": "https://authentik.mydomain.com/application/o/token/", "DeviceAuthEndpoint": "https://authentik.mydomain.com/application/o/device/", "AuthorizationEndpoint": "", "Scope": "openid", "UseIDToken": false, "RedirectURLs": null } }, "PKCEAuthorizationFlow": { "ProviderConfig": { "ClientID": "OauthProiderClientID", "ClientSecret": "", "Domain": "", "Audience": "OauthProiderClientID", "TokenEndpoint": "https://authentik.mydomain.com/application/o/token/", "DeviceAuthEndpoint": "", "AuthorizationEndpoint": "https://authentik.mydomain.com/application/o/authorize/", "Scope": "openid profile email offline_access api", "UseIDToken": false, "RedirectURLs": [ "http://localhost:53000" ] } }, "StoreConfig": { "Engine": "sqlite" }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] } }Here's sanitized openid config:
{ "issuer": "https://authentik.mydomain.com/application/o/netbird/", "authorization_endpoint": "https://authentik.mydomain.com/application/o/authorize/", "token_endpoint": "https://authentik.mydomain.com/application/o/token/", "userinfo_endpoint": "https://authentik.mydomain.com/application/o/userinfo/", "end_session_endpoint": "https://authentik.mydomain.com/application/o/netbird/end-session/", "introspection_endpoint": "https://authentik.mydomain.com/application/o/introspect/", "revocation_endpoint": "https://authentik.mydomain.com/application/o/revoke/", "device_authorization_endpoint": "https://authentik.mydomain.com/application/o/device/", "response_types_supported": [ "code", "id_token", "id_token token", "code token", "code id_token", "code id_token token" ], "response_modes_supported": [ "query", "fragment", "form_post" ], "jwks_uri": "https://authentik.mydomain.com/application/o/netbird/jwks/", "grant_types_supported": [ "authorization_code", "refresh_token", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code" ], "id_token_signing_alg_values_supported": [ "RS256" ], "subject_types_supported": [ "public" ], "token_endpoint_auth_methods_supported": [ "client_secret_post", "client_secret_basic" ], "acr_values_supported": [ "goauthentik.io/providers/oauth2/default" ], "scopes_supported": [ "email", "profile", "openid" ], "request_parameter_supported": false, "claims_supported": [ "sub", "iss", "aud", "exp", "iat", "auth_time", "acr", "amr", "nonce", "email", "email_verified", "name", "given_name", "preferred_username", "nickname", "groups" ], "claims_parameter_supported": false, "code_challenge_methods_supported": [ "plain", "S256" ] }Netbird is running inside Docker container, while Authentik in Podman one, on a separate server (with Caddy reverse proxy and Cloudflare).
I'm using Authentik for several other apps and I don't have any issues there (but there's one difference - for other apps I don't use service account setup).
On the side of Authentik I don't see any problems. Here's raw event info:
In credentials / tokens for a user that wishes to access Netbird I see:
Here are provider settings:
Any suggestions howto resolve the issue and get into the management panel are greatly appreciated. At this point I'm just blindly clicking various options as the suggestions in other topics are all over the place - it seems that I'm not the only one who has issues in pinpointing the cause / fix.
If there's some more info needed plz let me know - I'll be happy to provide it.
The text was updated successfully, but these errors were encountered: