I am currently trying to set up and use Authelia idendity providers with OpenID Connect as a single login provider for several different applications.
The first application I want to add is Nextcloud. To do this, I follow the instructions on the Authelia documentation page: https://www.authelia.com/integration/openid-connect/nextcloud
But the problem I'm facing now is that I always get an error message saying that the redirect URL I specified in the configuration is not valid, even though I used the official URL from the Authelia docs.
Authelia Error:
{
"error": "invalid_request",
"error_description": "The request is missing a required parameter,
includes an invalid parameter value, includes a parameter more than once,
or is otherwise malformed. The 'redirect_uri' parameter does not match
any of the OAuth 2.0 Client's pre-registered redirect urls."
}
Authelia Configuration:
(Replaced my server address by: "example.com")
jwt_secret: ac5Tmfbue44TxPTrCpCWNNZKm7AmvBS6
default_redirection_url: https://example.com
server:
host: 0.0.0.0
port: 9091
log:
level: debug
totp:
issuer: example.com
authentication_backend:
file:
path: /config/users_database.yml
access_control:
default_policy: one_factor
rules:
- domain: auth.example.com
policy: bypass
- domain:
- example.com
- proxy.example.com
- nextcloud.example.com
policy: one_factor
identity_providers:
oidc:
hmac_secret: GhuVkMctBBFratABE6fMUacCWKhGgNa23SuDuN62Ug6vxQhJJTsLXca3ZdXyuL7n
issuer_private_key: {KEY}
access_token_lifespan: 1h
authorize_code_lifespan: 1m
id_token_lifespan: 1h
refresh_token_lifespan: 90m
enable_client_debug_messages: false
enforce_pkce: public_clients_only
cors:
endpoints:
- authorization
- token
- revocation
- introspection
allowed_origins:
- https://example.com
allowed_origins_from_client_redirect_uris: false
clients:
- id: nextcloud
secret: nextcloud_client_secret
public: false
authorization_policy: one_factor
scopes:
- openid
- profile
- groups
redirect_uris:
- https://nextcloud.example.com/apps/oidc_login/oidc
userinfo_signing_algorithm: none
session:
name: authelia_session
secret: kHT5S9ed8ArygSwyVZWm48Pyjt4qyXg9
expiration: 3600
inactivity: 300
domain: example.com
regulation:
max_retries: 3
find_time: 120
ban_time: 300
storage:
encryption_key: nqcWgCG22YM6Uttj4GQw5eeNsWKwr4Xm
local:
path: /config/db.sqlite3
notifier:
filesystem:
filename: /config/notification.txt
Nextcloud Configuration:
(Plugin: OpenID Connect Login)
<?php
$CONFIG = array (
'htaccess.RewriteBase' => '/',
'memcache.local' => '\\OC\\Memcache\\APCu',
'apps_paths' =>
array (
0 =>
array (
'path' => '/var/www/html/apps',
'url' => '/apps',
'writable' => false,
),
1 =>
array (
'path' => '/var/www/html/custom_apps',
'url' => '/custom_apps',
'writable' => true,
),
),
'instanceid' => 'owd1s341ok',
'passwordsalt' => 'Kt7fjLgAGjGMtAdrfdsXR4BEEz5pqzmv',
'secret' => '64kSvSXtpQ2HUMBEdQTf5NusZ9SnQhBN64kSvSXtpQ2HUe',
'trusted_domains' =>
array (
0 => 'nextcloud.example.com',
),
'datadirectory' => '/var/www/html/data',
'dbtype' => 'sqlite3',
'version' => '24.0.1.1',
'overwrite.cli.url' => 'http://nextcloud.example.com',
'installed' => true,
'allow_user_to_change_display_name' => false,
'lost_password_link' => 'disabled',
'oidc_login_provider_url' => 'https://auth.example.com',
'oidc_login_client_id' => 'nextcloud',
'oidc_login_client_secret' => 'nextcloud_client_secret',
'oidc_login_auto_redirect' => false,
'oidc_login_end_session_redirect' => false,
'oidc_login_button_text' => 'Log in with Authelia',
'oidc_login_hide_password_form' => false,
'oidc_login_use_id_token' => true,
'oidc_login_attributes' => array (
'id' => 'preferred_username',
'name' => 'name',
'mail' => 'email',
'groups' => 'groups',
),
'oidc_login_default_group' => 'oidc',
'oidc_login_use_external_storage' => false,
'oidc_login_scope' => 'openid profile groups',
'oidc_login_proxy_ldap' => false,
'oidc_login_disable_registration' => true,
'oidc_login_redir_fallback' => false,
'oidc_login_alt_login_page' => 'assets/login.php',
'oidc_login_tls_verify' => true,
'oidc_create_groups' => false,
'oidc_login_webdav_enabled' => false,
'oidc_login_password_authentication' => false,
'oidc_login_public_key_caching_time' => 86400,
'oidc_login_min_time_between_jwks_requests' => 10,
'oidc_login_well_known_caching_time' => 86400,
'oidc_login_update_avatar' => false,
);
Does anyone know how I can fix this error or what I need to change to make it work?
(I am using Nginx Proxy Manager as a reverse proxy and Docker to run Nginx Proxy Manager, Authelia and Nextcloud).
Thanks
Ypselon :)
-= Update =-
I noticed that when I try to log in with Authelia, I get the error page with the following URL:
https://auth.example.com/api/oidc/authorization?response_type=code&redirect_uri=http%3A%2F%nextcloud.example.com%2Fapps%2Foidc_login%2Foidc&client_id=nextcloud&nonce=9a2986f054d7044bcb3050ed3c38a1b6&state=9384d2d39924b436f8a0eb6b8bd334ad&scope=openid+profile+groups+openid
I can then simply remove the "redirect_uri" from the query parameters, reload the page and then for some magical reason I am presented with the consent request and after I accept it I get logged in.
Now I'm completely confused, but maybe someone can tell me, based on the behavior, where the problem might be.
Thanks
Ypselon :)