Hello,
I’m trying for a while to enable OIDC authentication between Vikunja and Authelia. Both runs on separate VMs, inside docker.
As you probably guessed, I received the followed message:
details { error: “invalid_client”, error_description: “Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).” }
message “Could not authenticate against third party.”
Logs in Vikunja:
Error retrieving token: oauth2: \"invalid_client\" \"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method.\"
Logs in Authelia:
Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using ‘token_endpoint_auth_method’ method ‘client_secret_post’, however the OAuth 2.0 client registration does not allow this method. The registered client with id ‘vikunja’ is configured to only support ‘token_endpoint_auth_method’ method ‘client_secret_basic’. Either the Authorization Server client registration will need to have the ‘token_endpoint_auth_method’ updated to ‘client_secret_post’ or the Relying Party will need to be configured to use ‘client_secret_basic’.” method=POST path=/api/oidc/token remote_ip=<ip_vikinja>
Here is my Authelia conf:
client_id: ‘vikunja’
client_name: ‘vikunja’
client_secret: <super_secret>
consent_mode: ‘implicit’
public: false
authorization_policy: ‘vikunja_policy’
require_pkce: false
pkce_challenge_method: ‘’
redirect_uris:
- ‘``https://vikunja.<my_domain>.fr/auth/openid/’
- ‘``https://vikunja.``<my_domain>``.fr/auth/openid/authelia’
- ‘``https://vikunja.``<my_domain>``.fr/api/oidc/authorization’
scopes:
- ‘openid’
- ‘profile’
- ‘email’
response_types:
- ‘code’
grant_types:
- ‘authorization_code’
access_token_signed_response_alg: ‘none’
userinfo_signed_response_alg: ‘none’
token_endpoint_auth_method: ‘client_secret_basic’
And my Vikunja conf:
auth:
openid:
enabled: true
providers:
authelia:
name: ‘authelia’
authurl: ‘``https://<my_authelia_domain>.fr``’
redirecturl: ‘``https://vikunja.``<my_domain>``.fr/auth/openid/authelia’
clientid: ‘vikunja’
clientsecret: <super_secret>
scope: ‘openid profile email’
forceuserinfo: true
When I set token_endpoint_auth_method: ‘client_secret_post’ in Authelia, the message is:
Vikunja:
msg=“Error retrieving token: oauth2: "invalid_client" "Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)."”
Authelia:
Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using ‘token_endpoint_auth_method’ method ‘client_secret_basic’, however the OAuth 2.0 client registration does not allow this method. The registered client with id ‘vikunja’ is configured to only support ‘token_endpoint_auth_method’ method ‘client_secret_post’. Either the Authorization Server client registration will need to have the ‘token_endpoint_auth_method’ updated to ‘client_secret_basic’ or the Relying Party will need to be configured to use ‘client_secret_post’." method=POST path=/api/oidc/token remote_ip=<ip_vikinja>
and
Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The provided client secret did not match the registered client secret." method=POST path=/api/oidc/token remote_ip=<ip_vikinja>
I tried a lot of things, I’v read a lot of threads, and to be honest, I really don’t have any clue on how I could try anything else…
Thanks a lot for your help !
Regards,
Guillaume
… With a brand new secret generated with: