No longer able to login via OIDC

Bug
1

I have tried all config options I can. I run the unstable build of vikunja. Saw the map instead of array from Configure OpenID via environment post, and tried to remap my config. Wheter I use the

default config: 
auth:
  openid:
    providers:
      - name: foo
        clientid: ...
or new: 
auth:
  openid:
    providers:
      foo:
        clientid: ...

I cannot get my (previously) working login button to appear

image
image1202×775 36.8 KB

I can confirm working order of all Vikunja, as my API calls still work, Android app, and Home assistant plugin run just fine still. Being unable to access my instance from the web is a minor inconvenience, but would be awesome if anyone had an idea, it would be helpful

Current openid config 
auth:
  local:
    enabled: false
  openid:
    enabled: true
    #redirecturl: "https://vikunja.tld/auth/openid/"
    providers:
      authentik:
        authurl: "https://authentik.tld/application/o/vikunja"
        #logouturl: "https://authentik.tld/application/o/vikunja/end-session/"
        clientid: ...
        clientsecret: ...
        scope: openid email profile vikunja_scope
2

Is there anything in Vikunjas logs?

3

vikunja-1 | 2024-12-10T20:38:50Z: INFO ▶ 001 Using config file: /etc/vikunja/config.yml
then it seems to run through my metrics connections, I will dig through more later tonight. When I go to my /api/v1/info page, this is what I get as well:
image

EDIT:

vikunja-1  | 2024-12-11T02:09:07Z: INFO ▶ 001 Using config file: /etc/vikunja/config.yml                                                                                                                                        
vikunja-1  | 2024-12-11T02:09:07Z: INFO ▶ 001 Using config file: /etc/vikunja/config.yml                                                                                                                                        
vikunja-1  | 2024-12-11T02:09:08Z: INFO ▶ 001 Using config file: /etc/vikunja/config.yml                                                                                                                                        
vikunja-1  | ⇨ http server started on [::]:3456

That is all the log gives when restarting Vikunja before it starts relaying metrics to relay, here is an example of a login through the android app; when attempting to login to the app I get the same screen, already authenticated sessions seem to be fine:

2024-12-11T01:11:45Z: WEB  ▶ IP.ADDR.HERE  GET 304 /assets/es-ES-legacy-BUMxlyNR.js 205.599µs - Mozilla/5.0 (Linux; Android 13; SM-G781U Build/TP1A.220624.014; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4
.0 Chrome/131.0.6778.39 Mobile Safari/537.36
4

When you restart Vikunja and then access the /info endpoint for the first time, do you see anything in the logs?

5 
{"version":"v0.24.1-551-e8a07fc8e0","frontend_url":"https://vikunja.tld/","motd":"","link_sharing_enabled":true,"max_file_size":"20MB","registration_enabled":true,"available_migrators":["vikunja-file","ticktick"],"task_attachments_enabled":true,"enabled_background_providers":["upload","unsplash"],"totp_enabled":true,"legal":{"imprint_url":"","privacy_policy_url":""},"caldav_enabled":true,"auth":{"local":{"enabled":false},"openid_connect":{"enabled":true,"providers":[]}},"email_reminders_enabled":true,"user_deletion_enabled":true,"task_comments_enabled":true,"demo_mode_enabled":false,"webhooks_enabled":true,"public_teams_enabled":false}

Here is the log, doesn’t give me anything else.

6

This looks like the API response, is there anything in Vikunja’s logs when you access the endpoint for the first time after restart?

7 
vikunja-1  | ⇨ http server started on [::]:3456
vikunja-1  | 2024-12-12T16:09:03Z: WEB  ▶ IP GET 200 /login 2.187641ms - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
vikunja-1  | 2024-12-12T16:09:03Z: WEB  ▶IP  GET 200 /api/v1/info 246.901µs - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0
vikunja-1  | 2024-12-12T16:09:04Z: WEB  ▶ IP  GET 304 /sw.js 1.111561ms - Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0

Not really, no errors that I can tell.

8

Just to confirm, you’re still using the openid config from your original comment here in this thread?

9

That is correct, to be clear, I am using double quotes (") around my authurl no quotes surround my clientid/secret and no quotes surrounding scope.

EDIT: Here is my full (scrubbed) config FWIW, double checked my yaml to make sure it wasn’t a syntax issue as well:

service:
    # The public facing URL where your users can reach Vikunja. Used in emails and for the communication between api and frontend.
  publicurl: "https://vikunja.tld" 
  rootpath: "/etc/vikunja/"
  customlogourl: 'https://img.url.tld/u/WOC13r.png'
log:
  # A folder where all the logfiles should go.
  path: <rootpath>logs
  # Whether to show any logging at all or none
  enabled: false
  # Where the normal log should go. Possible values are stdout, stderr, file or off to disable standard logging.
  standard: "stdout"
  # Change the log level. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.
  level: "DEBUG"
  # Whether or not to log database queries. Useful for debugging. Possible values are stdout, stderr, file or off to disable database logging.
  database: "stdout"
  # The log level for database log messages. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.
  databaselevel: "DEBUG"
  # Whether to log http requests or not. Possible values are stdout, stderr, file or off to disable http logging.
  http: "stdout"
  # Echo has its own logging which usually is unnecessary, which is why it is disabled by default. Possible values are stdout, stderr, file or off to disable standard logging.
  echo: "stdout"
  # Whether or not to log events. Useful for debugging. Possible values are stdout, stderr, file or off to disable events logging.
  events: "stdout"
  # The log level for event log messages. Possible values (case-insensitive) are ERROR, INFO, DEBUG.
  eventslevel: "DEBUG"
  # Whether or not to log mail log messages. This will not log mail contents. Possible values are stdout, stderr, file or off to disable mail-related logging.
  mail: "stdout"
  # The log level for mail log messages. Possible values (case-insensitive) are ERROR, WARNING, INFO, DEBUG.
  maillevel: "info"
typesense:
  enabled: true
  url: 'http://IP.ADDR:8108'
  apikey: 'xyz'
cors:
  enable: true
  origins:
    - "*"
backgrounds:
  enabled: true
  providers:
    upload:
      enabled: true
    unsplash:
      enabled: true
      accesstoken: ...
      applicationid: ...
auth:
  local:
    enabled: false
  openid:
    enabled: true
   # redirecturl: "https://vikunja.tld/auth/openid/"
    providers:
      authentik:
        authurl: "https://authentik.tld/application/o/vikunja"
        #logouturl: "https://authentik.tlk/application/o/vikunja/end-session/"
        clientid: ...
        clientsecret: ...
        scope: openid email profile vikunja_scope
# Prometheus metrics endpoint
metrics:
  # If set to true, enables a /metrics endpoint for prometheus to collect metrics about Vikunja. You can query it from `/api/v1/metrics`.
  enabled: true
  # If set to a non-empty value the /metrics endpoint will require this as a username via basic auth in combination with the password below.
  username:
  # If set to a non-empty value the /metrics endpoint will require this as a password via basic auth in combination with the username below.
  password:

EDIT 2:

Reverted config to the old config to test:

service:
    # The public facing URL where your users can reach Vikunja. Used in emails and for the communication between api and frontend.
  publicurl: "https://vikunja.tld" 
  rootpath: "/etc/vikunja/"
  customlogourl: 'https://img.url.tld/u/WOC13r.png'
log:
  # A folder where all the logfiles should go.
  path: <rootpath>logs
  # Whether to show any logging at all or none
  enabled: false
  # Where the normal log should go. Possible values are stdout, stderr, file or off to disable standard logging.
  standard: "stdout"
  # Change the log level. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.
  level: "DEBUG"
  # Whether or not to log database queries. Useful for debugging. Possible values are stdout, stderr, file or off to disable database logging.
  database: "stdout"
  # The log level for database log messages. Possible values (case-insensitive) are CRITICAL, ERROR, WARNING, NOTICE, INFO, DEBUG.
  databaselevel: "DEBUG"
  # Whether to log http requests or not. Possible values are stdout, stderr, file or off to disable http logging.
  http: "stdout"
  # Echo has its own logging which usually is unnecessary, which is why it is disabled by default. Possible values are stdout, stderr, file or off to disable standard logging.
  echo: "stdout"
  # Whether or not to log events. Useful for debugging. Possible values are stdout, stderr, file or off to disable events logging.
  events: "stdout"
  # The log level for event log messages. Possible values (case-insensitive) are ERROR, INFO, DEBUG.
  eventslevel: "DEBUG"
  # Whether or not to log mail log messages. This will not log mail contents. Possible values are stdout, stderr, file or off to disable mail-related logging.
  mail: "stdout"
  # The log level for mail log messages. Possible values (case-insensitive) are ERROR, WARNING, INFO, DEBUG.
  maillevel: "info"
typesense:
  enabled: true
  url: 'http://IP.ADDR:8108'
  apikey: 'xyz'
cors:
  enable: true
  origins:
    - "*"
backgrounds:
  enabled: true
  providers:
    upload:
      enabled: true
    unsplash:
      enabled: true
      accesstoken: ...
      applicationid: ...
auth:
  local:
    enabled: false
  openid:
    enabled: true
   # redirecturl: "https://vikunja.tld/auth/openid/"
    providers:
      - name: "authentik"
        authurl: "https://authentik.tld/application/o/vikunja"
        #logouturl: "https://authentik.tlk/application/o/vikunja/end-session/"
        clientid: ...
        clientsecret: ...
        scope: openid email profile vikunja_scope
# Prometheus metrics endpoint
metrics:
  # If set to true, enables a /metrics endpoint for prometheus to collect metrics about Vikunja. You can query it from `/api/v1/metrics`.
  enabled: true
  # If set to a non-empty value the /metrics endpoint will require this as a username via basic auth in combination with the password below.
  username:
  # If set to a non-empty value the /metrics endpoint will require this as a password via basic auth in combination with the username below.
  password:

and still no luck, I can confirm if I create an intentional syntax error (or accidental) I get the local login, and it shows in an error in config in the logs, and reverting to a default config etc.

10

As of the latest unstable this still isn’t working

11

Which exact version are you using? (As reported via the cli or the frontend)

12

version "v0.24.1-594-c97fec9fed" according to /info

13

And which config are you using?

14

the new config is what is currently running, have tried with both still though.

15

And you’re still seeing nothing in the logs when accessing /info after first starting it?

I don’t really know why it would fail without an error logged here…