Problem with Authentik's self signed cert

Support
1

Hey,
I’m trying to set up SSO using Authentik - I followed the guide on authentiks page docs.goauthentik.io/integrations/services/vikunja/ (used up my link quota for this post, so here it’s a quote…)
Sadly, I’m running into an error and can’t find any leads about it.

I am receiving this error:
ERROR ▶ openid/GetAllProviders 0e5 Error while getting openid provider authentik Login: Get "https://auth.domain.mine/application/o/vikunja/.well-known/openid-configuration": tls: failed to verify certificate: x509: certificate signed by unknown authority

Vikunja and Authentik are both running on docker.
Vikunja version is 0.24.2, so I think the patch from here is already included?

I selected the self-signed cert by Authentik as mentioned in the guide and made sure it’s RSA (Based on this)

The config is mounted in the service “vikunja” (image: vikunja/vikunja) under /etc/vikunja/config.yml
I think the mount works, as disabling local leads to a blank login page right now and I can see in n /api/v1/info that openid_connect is enabled, but the providers list is shown as empty .

For reference, here is my entire config.yml (i only configured auth)

#config.yml 
auth:
  local:
    enabled: true
  openid:
    enabled: true
    providers:
      - name: "authentik Login".
        authurl: https://auth.domain.mine/application/o/vikunja  
        clientid: <client>
        clientsecret: <secret>

Any ideas where I went wrong? Did I miss some steps regarding the certificates?

2

This looks like you’re using the self-signed certificate to host Authentik? (for tls termination, not for the actual authentication)
Vikunja does not support adding any tls root certificates to its store, instead you should add the certificate from Authentik to your system’s trust store and make that available to Vikunja in the docker setup. Vikunja looks in these locations for tls certificates.

3

That was it! Thanks a lot!

My setup consists of my own CA to sign the certificates, which are in turn used in the nginx proxy manager. Individually it worked fine so far… But it makes sense that the individual containers need to know about the certificate, too…