TomBursch / kitchenowl

KitchenOwl is a self-hosted grocery list and recipe manager. The backend is made with Flask and the frontend with Flutter. Easily add items to your shopping list before you go shopping. You can also create recipes and add items based on what you want to cook.
https://kitchenowl.org/
GNU Affero General Public License v3.0
1.12k stars 62 forks source link

Docs: Authelia OIDC example is now incorrect #428

Closed elagil closed 2 months ago

elagil commented 2 months ago

URL to the Wiki page

https://docs.kitchenowl.org/self-hosting/oidc/

What's the issue?

Previously, the Authelia example was working fine.

However, following some update, Authelia now gives the following error:

Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'kitchenowl' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'.

Following that suggestion, I added the line token_endpoint_auth_method: client_secret_post to the client config, giving

- id: kitchenowl
    description: KitchenOwl
    secret: # Same as OIDC_CLIENT_SECRET
    public: false
    authorization_policy: two_factor # Can also be one_factor if you need less security
    pre_configured_consent_duration: 1M # One month - change this to something you desire
    audience: []
    scopes:
        - openid
        - email
        - profile
    redirect_uris:
        - https://your.domain.here/signin/redirect # Put the same value as FRONT_URL, appended with /signin/redirect
        - kitchenowl:///signin/redirect
    response_modes:
    userinfo_signing_algorithm: none
    token_endpoint_auth_method: client_secret_post # Configure custom authentication method

Was there a change in the authentication method?

TomBursch commented 2 months ago

Thanks for the tip, yes I've changed the auth method because someone requested it https://github.com/TomBursch/kitchenowl/discussions/406. I'll update the release notes to reflect the breaking change and docs. Thanks!