Error: Unauthenticated, signin works only using setup keys

[ozoromo]

Describe the problem

When trying to sign in using SSO (Zitadel) everything works fine on the SSO side and the user is redirected back to https://netbird.mydomain.com/auth?code=longcodehere and sees the following error there:

*Oops, something went wrong* There was an error logging you in. Error: Unauthenticated

To Reproduce

Steps to reproduce the behavior:

1. Run command 'sudo netbird up --management-url https://netbird.mydomain.com:443'
2. Browser opens
3. SSO login
4. See error

Expected behavior

After being redirected back to Netbird the tab should close or redirect to the main UI and the client should be added to the peers

Are you using NetBird Cloud?

No, I am selfhosting

NetBird version

0.27.10 (on client)

NetBird status -d output:

Netbird status of a client added using setup keys:

OS: linux/amd64
Daemon version: 0.27.10
CLI version: 0.27.10
Management: Connected
Signal: Connected
Relays: 2/2 Available
Nameservers: 0/0 Available
FQDN: vpsd2uodks.netbird.selfhosted
NetBird IP: 100.124.152.40/16
Interface type: Kernel
Quantum resistance: false
Routes: -
Peers count: 1/1 Connected

Screenshots

Page that appears

Additional context

The following error appears in netbird-managements log: WARN management/server/grpcserver.go:371: failed logging in peer xkk8XC31+NOZzHfFPzybhp8DbByrixl/nU8XlPJhT0o=: no peer auth method provided, please use a setup key or interactive SSO login

management.json (redacted)

```json { "DataStoreEncryptionKey": "long enryption key", "Datadir": "/var/lib/netbird-mgmt/data", "DeviceAuthorizationFlow": { "Provider": "hosted", "ProviderConfig": { "Audience": "numericalid@netbird", "ClientID": "numericalid@netbird", "ClientSecret": "longsecretstring", "DeviceAuthEndpoint": "https://auth.mydomain.com/oauth/v2/device_authorization", "Domain": "https://auth.mydomain.com", "Scope": "openid", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token", "UseIDToken": false } }, "HttpConfig": { "Address": "127.0.0.1:8011", "AuthAudience": "numericalid@netbird", "AuthIssuer": "https://auth.mydomain.com", "AuthKeysLocation": "https://auth.mydomain.com/oauth/v2/keys", "IdpSignKeyRefreshEnabled": true, "OIDCConfigEndpoint": "https://auth.mydomain.com/.well-known/openid-configuration" }, "IdpManagerConfig": { "Auth0ClientCredentials": null, "AzureClientCredentials": null, "ClientConfig": { "ClientID": "netbird", "ClientSecret": "longsecretstring", "GrantType": "client_credentials", "Issuer": "https://auth.mydomain.com", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token" }, "ExtraConfig": { "ManagementEndpoint": "https://auth.mydomain.com/management/v1" }, "KeycloakClientCredentials": null, "ManagerType": "zitadel", "ZitadelClientCredentials": null }, "PKCEAuthorizationFlow": { "ProviderConfig": { "Audience": "numericalid@netbird", "AuthorizationEndpoint": "https://auth.mydomain.com/oauth/v2/authorize", "ClientID": "numericalid@netbird", "ClientSecret": "longsecretstring", "RedirectURLs": [ "https://netbird.mydomain.com/auth", "https://netbird.mydomain.com/silent-auth" ], "Scope": "openid profile email offline_access api", "TokenEndpoint": "https://auth.mydomain.com/oauth/v2/token", "UseIDToken": false } }, "ReverseProxy": { "TrustedHTTPProxies": [], "TrustedHTTPProxiesCount": 0, "TrustedPeers": [ "0.0.0.0/0" ] }, "Signal": { "Password": null, "Proto": "https", "URI": "netbird.mydomain.com:443", "Username": "" }, "StoreConfig": { "Engine": "sqlite" }, "Stuns": [ { "Password": "some long credential", "Proto": "udp", "URI": "stun:netbird.mydomain.com:3478", "Username": "netbird" } ], "TURNConfig": { "CredentialsTTL": "12h", "Secret": "some long credential", "TimeBasedCredentials": false, "Turns": [ { "Password": "some long credential", "Proto": "udp", "URI": "turn:netbird.mydomain.com:3478", "Username": "netbird" } ] } } ```

[tarocjsu]

This issue or symptom also happen by my side, no any respond or answer for this topic ?

[zoechi]

Looks similar to #1288 (with Authentik). Perhaps also #2515

[patrick7]

Same issue here, i set the flow but still getting an unauthenticated. I'm not even being redirected to authentik.