netbirdio / netbird

Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.
https://netbird.io
BSD 3-Clause "New" or "Revised" License
11.03k stars 507 forks source link

Unable to authenticate with Authentik SSO #2515

Open excaliburzarau opened 2 months ago

excaliburzarau commented 2 months ago

Describe the problem

When trying to connect a mobile device or a laptop, after pressing to connect, the Netbird redirects me to Authentik, then it redirects me to a localhost:53000 page saying that i am now connected. After i go back to the Netbird menu, i press to connect and it gets stuck on connecting. On the logs it reports that no peer auth method provided, please use a setup key or interactive SSO login and i can actually see that on the it does not get an user Id with the code accountID: UNKNOWN this can be verified on the image below.

To Reproduce

Steps to reproduce the behavior:

  1. Go to the Netbird client.
  2. Click on Change Server.
  3. Add the server.
  4. Authenticate on Authentik.
  5. Go back to the Netbird client and connect.

Expected behavior

Authenticate with the Authentik user and connect the Netbird client to my self-hosted server.

Are you using NetBird Cloud?

It is a self-host NetBird's control plane.

NetBird version

v0.28.9

NetBird status -dA output:

Not applicable

Do you face any (non-mobile) client issues?

I have issues both on the mobile client and the laptop. Unable to run the command for the same reason as above.

Screenshots

Sem título

363506711-3ba8edcf-b368-4a31-a7aa-8d292b6d38c7

363506706-149e918a-b354-4318-8847-f976333d772e

Additional context

I believe that the Authentik application is sending the User ID but for some reason the Netbird does not receive the User ID presenting the error accountID: UNKNOWN . If i try to set a different scope on the Authentik application it does get the data from Authentik which i can see on the Netbird logs.

Can someone give me an idea of what i might be missing?

Thank you all in advance.

excaliburzarau commented 1 month ago

Hello guys,

An update on the issue.

I AM using the cloudflare provider, i already enabled the grc streaming option on my DNS profile.

I also tried to create a new flow device-code-flow and assign it to a brand on Authentik, the issue still remains.

Thank you all in advance.

Best Regards