OAuth setup with Authentik #3334
Replies: 18 comments 51 replies
-
|
as a point of note as Authentik uses a shared Redirect URI and Origins it is probably a good idea to add the BaseURL (no subpath) to that field as well. It might also be good to point out I had trouble with configuring OIDC_AUTO_REDIRECT=true it wasn't until I set that and logged in for the first time that it worked (it might be related to weird browser caching issues) I would but toggling this value fixed any token issues I was having Unsure if its required but should be highlighted authorization_code: In authentik 2024.2 you will need to define offline_access scope to access this |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for sharing your setup. I tried to follow your steps. Sadly no SSO / Login Button appears and my instance seams not to be working. Can you share a Screenshot of how the result should look like? |
Beta Was this translation helpful? Give feedback.
-
|
Same. I cannot get any SSO/Login button to appear. Looking at the "mealie" container logs in docker, I see all of the environment variables echo'd at startup, EXCEPT for the OIDC ones. I see LDAP_ environment variables listed (but they are not defined in my .env; I assume these are defaults), but none of the OIDC ones. Those are definitely in the same .env file as correctly loaded variables, and other variables from the .env are loaded as expected. |
Beta Was this translation helpful? Give feedback.
-
|
OIDC is not in version 1.3.2, it is only available on nightly. It will be widely available in the next version. If you would like to use it now, you will need to switch to the nightly image |
Beta Was this translation helpful? Give feedback.
-
|
I was able to get this working but have run into an issue with the Client_Id only accepting a set value. Is it expected that regardless of what you set the OIDC_CLIENT_ID value to in the environment variables that it will always default to the one you have set in this example. |
Beta Was this translation helpful? Give feedback.
-
|
This is likely due to caching. Once you change the environment variable, completely destroy and re-create the container. You may also need to clear the browser cache |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the response. |
Beta Was this translation helpful? Give feedback.
-
|
No problem, glad it's working! |
Beta Was this translation helpful? Give feedback.
-
|
I set this up myself running the Postgres version of Nightly Mealie then ran into an issue when logging in, I get the following - "GET /login/?code=d1615ae266154ffe849xxxxxxxxxxxxxxxxx&state=xxxxxxxxxxx HTTP/1.1" 200 OK This is for a brand new account logging into Mealie via Authentik OAuth. I then followed the instructions above and got the same issue where I get 401 Unauthorized after being redirected to Mealie. The following is enabled so I'm not sure where to look. Not really sure what to do next. |
Beta Was this translation helpful? Give feedback.
-
|
Hey Siythurn, I followed the above but it looks like authentik is only submitting mealie-admins rather than mealie-users & mealie-admins. DEBUG: 02-Apr-24 10:02:48 [OIDC] User does not have the required group. Found: ['pronto', 'mealie-admins'] - Required: mealie_users
thanks |
Beta Was this translation helpful? Give feedback.
-
|
Ahh after reading some more authentik support docs and threads is seems like this option doesn't do what I thought it did in OIDC context and only applies to internal authentik mappings sorry about the confusion, you will need to add to both groups for it to show up in the token tho its probably still a good idea to use the parent group option incase you have other workflows down the line |
Beta Was this translation helpful? Give feedback.
-
|
Well! Looks like adding to mealie_users doesn’t seem to work either DEBUG: 02-Apr-24 10:40:11 [OIDC] User does not have the required group. Found: ['pronto', 'mealie-admins', 'mealie-users'] - Required: mealie_users Env: |
Beta Was this translation helpful? Give feedback.
-
|
your group is set to _ while your authentik is - |
Beta Was this translation helpful? Give feedback.
-
|
Haha I can't believe I didn't see that :( Thanks for your help Siythurn! |
Beta Was this translation helpful? Give feedback.
-
|
This seems like something that should be added to the documentation. I would never have guessed that admins are not allowed to log in!
|
Beta Was this translation helpful? Give feedback.
-
|
It is in the documentation: https://docs.mealie.io/documentation/getting-started/authentication/oidc/#groups
|
Beta Was this translation helpful? Give feedback.
-
|
It's not 100% clear. I'd look to add all users (including admins) |
Beta Was this translation helpful? Give feedback.
-
|
Yep, this was biting me too. I only added my users to one group or the other, but in this app your admin users need to be in both. Thanks for pointing that you. 👍🏻 |
Beta Was this translation helpful? Give feedback.
-
|
I attempted to set up the openid with Authentik 2024.2 and somehow I get this error: |
Beta Was this translation helpful? Give feedback.
-
|
Did you set up Mealie with your own domain and https? I had the same error before I did exactly that and now it's working fine. |
Beta Was this translation helpful? Give feedback.
-
|
Hey how did you manage to resolve this? I'm getting the same error |
Beta Was this translation helpful? Give feedback.
-
|
Anyone got Authentik and Mealie working and willing to share their config? Somehow I get a 404 page error. |
Beta Was this translation helpful? Give feedback.
-
|
I have it working well, I can take screenshots of my configs in a bit, I'll edit this comment when I get around to it. So Mealie (with image BASE_URL: mealie.mydomain.com
# OIDC with Authentik
OIDC_AUTH_ENABLED: true
OIDC_SIGNUP_ENABLED: true
OIDC_CONFIGURATION_URL: "https://sts.mydomain.com/application/o/mealie/.well-known/openid-configuration"
OIDC_CLIENT_ID: ${mealie_oidc_client_id}
OIDC_USER_GROUP: "Mealie-Users"
OIDC_ADMIN_GROUP: "Mealie-Admins"
OIDC_AUTO_REDIRECT: false
OIDC_PROVIDER_NAME: Authentik
OIDC_REMEMBER_ME: trueThen in Authentik (v2024.2.2): Provider (not actually yaml but I wanted the formatting: Authentication flow: default authentication flow
Authorization flow: default implicit consent
Client type: public
client ID: <autogenerated one> # this one is random and I replace it in the environment variables
Redirect URIs:
- https://mealie.mydomain.com/login
- https://mealie.mydomain.com/login?direct=1
- https://mealie.mydomain.com/login*
Signing key: self-signed certificate
Advanced scopes: email, offline_access, openid, profile
Subject mode: Base on user's email
Include claims in id_token: true # (checked)Application: Slug: mealie # this needs to match the one in the openid url in the mealie env variables.
Policy engine mode: any # pretty sure this is defaultMake sure the case matches exactly for the groups and make sure you have the admin users also in the user group since they won't be able to login without it. I'm half confident that OIDC_AUTO_REDIRECT set to true just infinite loops but I don't want to mess with this again since it's working now. |
Beta Was this translation helpful? Give feedback.
-
|
Set it up the same way as you and still have an infinite redirecting loop and saw this in the browser: |
Beta Was this translation helpful? Give feedback.
-
|
Try in an incognito window, maybe your browser has something cached. |
Beta Was this translation helpful? Give feedback.
-
|
It was incognito already... I mean I have groups named different but the error does not seem to be related to group names anyway. |
Beta Was this translation helpful? Give feedback.
-
|
I only got that far that I actually get redirected to Authentik, log in, and then be redirected to Mealie in a loop with error 500 and the site reloads every second. No logs about error 500 in Mealie... the LOG_LEVEL variable does btw not seem to work. I've set it to DEBUG but there are no debug logs. I use it as a button to login with Authentik and not as a redirect for Mealie. |
Beta Was this translation helpful? Give feedback.
-
|
While I haven't figured it out yet, I've enabled the logging (set to So 2 things:
|
Beta Was this translation helpful? Give feedback.
-
Does your admin user also have the users group? The users group is required for any user login, the admin group just assigns the user as an admin once logged in |
Beta Was this translation helpful? Give feedback.
-
|
It's different for you then. I cannot log in as anybody. I have the groups user and admin in Authentik. The corresponding users are assigned to this group (multiple groups but I hope that shouldn't be a problem). And in Mealie I even named the groups the same according to these groups. Okay debug logs now really work. I have a different error: |
Beta Was this translation helpful? Give feedback.
-
|
That error is because there is a DEFAULT_GROUP environment variable that you need to set. This group is the group name in mealie that new users will be put into on account creation. If that group is set but the group doesn't exist in Mealie then this can cause the error too |
Beta Was this translation helpful? Give feedback.
-
@cmintey Thanks that's it 👍 . The misconception on my part is that in Authentik you can assign a "parent" to a group, which is what I did, so I gave the |
Beta Was this translation helpful? Give feedback.
-
Nope. I have set it to user too and still the error occurs... |
Beta Was this translation helpful? Give feedback.
-
|
Can you share your full environment variables, redacting any sensitive info? |
Beta Was this translation helpful? Give feedback.
-
|
Here are my env variables: I realized I had But the user was created or better said switched from LDAP to OIDC because I'm sure he existed before as LDAP user. Maybe this killed something? Ah and somehow the mainpage is now https://mealie.tld.xyz/g/user instead of the normal login page when I call the main page https://mealie.tld.xyz Okay while reading I found out that I misunderstood something I guess. Users can only see recipes and stuff of their own group. But that does not make much sense for me. I'm the admin with admin group and everybody else is just a user and I want to share the stuff with them of course out of the box but it is not possible right? So you should have a mealie internal admin account and my own account should be just user too? |
Beta Was this translation helpful? Give feedback.
-
|
Your user in Mealie does not need to be part of a "user" group in Mealie. You can have the group be named whatever you want within Mealie. The OIDC_USER_GROUP looks at your groups from Authentik and allows you to login. OIDC_ADMIN_GROUP does the same thing except it assigns you as an admin. The OIDC_USER_GROUP has no correlation to groups in Mealie, it's just like your LDAP_USER_FILTER. So you as an admin can be in the same Mealie group as everyone else so you can access the same recipes. Also, I would suggest setting your users Auth method to LDAP if you want them to be able to use LDAP Auth as a fallback of OIDC fails. If the Auth method is OIDC, then that's the only way they can login |
Beta Was this translation helpful? Give feedback.
-
|
Okay got it but what the hell is this auto redirect? I just realized that all recipes are public now. It redirects from the main page directly to https://meal.tld.xyz/g/ and of course they can see all recipes but I thought there is a mechanism that checks if they are logged in. The login button is available and I can confirm there are no previous cookies as it is an incognito tab. |
Beta Was this translation helpful? Give feedback.
-
|
That's a separate feature that was introduced a while back that if your default group is public, then it will show a public recipe browser. Unauthenticated users can view recipes but can't modify or create them. You can change this behavior by setting your group to private. Info can be found here: https://docs.mealie.io/documentation/getting-started/usage/permissions-and-public-access/ |
Beta Was this translation helpful? Give feedback.
-
|
Despite all my other applications working with Authentik, I cannot get Mealie to work with OIDC. In the console it is being blocked by CORS policy "The 'Access-Control-Allow-Origin' header contains multiple values" however, the domain does not have multiple values. I have upgraded to 1.7.0 but cannot incorporate Authentik |
Beta Was this translation helpful? Give feedback.
-
|
Do you have a proxy in front of Authentik? If so, what is it? Caddy, Nginx, Apache? I cannot reproduce this and the only reason for this that I can find online is that your reverse proxy is adding the '*' to the 'Access-Control-Allow-Origin' header |
Beta Was this translation helpful? Give feedback.
-
|
Hi, After a lot of testing, changing the headers I have found the issue. Mealie and Authentik are behind a Nginx reverse proxy which was adding a header to the Authentik block. I removed this line in the Authentik server configuration: " If others are experiencing the same, check the reverse proxy configuration for the oauth provider and if access control headers are being added |
Beta Was this translation helpful? Give feedback.
-
|
How do you fix that in Authentik? |
Beta Was this translation helpful? Give feedback.
-
|
The fix had to be made in the reverse proxy not Authentik. The server block in Nginx was adding another access control allow origin header which was causing the CORS policy to fail for Mealie. Once removed, it worked as expected. Check your configuration of the reverse proxy |
Beta Was this translation helpful? Give feedback.
-
|
Is that in the Authentik docker Image? I tried a connection without a proxy and I was still getting that error. |
Beta Was this translation helpful? Give feedback.
-
|
Can anyone help me with Traefik -> Authentik -> Mealie I can't figure out the middleware |
Beta Was this translation helpful? Give feedback.
-
|
I don't think you should need a specific middleware for mealie if you are using OAuth/OIDC with authentik. The middleware you would for sure need set up properly is one that correctly routes stuff to Authentik |
Beta Was this translation helpful? Give feedback.
-
|
I tried everything in the whole thread (again) after an update crashed my working mealie setup and now I only get an 404 error page when I try to login with Authentik. Trying for a long time to fix it and tried everything from the traefik documentation but it wont send the Access Control Allow Origin Header. Does anyone has a working Mealie website with traefik and authentik or know what's wrong with my current one? |
Beta Was this translation helpful? Give feedback.
-
|
I looked over it a bit, and everything looks to be good that I can tell. The part I'm less familiar with is the Traefik middleware. Do you have other OIDC connections set up with Authentik? I would also try with a cleared cache (incognito mode) and see what happens. |
Beta Was this translation helpful? Give feedback.
-
|
@zmweske Sorry for the late reply! All my other OIDC and LDAP connections work flawlessly with authentik, for example Proxmox, Portainer, Immich, etc. There is always the option to just have a authentik proxy in front of mealie, but I have to deal with a double login in that case ... |
Beta Was this translation helpful? Give feedback.
-
|
Dang, I would say try to start from scratch but you've already done that. I think what I had trouble with initially was the confidential vs public in authentik, maybe something with trailing slashes, and be sure to copy the config urls directly from the authentik provider- some stuff got mixed up when I used the templated example. Sorry if none of that helps! |
Beta Was this translation helpful? Give feedback.
-
|
I found the solution!
and saw that even with the correct CORS headers in mealie it didnt work. The missing Access-Control-Allow-Origin header ( here: and that little * solved my CORS issue and OIDC is working flawlessly. |
Beta Was this translation helpful? Give feedback.
-
|
I have been having a hell of a time getting this to work. I'll attach my config, along with the error I've been seeing in the log. Hopefully someone can give me some guidance. And here is the error in the log: |
Beta Was this translation helpful? Give feedback.
-
|
The |
Beta Was this translation helpful? Give feedback.
-
|
Ok, I found my mistake as soon as you gave some direction. And I'm embarrassed and humbled to say that it was just a dash vs an underscore.... Seems to be great now! Thank you! |
Beta Was this translation helpful? Give feedback.
-
|
Ok, new issue.... I replaced my ssl certs for my home lab. Now I'm seeing the following error when I attempt to authenticate. Looks like rebuilding and restoring a backup returns the issue. Any advise hopefully short of blowing everything away? |
Beta Was this translation helpful? Give feedback.
-
|
It seems setting up OIDC for Mealie with Authentik has sent quite a few of us to our wit's end, and you can add me to that list. Both Mealie and Authentik are running in containers connected to the same network sitting behind NGINX (which is also running in a container). I've set up everything OIDC related as suggested by @nichwall, I get the "Login with OAuth" button and go through the login process in Authentik as expected. The problems start at that point with a spinning loading "bar" and then getting dropped at the Mealie login screen. Looking at Mealie's logs, it looks like Mealie cannot connect to Authentik via my public DNS/IP. I have confirmed by dropping into a shell in the Mealie container that it can resolve the DNS name into my public IP, but all connections to that IP time out. I don't see anything in the NGINX logs, and the Authentik logs say everything worked out fine. The only thing I can think of at this point is a firewall issue, but that doesn't seem right as plenty of other people seem to have gotten this working and my setup can't be that odd. Does anyone have any ideas what I might have wrong or what I should look into? |
Beta Was this translation helpful? Give feedback.
-
|
I finally figured out my issue. It eventually came down to a firewall issue. |
Beta Was this translation helpful? Give feedback.
-
|
I tried to login with my Oauth ID and Mealie says invalid credentials. Here are my mealie env variables. Do I set the user groups in Mealie or Authentik? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @pandaboy6621 , You setup the groups in Authentik. You could test it without setting up the groups, that way Mealie will always accept users (you can always delete them :)). This can help you make sure OIDC onboarding is working, after that start testing the groups |
Beta Was this translation helpful? Give feedback.
-
|
I removed the two lines for the group setup. When I go to log in with my Authentik Credentials, it still says invalid login. When I log in with my existing account, it says that OIDC variables are set correctly. |
Beta Was this translation helpful? Give feedback.
-
|
Can you find anything in the logs? Otherwise, hit me up on the Discord (Deadwalker09) |
Beta Was this translation helpful? Give feedback.
-
|
Ok I got this to work thanks to the OP and this post above: #3334 (reply in thread). Thank you both! Small problem with NPM: when I enable Authentik also as a ForwardAuth for Mealie, when I use OIDC, after authenticating it redirects to # Increase buffer size for large headers
# This is needed only if you get 'upstream sent too big header while reading response
# header from upstream' error when trying to access an application protected by goauthentik
proxy_buffers 8 16k;
proxy_buffer_size 32k;
# Make sure not to redirect traffic to a port 4443
port_in_redirect off;
location / {
# Put your proxy_pass to your application here
proxy_pass $forward_scheme://$server:$port;
# Set any other headers your application might need
# proxy_set_header Host $host;
# proxy_set_header ...
##############################
# authentik-specific config
##############################
auth_request /outpost.goauthentik.io/auth/nginx;
error_page 401 = @goauthentik_proxy_signin;
auth_request_set $auth_cookie $upstream_http_set_cookie;
add_header Set-Cookie $auth_cookie;
# translate headers from the outposts back to the actual upstream
auth_request_set $authentik_username $upstream_http_x_authentik_username;
auth_request_set $authentik_groups $upstream_http_x_authentik_groups;
auth_request_set $authentik_email $upstream_http_x_authentik_email;
auth_request_set $authentik_name $upstream_http_x_authentik_name;
auth_request_set $authentik_uid $upstream_http_x_authentik_uid;
proxy_set_header X-authentik-username $authentik_username;
proxy_set_header X-authentik-groups $authentik_groups;
proxy_set_header X-authentik-email $authentik_email;
proxy_set_header X-authentik-name $authentik_name;
proxy_set_header X-authentik-uid $authentik_uid;
}
# all requests to /outpost.goauthentik.io must be accessible without authentication
location /outpost.goauthentik.io {
proxy_pass http://authentik-server:9000/outpost.goauthentik.io;
# ensure the host of this vserver matches your external URL you've configured
# in authentik
proxy_set_header Host $host;
proxy_set_header X-Original-URL $scheme://$http_host$request_uri;
add_header Set-Cookie $auth_cookie;
auth_request_set $auth_cookie $upstream_http_set_cookie;
proxy_pass_request_body off;
proxy_set_header Content-Length "";
}
# Special location for when the /auth endpoint returns a 401,
# redirect to the /start URL which initiates SSO
location @goauthentik_proxy_signin {
internal;
add_header Set-Cookie $auth_cookie;
return 302 /outpost.goauthentik.io/start?rd=$request_uri;
# For domain level, use the below error_page to redirect to your authentik server with the full redirect path
# return 302 https://authentik.company/outpost.goauthentik.io/start?rd=$scheme://$http_host$request_uri;
} |
Beta Was this translation helpful? Give feedback.
-
|
I have the same problem, but with cloudflare tunnel, it redirects me to localhost:9000 |
Beta Was this translation helpful? Give feedback.
and others
-
This is an example of how to set up OIDC or OAuth for Mealie with Authentik. This guide was written in May 2024 and is provided as a way to get started but information will likely not be kept up to date (there will be edit notes if updates are made).
I recommend Cooptonian's excellent video on setting up OIDC to get started.
Mealie documentation on for OpenID Connect: https://docs.mealie.io/documentation/getting-started/authentication/oidc/
Mealie documentation for environment variables: https://docs.mealie.io/documentation/getting-started/installation/backend-config/#openid-connect-oidc
This post is just how I got it set up for my setup, I am not well versed in everything you can do so hopefully other people can help you in the comments if you have problems.
First, I set the
Namefield to something description. For this, I useMealie Demo. Set theAuthentication flowandAuthorization flowas desired for your setup. Change theProtocol Settingsto "Public", and set theRedirect URI/Originsas desired. For example, if your Mealie instance is located athttps://mealie.cooldomain.com, you can use a Redirect ashttps://mealie.cooldomain.com/login.In
Advanced protocol settingsI changed theSubject Modeto be "Based on User's Email" because that's how I set up my user accounts. Make sure you have all of the required scopes that the Mealie documentation mentions.I then made an Application named
Mealie Demo Appand set the Provider toMealie Demo. After setting the application for the provider, the information in the gray boxes should all fill out. You can then use this information to set environment variables for your Mealie installation. Most of the information can be gotten from the Provider details page. You can verify the client type is public at(A), get the Client ID at(B), verify the Redirect at(C), and get the OIDC Configuration URL at(D). At the time of writing, you only needBandDfor the Mealie environment variables.An example of the environment variables in a Docker compose is included below using information from the Provider detail page. I have two groups in Authentik,
my_familyfor regular Mealie users andmealie Admins. These can be entered directly in the environment variables. You will need to change the OIDC variables according to your setup and based on updates to the Mealie documentation.Beta Was this translation helpful? Give feedback.
All reactions