Help setting up SSO/OIDC with Authentik

[dhop90]

Trying to configure SSO/OIDC using ghcr.io/enchant97/note-mark-aio:0.16.2 with Authentik as authentication provider is not working.

Upon trying to login via Authentik, it errors with "Error exchanging details with provider."

Note-mark configuration

        - env:
            - name: CORS_ORIGINS
              value: https://notemark.example.org
            - name: DB__TYPE
              value: postgres
            - name: DB__URI
              value: >-
                host=qnap.example.org user=notemark
                password=<password> dbname=notemark port=5432
                sslmode=disable TimeZone=America/Chicago
            - name: JWT_SECRET
              value: <secret>
            - name: OIDC__DISPLAY_NAME
              value: Authentik
            - name: OIDC__PROVIDER_NAME
              value: authentik
            - name: OIDC__ISSUER_URL
              value: https://auth.example.org/application/o/notemark/
            - name: OIDC__CLIENT_ID
              value: <client ID>
            - name: OIDC__ENABLE_USER_CREATION
              value: 'false'
            - name: ENABLE_INTERNAL_SIGNUP
              value: 'false'
            - name: ENABLE_INTERNAL_LOGIN
              value: 'true'
            - name: OIDC__EMAIL_FIELD
              value: email
            - name: OIDC__NAME_FIELD
              value: name
            - name: OIDC__SCOPES
              value: openid profile email notemark-claims

Authentik config:

Name
notemark
Assigned to application
[notemark](https://auth.example.org/if/admin/#/core/applications/notemark)
Client type
Public
Client ID
<client ID>
Redirect URIs
strict: https://notemark.example.org/oidc-callback

OpenID Configuration URL 
https://auth.example.org/application/o/notemark/.well-known/openid-configuration
OpenID Configuration Issuer 
https://auth.example.org/application/o/notemark/

For the life of me, I can't get this working.

[enchant97]

Sorry to hear you are having a problem. Looking at your config, seems like everything that should be there is correct.

There are a few possibilities that I can think of:

1. client id is incorrect
2. Issuer url is incorrect
3. OIDC__ENABLE_USER_CREATION needs to be true if the oidc mapping & user have not been manually created
4. Your browser is not storing the state/pkce is localstorage

As a side note I have noticed you have specified OIDC__EMAIL_FIELD, OIDC__NAME_FIELD and OIDC__SCOPES. These are not valid configuration values.

I can't think of anything else. Just verified my own setup with latest version of Authentik (2025.6.1) and it works correctly. Maybe something not related to Note Mark is setup incorrectly, which I do not offer any support for.

[dhop90]

thanks for the reply. What is the --user-sub when trying to map the user to oidc with the cli command?

/note-mark user add-oidc-mapping --username <value> --user-sub <value>

[enchant97]

That's the user id from your auth provider. On Authentik you can find a users one via the admin interface: Applications -> Provider -> {Name} -> Preview -> sub.

[dhop90]

Thanks, got it working!

Not sure if it's required, but I made several other changes to the provider:

Authorization flow: default-provider-authorization-implicit-consent
Client type: Public
Signing Key: set
Encryption Key: not set
Authentication flow: default-authetication-flow