Login failed with OIDC Provider Authelia

[catfishlty]

Info

• Platform: Self-hosted Docker
• Version: 1.133.0
• OS: Windows 11
• Browser: Chrome
• Authelia Version: 4.39.10

Bug Description

Configs

Lobe Chat Database

services:
  lobe:
    image: lobehub/lobe-chat-database:latest
    container_name: lobe-chat-server
    #ports:
    #  - '3210:3210'
    depends_on:
      - db
    volumes:
      - /etc/ssl/certs:/etc/ssl/certs:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/datetime:/etc/datetime:ro
      - /etc/localtime:/etc/localtime:ro
    environment:
      - APP_URL=https://lobe.example.com
      - KEY_VAULTS_SECRET=xxx
      - DATABASE_URL=postgresql://xxx:xxx@lobe-db:5432/lobe
      - NEXT_PUBLIC_ENABLE_NEXT_AUTH=1
      - NEXT_AUTH_SECRET=xxx
      - NEXT_AUTH_SSO_PROVIDERS=authelia
      - AUTH_AUTHELIA_ID=<oicd-client-id>
      - AUTH_AUTHELIA_SECRET=<oicd-insecure-secret>
      - AUTH_AUTHELIA_ISSUER=https://auth.example.com
      - NEXTAUTH_URL=https://lobe.example.com/api/auth
      - PROXY_URL=xxx
      - ...
    restart: always
    labels:
      - traefik.enable=true
      - traefik.http.routers.lobe-chat-server.tls=true
      - traefik.http.routers.lobe-chat-server.tls.certresolver=letsencrypt
      - traefik.http.routers.lobe-chat-server.rule=Host(`lobe.example.com`)
      - traefik.http.routers.lobe-chat-server.entrypoints=web-secure
      - traefik.http.services.lobe-chat-server.loadbalancer.server.port=3210
      - traefik.http.routers.lobe-chat-server.middlewares=authelia@docker
  db:
    image: pgvector/pgvector:pg16
    container_name: lobe-db
    volumes:
      - /etc/ssl/certs:/etc/ssl/certs:ro
      - /etc/timezone:/etc/timezone:ro
      - /etc/datetime:/etc/datetime:ro
      - /etc/localtime:/etc/localtime:ro
      - ./postgres/data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=lobe
      - POSTGRES_PASSWORD=xxx
    healthcheck:
      test:
        - CMD-SHELL
        - pg_isready -U postgres
      interval: 5s
      timeout: 5s
      retries: 5
    restart: always

Authelia OIDC configs

identity_providers:
  oidc:
    clients:
      - client_name: 'Lobe Chat'
        client_id: '<oicd-client-id>'
        client_secret: '<oicd-secret>'
        authorization_policy: 'one_factor'
        public: false
        redirect_uris:
          - 'https://lobe.example.com/api/auth/callback/authelia'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        userinfo_signed_response_alg: 'none'

Reproduce

• Click Login: Auto choose Authelia method.
• GET https://lobe.example.com/api/auth/providers 200 OK

  {
    "authelia": {
        "id": "authelia",
        "name": "Authelia",
        "type": "oidc",
        "signinUrl": "https://lobe.example.com/api/auth/signin/authelia",
        "callbackUrl": "https://lobe.example.com/api/auth/callback/authelia"
     }
  }

• POST https://lobe.example.com/api/auth/signin/authelia? 200 OK
  • Response Header: Location

  https://auth.example.com/api/oidc/authorization?response_type=code&client_id=<oicd-client-id_url-encoded>&redirect_uri=https%3A%2F%2Flobe.example.com%2Fapi%2Fauth%2Fcallback%2Fauthelia&scope=openid+email+profile&state=<state>&code_challenge=<code-challenge>&code_challenge_method=S256
  

• GET https://auth.example.com/api/oidc/authorization?response_type=code&client_id=<oicd-client-id_url-encoded>&redirect_uri=https%3A%2F%2Flobe.example.com%2Fapi%2Fauth%2Fcallback%2Fauthelia&scope=openid+email+profile&state=eyJh...Pvi4&code_challenge=&code_challenge_method=S256 302 FOUND
  • Response Header: Location

  https://auth.example.com/consent/openid/decision?flow=openid_connect&flow_id=<authelia-flow-id>
  

• GET https://auth.example.com/consent/openid/decision?flow=openid_connect&flow_id= 200 OK
• Login in Authelia Page
• GET
  https://auth.example.com/api/oidc/authorization?client_id=&code_challenge=&code_challenge_method=S256&consent_id=&redirect_uri=https%3A%2F%2Flobe.example.com%2Fapi%2Fauth%2Fcallback%2Fauthelia&response_type=code&scope=openid+email+profile&state= 303 See Other
  • Response Header: Location

  https://lobe.example.com/api/auth/callback/authelia?code=authelia_ac_lzGM...Dibk&iss=https%3A%2F%2Fauth.example.com&scope=openid+email+profile&state=<state>
  

• GET https://lobe.example.com/api/auth/callback/authelia?code=authelia_ac_lzGM...Dibk&iss=https%3A%2F%2Fauth.example.com&scope=openid+email+profile&state= 302 FOUND
  • Response Header: Location

  https://lobe.example.com/next-auth/error?error=Configuration
  

• GET https://lobe.example.com/next-auth/error?error=Configuration 200 OK

Error logs in Lobe Chat Database Container

lobe-chat-server  | [auth][error] AdapterError: Read more at https://errors.authjs.dev#adaptererror
lobe-chat-server  | [auth][cause]: SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON
lobe-chat-server  |     at JSON.parse (<anonymous>)
lobe-chat-server  |     at parseJSONFromBytes (node:internal/deps/undici/undici:6433:19)
lobe-chat-server  |     at successSteps (node:internal/deps/undici/undici:6414:27)
lobe-chat-server  |     at readAllBytes (node:internal/deps/undici/undici:5380:13)
lobe-chat-server  |     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
lobe-chat-server  | [auth][details]: {}
lobe-chat-server  | [auth][error] AdapterError: Read more at https://errors.authjs.dev#adaptererror
lobe-chat-server  | [auth][cause]: SyntaxError: Unexpected token '<', "<!DOCTYPE "... is not valid JSON
lobe-chat-server  |     at JSON.parse (<anonymous>)
lobe-chat-server  |     at parseJSONFromBytes (node:internal/deps/undici/undici:6433:19)
lobe-chat-server  |     at successSteps (node:internal/deps/undici/undici:6414:27)
lobe-chat-server  |     at readAllBytes (node:internal/deps/undici/undici:5380:13)
lobe-chat-server  |     at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
lobe-chat-server  | [auth][details]: {}

Could you please help check and solve it?

I'm not sure is it the issue from lobe chat or from nextauth.