XCP-ng
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    OIDC not redirecting back to XO

    Scheduled Pinned Locked Moved Xen Orchestra
    22 Posts 4 Posters 3.6k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • maxcernyM Offline
      maxcerny
      last edited by

      Still haven't been able to get it working... Any suggestions?

      1 Reply Last reply Reply Quote 0
      • olivierlambertO Offline
        olivierlambert Vates 🪐 Co-Founder CEO
        last edited by

        XO works well with a reverse proxy, so I would ask Authelia community I think. I don't see any reason it shouldn't work 🤔

        maxcernyM 1 Reply Last reply Reply Quote 1
        • maxcernyM Offline
          maxcerny @olivierlambert
          last edited by

          @olivierlambert I got a bit further, but now I'm getting an internal server error when I get redirected back.

          S 1 Reply Last reply Reply Quote 0
          • S Offline
            sluflyer06 @maxcerny
            last edited by

            @maxcerny maybe post the config you are using? I use OIDC with Google for XO and it worked right out of the gate.

            maxcernyM 1 Reply Last reply Reply Quote 0
            • maxcernyM Offline
              maxcerny @sluflyer06
              last edited by

              @sluflyer06
              authelia client config:
              e14b6fa1-32c0-46b7-b1e4-35471937ea1d-image.png

              XO OIDC config:
              faf23cd1-5ad5-4127-abf1-ec5feb43973e-image.png

              1 Reply Last reply Reply Quote 0
              • maxcernyM Offline
                maxcerny
                last edited by

                Not really sure which scopes I should be using tho. might be the issue.

                1 Reply Last reply Reply Quote 0
                • olivierlambertO Offline
                  olivierlambert Vates 🪐 Co-Founder CEO
                  last edited by

                  Have you asked Authelia community? Sounds like more a configuration tuning than anything else 🙂

                  maxcernyM 1 Reply Last reply Reply Quote 0
                  • maxcernyM Offline
                    maxcerny @olivierlambert
                    last edited by

                    @olivierlambert I haven't, but considering the issue is only with xen orchestra, which has 0 documentation on the oidc plugin I don't think they will be of much help.

                    1 Reply Last reply Reply Quote 0
                    • olivierlambertO Offline
                      olivierlambert Vates 🪐 Co-Founder CEO
                      last edited by

                      Our OIDC plugin is very standard, as far OIDC is. We detailed how to use it with Keycloak (with screenshots), if you can have people from Authelia with some knowledge on what fields to fill, that would be wonderful. Keep us posted, we'll be happy to have your steps in our documentation 🙂

                      maxcernyM 1 Reply Last reply Reply Quote 0
                      • maxcernyM Offline
                        maxcerny @olivierlambert
                        last edited by

                        @olivierlambert I was able to get some logs from xen orchestra.

                        Expected values to be strictly equal:
                        + actual - expected
                        
                        + 'undefined'
                        - 'string'
                        

                        But no additional information.

                        julien-fJ 1 Reply Last reply Reply Quote 0
                        • olivierlambertO Offline
                          olivierlambert Vates 🪐 Co-Founder CEO
                          last edited by

                          Ah! That's interesting 🙂

                          Ping @julien-f

                          maxcernyM 1 Reply Last reply Reply Quote 0
                          • maxcernyM Offline
                            maxcerny @olivierlambert
                            last edited by

                            @olivierlambert could you point me in the keycloak configuration direction?

                            1 Reply Last reply Reply Quote 0
                            • olivierlambertO Offline
                              olivierlambert Vates 🪐 Co-Founder CEO
                              last edited by

                              See https://xen-orchestra.com/blog/xen-orchestra-5-80/

                              1 Reply Last reply Reply Quote 0
                              • julien-fJ Offline
                                julien-f Vates 🪐 Co-Founder XO Team @maxcerny
                                last edited by

                                @maxcerny I believe the username field is incorrect, it should be one of displayName, username or email).

                                Make sure your plugin is up-to-date because it is documented.

                                17e7fc12-7b56-4d78-8fdf-42906dc685f0-image.png

                                maxcernyM 1 Reply Last reply Reply Quote 0
                                • maxcernyM Offline
                                  maxcerny @julien-f
                                  last edited by

                                  @julien-f tried it, no dice

                                  Also according to the authelia docs: https://www.authelia.com/integration/openid-connect/introduction/#profile

                                  the claim is preferred_username

                                  julien-fJ 1 Reply Last reply Reply Quote 0
                                  • julien-fJ Offline
                                    julien-f Vates 🪐 Co-Founder XO Team @maxcerny
                                    last edited by

                                    @maxcerny username is preferred_username in XO.

                                    We weren't explicitly using the profile scope, please test the oidc-scope-profile branch.

                                    maxcernyM 2 Replies Last reply Reply Quote 0
                                    • maxcernyM Offline
                                      maxcerny @julien-f
                                      last edited by

                                      @julien-f yes, this branch works.
                                      guess it was a scoping issue then.

                                      When about can I expect an update to the master branch? I'm currently running xo in docker and don't really want to glue together different plugin versions.

                                      1 Reply Last reply Reply Quote 0
                                      • maxcernyM Offline
                                        maxcerny @julien-f
                                        last edited by

                                        @julien-f just a clarification, it works with username, not preferred username

                                        julien-fJ 1 Reply Last reply Reply Quote 0
                                        • julien-fJ Offline
                                          julien-f Vates 🪐 Co-Founder XO Team @maxcerny
                                          last edited by

                                          @maxcerny I've made some changes to make scopes configurable, if you could test it to make sure it works, that would be great. (same branch, commit da14bab)

                                          julien-fJ 1 Reply Last reply Reply Quote 0
                                          • julien-fJ Offline
                                            julien-f Vates 🪐 Co-Founder XO Team @julien-f
                                            last edited by

                                            @maxcerny Have you been able to test the latest version?

                                            julien-fJ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post