v2.3.3

[0xJacky]

🎉 Features

• Integrate DNS record management into site configuration (feat: Integrate DNS record management into site configuration #1519) by @NemerYTamimi
• Support OIDC login (Support SSO login via OIDC #1488) by @Jraaay
• Implement PID path extraction from nginx -T output by @0xJacky
• Add Termux build support and update build configuration (Termux support? #1479) by @0xJacky
• Refactor title generation for LLM sessions (AI Chat Generate Title Error #1540) by @0xJacky

🐛 Bug Fixes

• Add WebDAV methods (PROPFIND, PROPPATCH, MKCOL, etc.) to ValidHTTPMethods (Propfind method logging #1546) by @0xJacky
• Explicitly negotiate Docker API version to ensure compatibility (Docker client version update #1543) by @0xJacky
• Fix image paths and enhance Japanese translations (Fix image paths and enhance Japanese translations #1541) by @mumeinosato
• Change input type from 'number' to 'numeric' (Change input type from 'number' to 'numeric' #1499) by @heintz06
• Fix Nginx duplicate includes (Nginx duplicate includes #1550) by @0xJacky
• Fix Access log dark mode font (Access log dark mode font #1545) by @0xJacky
• Disable dead links check for Weblate translation by @Hintay

❤️ Contributors

@0xJacky
@Jraaay
@NemerYTamimi
@mumeinosato
@heintz06
@Hintay
@renovate[bot]
@weblate

---

This discussion was created from the release v2.3.3.

[Morethanevil]

Has anyone got OIDC working with Authentik?

The example for the redirect URI in the docs is not useful, I use Authentik over HTTPS for multiple servers. If I set the redirect URI to the URL of the NGINX-UI (https://my.domain.com), I get this error:

Redirect URI Error

The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).

In the browser console I see that it tries to call the URL https://my.domain.com/api/oidc_callback
I tried this too, but then I get this error:

My OIDC config:

[oidc]
ClientId     = id
ClientSecret = secret
Endpoint     = https://sso.domain.com/application/o/nginx-ui/
RedirectUri  = https://my.domain.com/api/oidc_callback
Scopes       = openid profile email username
Identifier   = username

In Authentik the URI https://my.domain.com/api/oidc_callback is set as a strict redirect URI
What am I doing wrong?

[Jraaay]

Your initial attempt to set the RedirectUri to the root directory of NginxUI was correct. The /api/oidc_callback path is an internal authentication interface called by the frontend and is not intended for external SSO integration. Regarding the issue where authentik prevents setting https://my.domain.com as the RedirectUri, I will run some tests and update you once I have more information.

[Jraaay]

I'm running authentik 2025.12.4 (@localhost:9000) and NginxUI (@localhost:19000) locally, and it's working fine with this configuration:

[Morethanevil]

Nope, I get a CORS error with this settings, can you try over HTTPS please?

[Jraaay]

Nope, I get a CORS error with this settings, can you try over HTTPS please?

It also works correctly in HTTPS environments. Please check your configuration.

[Morethanevil]

Tried again, I am still getting CORS errors... I use this for accessing the nginx-ui, do I have errors here?

# Redirect HTTP zu HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name nginx.mydomain.com;
    return 301 https://$host$request_uri;
}
# HTTPS über TCP (HTTP/2)
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    listen 443 quic;
    listen [::]:443 quic;
    server_name nginx.mydomain.com;
    http2 on;
    http3 on;
    http3_hq on;
    quic_retry on;
    # Allow special characters in headers
    ignore_invalid_headers off;
    # Allow any size file to be uploaded.
    # Set to a value such as 1000m; to restrict file size to a specific value
    client_max_body_size 0;
    # Buffering deaktivieren, falls benötigt
    # proxy_buffering off;
    # proxy_request_buffering off;
    ssl_certificate /etc/nginx/ssl/mydomain/fullchain.cer;
    ssl_certificate_key /etc/nginx/ssl/mydomain/private.key;
    ssl_protocols TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;
    ssl_prefer_server_ciphers off;
    ssl_early_data on;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;
    add_header Alt-Svc 'h3=":443"; ma=86400';
    add_header Strict-Transport-Security "max-age=6307200" always;
    ssl_stapling on;
    ssl_stapling_verify on;
    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        # Websockets
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_pass http://localhost:9000;
    }
}

Authentik:

The nginx-ui is the only application where I get those errors. What am I missing or doing wrong? I get 403 and 400 as status messages when trying to log in via OIDC. Login via email / password works fine, and all checks are passed on the self check inside the UI