Setting up a new Trilium Instance - OIDC

[brhahlen]

Hello!

Looking into using Trilium and trying to setup the server.
Setting up is a breeze, but I can't get OAuth/OIDC to work properly.

My compose looks like this:

  trilium:
    extends:
      file: ../shared.yml
      service: pubnet-shared
    container_name: trilium
    hostname: trilium
    image: ghcr.io/triliumnext/trilium:latest
    env_file: trilium.env
    volumes:
      - ${CONF_DIR}/trilium/data:/home/node/trilium-data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      ## HTTP Routers
      - "traefik.http.routers.trilium.entrypoints=websecure"
      - "traefik.http.routers.trilium.rule=Host(`trilium.${DOMAINNAME}`)"
      ## Middlewares
      - "traefik.http.routers.trilium.middlewares=secure-headers"
      ## HTTP Services
      - "traefik.http.routers.trilium.service=trilium"
      - "traefik.http.services.trilium.loadbalancer.server.port=8080"

And the trilium.env like this:

# OIDC
TRILIUM_GENERAL_NOAUTHENTICATION=true
TRILIUM_OAUTH_BASE_URL=https://trilium.domain.com
TRILIUM_OAUTH_CLIENT_ID=IDGOESHERE
TRILIUM_OAUTH_CLIENT_SECRET=SECRETGOESHERE
TRILIUM_OAUTH_ISSUER_BASE_URL=https://auth.domain.com/application/o/trilium/.well-known/openid-configuration
TRILIUM_OAUTH_ISSUER_NAME=Authentik

From how I understand the docs, I need to start the server and do not initialize it.
Then, I need to setup the Desktop Client (Windows, in my case) and set it up to sync with the Server.

That all seems to work.
However, when I then go to the Web UI, it will not prompt me for a OAUTH login, but asks me to create a password.
Am I doing something wrong?

Thanks!

[brhahlen]

Related to #5847

[raftilu]

If I understand correctly, the OAuth login is only for the web instance and the desktop instance use a username/password login despite everything. For this reason you still need to configure a password during the server setup to make the sync work. I am not very familiar with the program and some aspect are not working as I would expect (why have a username if there is no multi-user support ?), so please excuse me if I mislead you on this.

[perfectra1n]

What happens if you create a password for initializing Trilium? After initialization, does OIDC work as expected? When starting a brand new server, I don't believe the logic currently checks if OIDC is enabled -> bypass password setup during initialization. Where in the docs did it say to not initialize Trilium when using OIDC?

If not, after you initialize Trilium and then restart the server, does OIDC work as expected?

The desktop client does not use a username/password. The desktop instance asks for a password when initializing from a server, which will need to be the same password as you entered in when initializing the server.

[brhahlen]

What happens if you create a password for initializing Trilium? After initialization, does OIDC work as expected? When starting a brand new server, I don't believe the logic currently checks if OIDC is enabled -> bypass password setup during initialization. Where in the docs did it say to not initialize Trilium when using OIDC?

If not, after you initialize Trilium and then restart the server, does OIDC work as expected?

The desktop client does not use a username/password. The desktop instance asks for a password when initializing from a server, which will need to be the same password as you entered in when initializing the server.

It doesn't say anywhere in the docs not to initialize Trilium when using OIDC, but then again, the docs say that using Authentik is not yet supported.
Also just saw that SSO_ENABLED environment variable from this page, which might have helped.

My expectation would be that when I fill the environment variables for OIDC, they would also be propagated to the config.ini, which doesn't seem to be happening.

Have cleared the settings from the directory, used this for Environment variables:

TRILIUM_OAUTH_BASE_URL=https://trilium.domain.com
TRILIUM_OAUTH_CLIENT_ID=CLIENTID
TRILIUM_OAUTH_CLIENT_SECRET=CLIENTSECRET
TRILIUM_OAUTH_ISSUER_BASE_URL=https://auth.domain.com/application/o/trilium/.well-known/openid-configuration
TRILIUM_OAUTH_ISSUER_NAME=Authentik
TRILIUM_OAUTH_ISSUER_ICON=https://auth.domain.com/media/logo.png

Removed and restarted the container, and went to the web to initialize the application.
Created a password, and then went into settings to enable MFA and OIDC.
Restarted the application, and got the "Sign in with Authentik" button (which looks a bit weird):

Signed in and it worked! For some reason!

Now, I think the confusion I had was that the values in the config.ini were not being filled, even though the environment variables were properly propagated.
On the MFA/OIDC page, you also don't get hints on which provider you are using, which might be an improvement. At least that way you are aware of the fact that the values have been propagated properly.

But it works now, so I'm happy abou that!
Now to further explore Trilium!

Thanks!

[perfectra1n]

I'm not sure what you mean to "propagated to the config.ini" - the server's settings are created by merging the environment variables and the config.ini values together, with priority given to the environment variables. So you won't see the environment variables that you were setting magically float into the config.ini file. Glad you were able to get it working!

[brhahlen]

@perfectra1n
By "propagated" I indeed meant that the ENV variables would be added to the config.ini file.

Thanks again! Just imported notes from Joplin, now trying everything :)

[Ziang-Cui]

Meeting the same problem, including BadRequestError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)) and stack.sum error : (
After clear all previoud data and create a new pod with necessary envs, problem resolved: )

[SeadogsBooty]

Here's what worked for me:
I set all of the following environment variables for the Trilium container

TRILIUM_OAUTH_BASE_URL=https://trilium.domain.com
TRILIUM_OAUTH_CLIENT_ID=CLIENTID
TRILIUM_OAUTH_CLIENT_SECRET=CLIENTSECRET
TRILIUM_OAUTH_ISSUER_BASE_URL=https://auth.domain.com/application/o/trilium/.well-known/openid-configuration
TRILIUM_OAUTH_ISSUER_NAME=Authentik
TRILIUM_OAUTH_ISSUER_ICON=https://auth.domain.com/media/public/application-icons/logo.png

Here's the kicker. I kept getting errors when clicking on the "Sign in with Authentik". Everything seemed to be working except the authentication piece back to Authentik through the Redirect URL.
I removed the Redirect URL from the Authentik Provider for Trilium and that worked!
After a successful login, I checked the Authentik Provider Redirect URL and it was listed as follows:
https://trilium.domain.com/callback

I hope this helps someone!

[Guruleenyc]

Here's what worked for me:
I set all of the following environment variables for the Trilium container

TRILIUM_OAUTH_BASE_URL=https://trilium.domain.com
TRILIUM_OAUTH_CLIENT_ID=CLIENTID
TRILIUM_OAUTH_CLIENT_SECRET=CLIENTSECRET
TRILIUM_OAUTH_ISSUER_BASE_URL=https://auth.domain.com/application/o/trilium/.well-known/openid-configuration
TRILIUM_OAUTH_ISSUER_NAME=Authentik
TRILIUM_OAUTH_ISSUER_ICON=https://auth.domain.com/media/public/application-icons/logo.png

Here's the kicker. I kept getting errors when clicking on the "Sign in with Authentik". Everything seemed to be working except the authentication piece back to Authentik through the Redirect URL.
I removed the Redirect URL from the Authentik Provider for Trilium and that worked!
After a successful login, I checked the Authentik Provider Redirect URL and it was listed as follows:
https://trilium.domain.com/callback

I hope this helps someone!

I'm trying to get Triliumnext to use Authentik for authentication as well.
I've been stuck on getting nginx Authentik-server.conf with a proxy outpost...
My triliumnext is currently configured with top and not openID.
I will try the what you did.

[Guruleenyc]

Looking under the MFA settings in triliumnext, when you tick on the openID option, the following verbiage is presented. It even states the default issuer is Google:

"OpenID is a standardized way to let you log into websites using an account from another service, like Google, to verify your identity. The default issuer is Google, but you can change it to any other OpenID provider. Check here for more information. Follow these instructions to setup an OpenID service through Google."

So why are my docker containing variables not being respected for Authentik instead?

[perfectra1n]

Do the values look like the ones here? https://github.com/orgs/TriliumNext/discussions/6258#discussioncomment-13796966

Also what if you don’t specify the OIDC environment variables and just the environment variables in that comment?

The previous comments in this thread that have it working don’t show any OIDC variables, do you need those for your instance?

[perfectra1n]

Can you share a screenshot of the variables that show when doing a “env | grep TRILIUM” from the container, maybe you have other misspellings?

[Guruleenyc]

I also opened this trillium issue here: #6444

I don't have a redirect URL specified in Authentik for the triliumnext app. I tried it with and without.

[Guruleenyc]

Can you share a screenshot of the variables that show when doing a “env | grep TRILIUM” from the container, maybe you have other misspellings?

Here's the output. I redacted my client ID and client key, and masked my domain name for security reasons 😎:

docker exec -it triliumnext sh /usr/src/app # env | grep TRILIUM TRILIUM_OAUTH_BASE_URL=https://notes.mydomain com TRILIUM_OIDC_USERINFO_URL=https://authentik.mydomain com/application/o/userinfo/ TRILIUM_OIDC_AUTHORIZATION_URL=https://authentik.mydomain.com/application/o/authorize/ TRILIUM_OIDC_TOKEN_URL=https://authentik.mydomain com/application/o/token/ TRILIUM_OAUTH_ISSUER_NAME=Authentik TRILIUM_OAUTH_CLIENT_ID=i64UVAaxxxxxxxxxxxxxxx TRILIUM_OAUTH_CLIENT_SECRET=yLJH10bPxxxxxxxxxxxxxxxxxxxxxx TRILIUM_OIDC_ISSUER=https://authentik.mydomain.com/application/o/triliumnext/