v0.7.8 - REGRESSION - Error: Unknown authentication strategy "openid"

[dkindlund]

What happened?

After upgrading from v0.7.8-rc1 to v0.7.8, all openid authentication failed. Here's the error my users are seeing when clicking on Continue with OpenID button:

Error: Unknown authentication strategy "openid"
    at attempt (/app/node_modules/passport/lib/middleware/authenticate.js:193:39)
    at authenticate (/app/node_modules/passport/lib/middleware/authenticate.js:370:7)
    at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
    at next (/app/node_modules/express/lib/router/route.js:149:13)
    at Route.dispatch (/app/node_modules/express/lib/router/route.js:119:3)
    at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
    at /app/node_modules/express/lib/router/index.js:284:15
    at Function.process_params (/app/node_modules/express/lib/router/index.js:346:12)
    at next (/app/node_modules/express/lib/router/index.js:280:10)
    at /app/api/node_modules/express-rate-limit/dist/index.cjs:752:7

YAML has:

# Example Registration Object Structure (optional)
registration:
  socialLogins: ['google', 'openid']

I have no idea what changed.

Version Information

v0.7.8

Steps to Reproduce

1. Configure v0.7.8-rc1 working with OpenID
2. Upgrade to v0.7.8
3. See that logins to OpenID fail with Internal Server Error

What browsers are you seeing the problem on?

Chrome

Relevant log output

Error: Unknown authentication strategy "openid"
    at attempt (/app/node_modules/passport/lib/middleware/authenticate.js:193:39)
    at authenticate (/app/node_modules/passport/lib/middleware/authenticate.js:370:7)
    at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
    at next (/app/node_modules/express/lib/router/route.js:149:13)
    at Route.dispatch (/app/node_modules/express/lib/router/route.js:119:3)
    at Layer.handle [as handle_request] (/app/node_modules/express/lib/router/layer.js:95:5)
    at /app/node_modules/express/lib/router/index.js:284:15
    at Function.process_params (/app/node_modules/express/lib/router/index.js:346:12)
    at next (/app/node_modules/express/lib/router/index.js:280:10)
    at /app/api/node_modules/express-rate-limit/dist/index.cjs:752:7

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[dkindlund]

I suspect the root cause of this regression is likely due to changes based on this PR:
#6741

[danny-avila]

The PR you linked is not even merged. You may be missing some configuration items:

#674

[dkindlund]

The PR you linked is not even merged. You may be missing some configuration items:

#674

Hey @danny-avila, I understand that the PR may not be relevant, but I don't think it's a configuration issue -- my current config was working perfectly in v0.7.8-rc1, but somehow when upgrading from v0.7.8-rc1 to v0.7.8 these errors started appearing.

Was there a functional change made in the OpenID config between v0.7.8-rc1 and v0.7.8? Based on the documentation, I don't think so, but feel free to correct me if I'm wrong here. Thanks!

[danny-avila]

Thank you for the detailed report with error logs. I've thoroughly investigated this issue, and I can confidently state there were absolutely no OpenID configuration changes between v0.7.8-rc1 and v0.7.8.

Evidence Supporting My Conclusion

I've personally analyzed:

1. All Code Differences: I examined the git diff between these specific tags and found no modifications to the OpenID authentication system:

   git diff v0.7.8-rc1..v0.7.8 -- api/strategies/openidStrategy.js
   git diff v0.7.8-rc1..v0.7.8 -- api/server/middleware/auth.js

2. Official Changelog: The CHANGELOG.md for v0.7.8 explicitly documents all changes from v0.7.8-rc1, which include form submissions, Tavily API parameters, Python in Dockerfile, and various fixes - but nothing related to OpenID.

3. Usage Data: This would be a widespread issue affecting our large OpenID user base if there were any breaking changes - yet you're the first to report this specific problem with v0.7.8.

Root Cause Analysis

The error Unknown authentication strategy "openid" specifically indicates that Passport.js can't find the OpenID strategy when it's being called. Since your setup worked perfectly with v0.7.8-rc1, this strongly suggests an issue with how the Docker container is initializing in your specific environment.

Action Steps

Since you're using Docker, I recommend:

1. Clean Docker Environment:

   # Stop your current containers
   docker-compose down
   
   # Remove any cached images to ensure clean rebuild
   docker system prune -a --volumes
   
   # Pull the specific working tag you had before
   docker pull ghcr.io/danny-avila/librechat:v0.7.8-rc1
   
   # Edit your docker-compose.yml to use specific tag
   # Change: image: ghcr.io/danny-avila/librechat:latest
   # To: image: ghcr.io/danny-avila/librechat:v0.7.8-rc1
   
   # Start with clean state
   docker-compose up -d

2. Test Known Working Version First:
   Confirm that v0.7.8-rc1 still works correctly in a clean environment. Then try v0.7.8 with the same exact configuration.

3. Verify Docker Volume Persistence:
   Make sure your docker-compose setup correctly persists environment variables and doesn't reset crucial configurations.

4. Environment Variables Check:
   Double-check that all your OpenID variables are correctly passed to the container:

   OPENID_CLIENT_ID
   OPENID_CLIENT_SECRET
   OPENID_ISSUER
   OPENID_SCOPE
   OPENID_SESSION_SECRET
   OPENID_CALLBACK_URL
   

5. Check OpenID Provider Side:
   Verify that your OpenID provider hasn't made any changes to their service since you last tested with v0.7.8-rc1.

I'm confident this is an isolated environment issue with your Docker setup rather than a regression in the codebase itself. Let me know the results after trying these steps with the specific tags.

[psychomelet]

Following a recent update to the latest version of Docker, our previously functional Authentik OpenID authentication is now failing.

User will see webpage shown as "Internal Server Error" at location of "https://domain.ltd/oauth/openid/callback?code=xxx&state="

Error log is a little different though:

ClientError: invalid response encountered
    at e (file:///app/api/node_modules/openid-client/build/index.js:116:12)
    at errorHandler (file:///app/api/node_modules/openid-client/build/index.js:139:23)
    at Module.authorizationCodeGrant (file:///app/api/node_modules/openid-client/build/index.js:916:21)
    at CustomOpenIDStrategy.authorizationCodeGrant (file:///app/api/node_modules/openid-client/build/passport.js:135:41)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)

[rubentalstra]

@danny-avila i have spotted an issue. In my PR regarding the OpenID strategy I did not upgraded to v6 but kept to v5 latest because it only supports ESM from v6

https://github.com/panva/openid-client?tab=readme-ov-file#supported-versions

So that explains this issue right here.

It also explains the other issue that it can't find the package because it's commonJS and not ESM.

[danny-avila]

The link you pointed to has a footnote:

CJS style let client = require('openid-client') is possible in Node.js versions where the require(esm) feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0). ↩ ↩2

This is correct in my experience, as the docker build is on node v20.19.2:

and I'm able to use OpenID (using Okta, Entra):

LibreChat         | 2025-05-25T20:52:17.783Z info: Configuring social logins...
LibreChat         | 2025-05-25T20:52:17.784Z info: Configuring OpenID Connect...
LibreChat         | 2025-05-25T20:52:18.154Z info: OpenID Connect configured.

[danny-avila]

@psychomelet You might be having a separate issue with state parameter being undefined. I'm adding a change that will make sure random state is defined, as it fixed an issue I had with Okta (only on openid-client v6).

[danny-avila]

@psychomelet I just tried Authentik and got the same error as you before my fix:

ClientError: invalid response encountered
    at e (file:///home/danny/LibreChat/api/node_modules/openid-client/build/index.js:116:12)
    at errorHandler (file:///home/danny/LibreChat/api/node_modules/openid-client/build/index.js:139:23)
    at Module.authorizationCodeGrant (file:///home/danny/LibreChat/api/node_modules/openid-client/build/index.js:916:21)
    at CustomOpenIDStrategy.authorizationCodeGrant (file:///home/danny/LibreChat/api/node_modules/openid-client/build/passport.js:135:41)

I can confirm that after my fix, it works:

2025-05-26T01:44:45.638Z info: [openidStrategy] user not found with openidId: c21d081a43f2997378615339f5b04460b3c7bbaf268d7bb500b48a9a5097ca31
2025-05-26T01:44:45.651Z info: [openidStrategy] user found with email: [email protected] for openidId: c21d081a43f2997378615339f5b04460b3c7bbaf268d7bb500b48a9a5097ca31
2025-05-26T01:44:45.687Z info: [openidStrategy] login success openidId: c21d081a43f2997378615339f5b04460b3c7bbaf268d7bb500b48a9a5097ca31 | email: [email protected] | username: test use... [truncated]

Will merge soon:

#7559

[derhelge]

@danny-avila I'm still getting exactly the same error even with the current code state. I have now reverted to a version before #7397.

[danny-avila]

If using docker, can you confirm the output of the following command?

docker images | grep librechat

Also, be sure to update as recommended:
https://www.librechat.ai/docs/local/docker#update-librechat

If not using docker, or have your own container image build, make sure you are using node ^20.19.0

[derhelge]

Hi @danny-avila

thank you very much for your quick response. i am building my own container:

npm install
npm run frontend
node -v
v20.19.0
npm run backend:dev

[derhelge]

okay i found the issue: in one of the latest commits the openid-client changed the token endpoint authentication method from client_secret_basic to client_secret_post. After changing my IdP to client_secret_post it works perfectly again :)

[dkindlund]

Hi @danny-avila, considering there are multiple people independently reporting this issue, it's unlikely this is a localized problem specific to my setup of LibreChat. That said, I'll try to examine all the code changes between v0.7.8-rc1 and v0.7.8 to determine the possible root cause. To be crystal clear, I'm using just the pre-built Docker images and not building from source:

ghcr.io/danny-avila/librechat:v0.7.8-rc1
ghcr.io/danny-avila/librechat:v0.7.8

Thanks for your time on this issue.

[danny-avila]

The openid-client version bump was done 3 days ago, not at v0.7.8, so you must be using the latest build.

Be sure to use docker images | grep librechat to ensure you are not using latest

[Dual-0]

#7559 fix this for me too.

[nicholas-johnson-techxcel]

If it requires a certain npm version, then there should be an .nvmrc file in the repository.