Portainer Authentication with Oauth/OIDC (via Pocket ID)

[Owl-Tec]

Ask a Question!

Hi Everyone,

I am trying to integrate Portainer authentication to work with Oauth/OIDC (via Pocket ID).

Should be straightforward but I cannot get it to work as I keep getting an "authorized error" on my end:

Now before proceeding - because I am using Tailscale with all my containers (so everything is "internal"), is that the current source of my problems? Typical networking issue with redirection? Maybe my container has to be in either bridge/host mode for the networking or maybe I have to use my container with the Tailscale container then publish it externally?

Portainer just tells me there is an authentication error:

While Pocket ID states the following:

In the console:

In the logs:

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.689767ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.737917ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.158306ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.199676ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  108.980719ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  109.013679ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:49 | 200 |     366.401µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:10:49 | 200 |     400.152µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     337.691µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     374.072µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     330.741µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     366.411µs |       127.0.0.1 | GET      "/api/application-configuration"

Here are my settings in Pocket ID and this is what I used in Portainer:

Here are some additional settings I have configured in Portainer:

As well as the Open ID configuration info:

{"authorization_endpoint":"https://id.owltec.ca/authorize","claims_supported":["sub","given_name","family_name","name","email","email_verified","preferred_username"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://id.owltec.ca","jwks_uri":"https://id.owltec.ca/.well-known/jwks.json","response_types_supported":["code","id_token"],"scopes_supported":["openid","profile","email"],"subject_types_supported":["public"],"token_endpoint":"https://id.owltec.ca/api/oidc/token","userinfo_endpoint":"https://id.owltec.ca/api/oidc/userinfo"}

Thanks for the help everyone.

[aerosteon]

I have a similar setup but using Traefik and have exactly the same problem

[Nick-Portainer]

@Owl-Tec What version of Portainer are you running?

[Owl-Tec]

I am currently running 20.10.23 (API: 1.41):

[Nick-Portainer]

@Owl-Tec, you can find your Portainer version in the bottom left corner of the Portainer UI

[Owl-Tec]

In that case, it is Portainer Business Edition 2.21.5.

[Nick-Portainer]

It seems like the “Invalid code verifier” error might be related to either mismatched Redirect URIs or networking issues with Tailscale. Here are a couple of things to check:

• Redirect URIs: Double-check that the Redirect URIs configured in Pocket ID match exactly with those set in Portainer. Ensure that the protocol (http/https), domain, port number, and path are all identical. Even small differences can cause the OAuth flow to fail.

• Network Configuration: Since you’re using Tailscale for internal networking, review your setup to ensure it doesn’t interfere with the OAuth flow. Pay particular attention to the handling of redirect and callback URLs within the Tailscale environment, as any inconsistencies here could break the PKCE flow.

[schongewusst99]

Hello,
unfortunately I have exactly the same problems when I want to use Portainer BE 2.21.5 with OAuth via PKCE. Pocket-ID enforces PKCE. I first tried it with Zitadel. There you can also use CODE instead of PKCE which works fine.
Jim's Garage already noted this a year ago. Please take note of his tutorial on youtube (https://www.youtube.com/watch?v=1T1uxKW06Vs)
Minute 16 and 14 seconds

It looks like something went wrong with PKCE in Portainer. Since two different OIDC providers can reproduce the problem identically.

[cloonix]

I found this on the pocket-id documentation: https://pocket-id.org/docs/client-examples/portainer

See the user identifier and scope fields. No commas there. Once i used the values from the documentation, authenticating worked.

[Owl-Tec]

Nope, I never managed to get it working and I have since abandoned using Pocket-ID with Portainer.

[BobWs]

Nope, I never managed to get it working and I have since abandoned using Pocket-ID with Portainer.

I’m in a similar situation—unfortunately, I haven’t been able to get any OpenID clients working with Pocket ID on my Synology either. It’s frustrating because Synology’s built-in SSO works flawlessly with all those same clients and apps, but Pocket ID just won’t cooperate. It’s odd, especially since the DSM SSO implementation seems to be fully compatible with OpenID, while Pocket ID, despite being a lightweight OIDC provider designed for this use case, just doesn’t seem to connect properly in my setup.

[thomasdelorge]

Same behavior on my side, here's the portainer logs :
ERR github.com/portainer/portainer/api/oauth/oauth.go:57 > failed retrieving username | error="failed to extract username from oauth resource"

If I preview token : no attribut "username".

Can be hardcoded for each user as custom claims :

Then OIDC via pocket-id is ok

[veleek]

I attempted @thomasdelorge's solution and it didn't work for me. On the portainer side I have this config:

(as defined in the Pocket-ID Portainer docs).

Unless this configuration has been overridden in portainer to use a the username claim, then it is unnecessary to add the custom claim.

The proper fix for me was to use SPACE-SEPARATED values in the Scopes field (e.g. email openid profile) instead of comma separated like the field hint in Portainer shows:

You can confirm that the scopes are working properly when the first time you login Pocket ID shows you can additional "this page is requesting your email and profile info" confirmation before logging in.

[sym0nd0]

Thanks, @cloonix that cracked it for me. I went against my instincts and included the commas, but removing them got OICD, via Pocket-ID, working straight away.

[BobWs]

These settings works for me! Maybe it helps someone!

[divStar]

So this means: PKCE does not work with Portainer, you have to provide a client_id and a client_secret it seems.

[Riyaz-Hussain]

Ensure your pocket-ID URL is set to bypass in cloudflare if you are using CF tunnels, else you would get the below errors.

during authentication - "authorized error"

In your portainer logs
"ERR github.com/portainer/portainer-ee/api/oauth/oauth.go:27 > failed retrieving OAuth token | error="oauth2: cannot parse json: invalid character '<' looking for beginning of value"

[cuelist1]

@Riyaz-Hussain what do you mean by "set to bypass"?

[Riyaz-Hussain]

Create a policy with Action as Bypass and attach to your application in CloudFlare

This is only applicable if you are using CF tunnels to publish your application to be able to access over internet