Getting OIDC authentication failed all of a sudden

[ovizii]

Everything has been working fine with OIDC and Pocket-ID for a couple of months. Today when I tried to log into geopulse, I get this error:

Authentication Failed
OIDC authentication failed

I then looked at my Pocket-ID audit logs and I only see a Client Authorization event but no result as in success or failure.

Geopulse has some sort of caching, but I do not think it is the cause as Pocket-ID logs the Client Authorization event, right?

Geopulse itself only logs:

geopulse-backend    | 2026-01-06 14:23:29,623 INFO  [org.git.tes.geo.aut.oid.ser.OidcProviderService] (executor-thread-5163) Fetching OIDC metadata for provider: pocketid
geopulse-backend    | 2026-01-06 14:23:29,813 INFO  [org.git.tes.geo.aut.oid.ser.OidcProviderService] (executor-thread-5163) Successfully cached OIDC metadata for provider: pocketid
geopulse-backend    | 2026-01-06 14:23:30,099 ERROR [org.git.tes.geo.aut.oid.res.OidcAuthenticationResource] (executor-thread-5163) Failed to handle OIDC callback: java.lang.RuntimeException: OIDC authentication failed.
geopulse-backend    | 2026-01-06 14:26:07,000 INFO  [org.git.tes.geo.aut.oid.ser.OidcCleanupService] (executor-thread-5163) Cleaned up 3 expired OIDC session states

[tess1o]

Hello,

It's strange that the error message doesn't have a real stracktrace:

geopulse-backend    | 2026-01-06 14:23:30,099 ERROR [org.git.tes.geo.aut.oid.res.OidcAuthenticationResource] (executor-thread-5163) Failed to handle OIDC callback: java.lang.RuntimeException: OIDC authentication failed.

Based on the backend code, the exact error should have been printed, but unfortunately it wasn’t.

I will add more logging in the next minor release so we can understand where the problem is.

P.S. pocketid still works fine for me. I didn't make any changes in OIDC part for many releases.

Thanks.

[ovizii]

Thanks. I managed to update to the latest geopulse version just now and thus restated all the containers and now it works again.
I'm sure it was some OIDC caching error and restarting containers fixed it. I just couldn't try restarting yesterday since my client was busy batch-uploading location data to geopulse.

Would you like to leave the issue open and maybe pass me some tips for debugging, else we can close the issue.

[tess1o]

I found an issue with cache - it stores cache for JWKS keys forever and it fails when pocketid rotates them. It worked for me because I upload new version pretty often and restart the container. I cannot be 100% sure it's the issue you had but anyway it has to be fixed to provide TTL for the cache. I will do required fixes in the next release.

Not sure what you mean by "client was uploading data". Just to remind that GeoPulse can be used for personal and non-commercial use only. See details in the LICENSE: https://github.com/tess1o/geopulse/blob/main/LICENSE

[ovizii]

Not sure what you mean by "client was uploading data".

My GPS client was batch uploading data, it saves to CSV then uploads 4 times a day, I do not need real-time data. I am referring to my GPS app, is the term client wrong in this context?

[tess1o]

It's fine. It was not clear if this is some script/tool you use or some other people you sell the service :)
No issues.

[tess1o]

The fix is implemented in release 1.12.0 - see release notes here: https://github.com/tess1o/geopulse/releases/tag/v1.12.0