OAuth setup with Authelia #3338
Replies: 12 comments 53 replies
-
|
Fixed the formatting, unfortunately does not work: identity_providers:
oidc:
jwks:
- key: {{ secret "/config/keys/private.pem" | mindent 10 "|" | msquote }}
enforce_pkce: public_clients_only
cors:
endpoints:
- userinfo
- authorization
- token
- revocation
- introspection
allowed_origins:
- https://mealie.example.com
allowed_origins_from_client_redirect_uris: true
clients:
- client_id: mealie
client_name: Mealie
authorization_policy: one_factor
redirect_uris:
- https://mealie.example.com/login
public: true
pkce_challenge_method: S256
grant_types:
- authorization_code
scopes:
- openid
- profile
- groups
- emailAny ideas? what exact environment variables are required? |
Beta Was this translation helpful? Give feedback.
-
|
I'm using Mealie in Unraid, environment variables for the docker container are:
Where |
Beta Was this translation helpful? Give feedback.
-
|
Your mealie configuration looks fine. I would turn off AUTO_REDIRECT while you are testing this. You can enable debug logs for mealie by setting A 500 is still a pretty vague error. Is there any specific message? Or anything in the logs of either Mealie or Authelia? |
Beta Was this translation helpful? Give feedback.
-
|
Fixed the 500 error, wrong port was used, however the current authentication mechanism still doesn't work. Even if I login it still shows the login button as if I wasn't logged in. The nginx-proxy-manager advanced configuration for this host is: Where the Now, here's what happens, the same configuration is present for other services on my network. Visiting the page prompts me for login in authelia, however after a successful login I don't see my username at the top right, it's still a "login" button. Screen.Recording.2024-03-29.at.5.20.35.PM.mov |
Beta Was this translation helpful? Give feedback.
-
|
I should also note that there are no errors, and the image used is I've checked where the variable is being used and it's used here - mealie/mealie/routes/app/app_about.py Lines 63 to 69 in 79fb1fb Now if I lookup that file: root@82872204f6f4:/app# tail -20 /app/mealie/routes/app/app_about.py
"""returns helpful startup information"""
settings = get_app_settings()
is_first_login = False
with session as db:
if db.query(User).filter_by(email=settings._DEFAULT_EMAIL).count() > 0:
is_first_login = True
return AppStartupInfo(
is_first_login=is_first_login,
)
@router.get("/theme", response_model=AppTheme)
def get_app_theme(resp: Response):
"""Get's the current theme settings"""
settings = get_app_settings()
resp.headers["Cache-Control"] = "public, max-age=604800"
return AppTheme(**settings.theme.model_dump())There is no mention of that endpoint therefor this functionality is not available on the latest tag. Checking the v1.3.2 tag - https://github.com/mealie-recipes/mealie/blob/v1.3.2/mealie/routes/app/app_about.py still the same, the functionality is not yet present. Given the wording in - https://github.com/mealie-recipes/mealie/releases/tag/v1.3.2
It means that this functionality is not yet available as of today and will be in the next version. |
Beta Was this translation helpful? Give feedback.
-
|
Correct, this feature has not yet been released and is only available on nightly. The docs will be more explicit in the future on which versions certain features are in. Also it looks from your video that you have set up Authelia as a forward proxy authentication for Mealie? That is not necessary for OIDC to work. Once this has been released or you switch to nightly, there will be a new button "Login with OAuth" that will redirect you to Authelia portal |
Beta Was this translation helpful? Give feedback.
-
|
Bonus suggestions:
|
Beta Was this translation helpful? Give feedback.
-
|
@Shagon94 thank you for this! I was tearing my hair out trying to make this work |
Beta Was this translation helpful? Give feedback.
-
|
I have Authelia 4.37.5 and Mealie Nightly. Authelia: id: melie
description: mealie
authorization_policy: one_factor
public: true
grant_types:
- authorization_code
scopes:
- openid
- email
- profile
- groups
redirect_uris:
- https://mealie.gasimzada.casa/login
userinfo_signing_algorithm: noneMealie: environment:
- ALLOW_SIGNUP=false
- PUID=1000
- PGID=1000
- TZ=Europe/Amsterdam
- MAX_WORKERS=1
- WEB_CONCURRENCY=1
- BASE_URL=https://mealie.example.com
- OIDC_AUTH_ENABLED=true
- OIDC_SIGNUP_ENABLED=true
- OIDC_CONFIGURATION_URL=https://auth.example.com/.well-known/openid-configuration
- OIDC_CLIENT_ID=mealie
- OIDC_ADMIN_GROUP=admins
- OIDC_USER_GROUP=users
- OIDC_AUTO_REDIRECT=falseWhen I log in with OIDC, the user is created (with correct permissions based on groups defined in Authelia) but I cannot log into Mealie. It basically never logs in. When I log in with the default Admin user, I can see the user being created with all the information there. Is there something that I am missing here? |
Beta Was this translation helpful? Give feedback.
-
|
That's strange. What is the AuthMethod for the user that you see in the admin panel? |
Beta Was this translation helpful? Give feedback.
-
|
I did not do any change but after a while is started working. Maybe it was a cache issue or something. |
Beta Was this translation helpful? Give feedback.
-
|
Out of interest: Why no client secret? Why use Also configuration for all others is a bit simpler / less to configure. Why go a different route? Safer? Less safe? Easier to manage? |
Beta Was this translation helpful? Give feedback.
-
|
Mealie is partially a SPA and so the authentication plugin we use only supports OAuth Authorization Code Flow with PKCE. This flow does not need a client_secret. It is fully compliant and not any less secure. |
Beta Was this translation helpful? Give feedback.
-
|
Interesting! Switched to nightly right away as soon as I saw OIDC support. Love me some OIDC for everything. |
Beta Was this translation helpful? Give feedback.
-
|
I get an infinite redirect after logging in. Configuration works as described, Authelia assigns a token - but after that I am caught in a loop. Debug-level logging shows this: I'm not redirecting to the |
Beta Was this translation helpful? Give feedback.
-
|
Oh wow! Waiting for the :nightly build to integrate this PR - maybe it is already integrated? Didn’t check what nightly entails vs mealie-next branch. Maybe it fixes stuff. |
Beta Was this translation helpful? Give feedback.
-
|
That is already in nightly, as soon as the PR is merged. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah. Doesn't work. :-) Opening an issue now. #3461 |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for testing @DennisGaida, that feedback is critical to helping find issues |
Beta Was this translation helpful? Give feedback.
-
|
Figured out my problem - see closed issue. |
Beta Was this translation helpful? Give feedback.
-
|
Not actually tested but here's a theoretically working guide provided Mealie supports PKCE S256: https://www.authelia.com/integration/openid-connect/mealie/ |
Beta Was this translation helpful? Give feedback.
-
|
Did test the guide. Works as-is :-) |
Beta Was this translation helpful? Give feedback.
-
|
I don't know if it me completely missing something but I can't make the integration work. I reach the login page and once i press the oauth-login button, I get redirected to a 404 page the url looks is the following: identity_providers:
oidc:
hmac_secret: ':>)'
jwks:
- key_id: 'example'
algorithm: 'RS256'
key: {{ secret "/config/secrets/oidc/jwks/private_authelia.pem" | mindent 10 "|" | msquote }}
cors:
endpoints:
- userinfo
- authorization
- token
- revocation
- introspection
allowed_origins:
- 'https://mealie.domain.lan'
allowed_origins_from_client_redirect_uris: false
clients:
- client_id: 'mealie'
client_name: 'Mealie'
public: true
authorization_policy: 'one_factor'
require_pkce: true
pkce_challenge_method: 'S256'
grant_types:
- 'authorization_code'
redirect_uris:
- 'https://mealie.domain.lan/login'
scopes:
- openid
- profile
- groups
- email
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'none'And this is my enviroment variables from the compose file: environment:
- ALLOW_SIGNUP=true
- PUID=1000
- PGID=1000
- TZ=Europe/Berlin
- MAX_WORKERS=1
- WEB_CONCURRENCY=1
- BASE_URL=https://mealie.domain.lan
# Database Settings
- DB_ENGINE=postgres
- POSTGRES_USER=username
- POSTGRES_PASSWORD=password
- POSTGRES_SERVER=db
- POSTGRES_PORT=5432
- POSTGRES_DB=mealie
- OIDC_AUTH_ENABLED=true
- OIDC_SIGNUP_ENABLED=true
- OIDC_CONFIGURATION_URL=https://authelia.domain.lan/.well-known/openid-configuration
- OIDC_CLIENT_ID=mealie
- OIDC_AUTO_REDIRECT=false
- OIDC_ADMIN_GROUP=mealie-admins
- OIDC_USER_GROUP=mealie-users
- LOG_LEVEL=DEBUGI've tried to switch around with different settings in order to get it work but without success. When I look at the network tab I get a error on a options request to my authelia address where the "Transferred" value is: "CORS missing allow origin" |
Beta Was this translation helpful? Give feedback.
-
|
Hmm looks right to me, maybe try setting |
Beta Was this translation helpful? Give feedback.
-
|
Also chuck your yaml into a formatter. |
Beta Was this translation helpful? Give feedback.
-
|
Check out my closed issue #3461 I had exactly the same URL with |
Beta Was this translation helpful? Give feedback.
-
|
Fixed it! Seems most likely that it was the cache that messed with me. Now i've reached my next issue which is that I won't create an account/login after i've accepted mealie to get its permissions. The log says: |
Beta Was this translation helpful? Give feedback.
-
|
You must have at least these scopes defined in Authelia. Seems like they are not included in your Authelia config or Authelia is not providing those claims when requested. Probably a config issue scopes:
- 'openid'
- 'email'
- 'profile' |
Beta Was this translation helpful? Give feedback.
-
|
First off, loving the support for OIDC, thank you again for the implementation! Quick question: When I put my admin user into the config includes: The temporary solution seems to just put the admin user into the Am I missing something here? |
Beta Was this translation helpful? Give feedback.
-
Credit to @cmintey ! I'm not an expert on it, but from what I understand you need to give your user both the OIDC_USER_GROUP and OIDC_ADMIN_GROUP to make them an admin. So I think the "temporary solution" you're talking about is what's required. |
Beta Was this translation helpful? Give feedback.
-
|
Ahhhhh OK. I read the docs 5 times, but now that you put it that way I am reading the docs differently. Alright, the admin user is in both groups. Thanks @boc-the-git for the clarification. I'll admit this seems a bit redundant and unnecessary, but if that's how it is, I will follow it. |
Beta Was this translation helpful? Give feedback.
-
|
I tried setting up authelia, but it didn't work mealie config: authelia config: INFO 2024-07-21T08:59:21 - [192.168.254.21:0] 307 Temporary Redirect "GET /login?code=authelia_ac_zYpqmL_zUlyMYxfFJKI4tcVtYD78eVza5edvJDz-6L8.ZdYQ35Uug8xCvDlrVFOjzRn91pQbaCON1RgZqHN36AI&iss=https%3A%2F%2Fauthelia.lan&scope=openid+profile+email+groups&state=pwVwtQjKxZ HTTP/1.1" |
Beta Was this translation helpful? Give feedback.
-
|
I, too, have the same exact problem! I've tried turning up logging in both mealie and Authelia, but there's just nothing additional noted. I've enabled LDAP auth as a fallback, but I'd really like to get OIDC working properly... My configuration is practically verbatim from the Authelia Mealie Integrations page. |
Beta Was this translation helpful? Give feedback.
-
|
If the only logs for authelia when logging is set to debug are |
Beta Was this translation helpful? Give feedback.
-
|
I figured it out! I think it was CORS issues... I had another look at my overall OIDC config in Authelia, and went back to the docs, and noticed I didn't have any CORS configurations in place. After adding in the CORS configs in Authelia, I started actually getting errors (either in the Authelia or Mealie logs, I can't remember which). But my Here's the CORS config in Authelia that got it to work for me: cors:
endpoints:
- 'authorization'
- 'pushed-authorization-request'
- 'token'
- 'revocation'
- 'introspection'
- 'userinfo'
allowed_origins:
- '*'
allowed_origins_from_client_redirect_uris: false |
Beta Was this translation helpful? Give feedback.
-
|
Can someone update with an example for Mealie (latest version). I'm having the most unusual time debugging my setup. Authelia logs show the login with OIDC is successful but I get the following error from Mealie logs: I supply the scope as recommended in my authelia config yml: |
Beta Was this translation helpful? Give feedback.
-
|
Phew! Glad we got it resolved 😄 |
Beta Was this translation helpful? Give feedback.
-
|
That image supports the claims parameter and expects it is used to include additional claims outside the standard claims within the ID Token per the spec. There's a way to manually configure that but by default we'll be expecting the clients to correctly request the additional claims they want or use the User Info endpoint as per the spec. |
Beta Was this translation helpful? Give feedback.
-
|
@james-d-elliott Mm, so if we want to continue to use scopes instead of requesting individual claims, we'll need to call the userinfo endpoint? I do see that called out in the spec, but it seems like many IdPs don't fully follow that |
Beta Was this translation helpful? Give feedback.
-
|
Not necessarily, there is a reusable claims policy which can be configured to include the claims in the ID Token for a given client or clients automatically. There is also the We're focused on including all of the security, privacy, and general compliance elements of the spec and related specs. The specs are a contract and us implementing them correctly with reasonable escape hatches is the direction we are going to take with this and practically all elements of Authelia. I think it's opinionated but flexible in logical ways. In this situation it has privacy and information security implications and generally improves that for Authelia users when the client is compliant with the spec. Scopes themselves are intended to request scopes for the Access Token which is used to access the User Info endpoint. They communicate what the Access Token has permission to do, in this case retrieval of information, or in the instance of the allowed scopes registered for a specific client it also communicates what specific claims they are permitted to request in the Also what other IdP's do is actually not all that relevant for us mainly because of situations like many IdP's allowing things like regex in the registered redirect_uris which is expressly prohibited in the specs for an incredibly important security risk. We may use their ideas for inspiration to solve unique issues but that's probably the extent of it. |
Beta Was this translation helpful? Give feedback.
-
|
Cool, thanks for explaining that! |
Beta Was this translation helpful? Give feedback.
-
|
Hi! I'm trying to get this working myself, but running into some headaches 😓. After logging in via Authelia, I'm just returned back to the Mealie login page, and clicking "Login with OIDC" again just repeats the loop... Hopefully one of you fine folks could help me figure this out 🤞 Looking at and with Mealie (v1.12.0) I see While doing this, looking at browser network requests there's a In terms of config, with Mealie I have: [Service]
Environment="ALLOW_SIGNUP=false"
Environment="BASE_URL=https://food.<mysite>.net"
Environment="OIDC_ADMIN_GROUP=admin"
Environment="OIDC_AUTH_ENABLED=true"
Environment="OIDC_AUTO_REDIRECT=false"
Environment="OIDC_CLIENT_ID=mealie"
Environment="OIDC_CONFIGURATION_URL=https://auth.<mysite>.net/.well-known/openid-configuration"
Environment="OIDC_SIGNUP_ENABLED=true"
Environment="OIDC_USER_GROUP=mealie"
EnvironmentFile="/my/env/file"where with Authelia, I have: access_control:
default_policy: deny
rules:
- domain: '*.<mysite>.net'
policy: one_factor
identity_providers:
oidc:
authorization_policies:
default:
default_policy: one_factor
rules:
- policy: deny
subject: group:lldap_strict_readonly
clients:
- authorization_policy: one_factor
client_id: mealie
client_name: Mealie
client_secret: $argon2id$v=19$m=65536,t=3,p=...
consent_mode: implicit
grant_types:
- authorization_code
pkce_challenge_method: S256
public: false
redirect_uris:
- https://food.<mysite>.net/login
scopes:
- openid
- email
- profile
- groups
token_endpoint_auth_method: client_secret_basic
userinfo_signed_response_alg: none
cors:
allowed_origins:
- https://food.<mysite>.net
allowed_origins_from_client_redirect_uris: true
endpoints:
- userinfo
- authorization
- token
- revocation
- introspection
session:
cookies:
- authelia_url: https://auth.<mysite>.net
default_redirection_url: https://home.<mysite>.net
domain: <mysite>.netI've been tweaking this trying to get it to work, but haven't had any luck so far 😞 |
Beta Was this translation helpful? Give feedback.
-
|
You say you're on Mealie v1.x? Only the new v2 Mealie supports the OIDC with client secret |
Beta Was this translation helpful? Give feedback.
-
|
Ahhh! I just went for the latest docs since "NixOS unstable must have a recent version...". Silly me I suppose, but thank you for pointing the obvious out! |
Beta Was this translation helpful? Give feedback.
-
|
Did anyone observe issues after updating to Authelia v4.39.0? I'm aware of the release notes and followed the guideline to migrate. I don't observe similar issues with other OAuth clients so far. |
Beta Was this translation helpful? Give feedback.
-
|
You'll either configure Mealie to use userinfo or follow the claims policy instructions. |
Beta Was this translation helpful? Give feedback.
-
|
I already implemented the claims policy as per the instructions. Any issues with this configuration? claims_policies:
default:
id_token: ['groups', 'email', 'email_verified', 'alt_emails', 'preferred_username', 'name']For the second option, I will have to figure out how to configure Mealie to use "UserInfo". Let me check... |
Beta Was this translation helpful? Give feedback.
-
|
FWIW, I had no issues with the upgrade to 4.39 after following the migration guide. Did you actually apply that claim policy to the Mealie client? identity_providers:
oidc:
clients:
- client_id: <mealie>'
claims_policy: 'default'
...I've also opened a PR to have Mealie make the call to the UserInfo endpoint if the claims aren't present in the ID token. |
Beta Was this translation helpful? Give feedback.
-
|
😂 @cmintey Thx for your hint. Indeed, I missed applying the policy to the client. It's misleading, as I assumed "default" means the policy will be applied to all clients "by default". Solved! THX! |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
This post is meant to serve as a companion to the guide in the docs with examples specifically for Authelia. The following configurations are only partial and are intended only as examples. You will likely need to modify them as necessary for your particular setup.
Authelia Configuration
Important
This is only an example and is not a full configuration. You should read through the Authelia documentation and adjust your configuration as needed.
Mealie Configuration
These are the minimum required environment variables to get it working. See the docs for full options.
Beta Was this translation helpful? Give feedback.
All reactions