Can´t login after install: Openid button -> "Authentication provider is not configured"

[hakunamatata]

@James thanks for the feedback. Will do some more troubleshooting on my end. Could be network/firewall related.

[hakunamatata]

I ran curl -v https://<your-cloudron-dashboard-url>/.well-known/openid-configuration from the Penpot terminal and it connected just fine. So maybe it is not network related. More investigations to follow.

[james]

Hello @hakunamatata

A note.
Penpot uses environment variables to configure OIDC.
https://git.cloudron.io/packages/penpot-app/-/blob/v1.15.3/start.sh?ref_type=tags#L43-L52

# OIDC
# CLOUDRON_OIDC_PROVIDER_NAME is not supported
export PENPOT_OIDC_BASE_URI="${CLOUDRON_OIDC_ISSUER}"
export PENPOT_OIDC_CLIENT_ID="${CLOUDRON_OIDC_CLIENT_ID}"
export PENPOT_OIDC_CLIENT_SECRET="${CLOUDRON_OIDC_CLIENT_SECRET}"
export PENPOT_OIDC_SCOPES="openid profile email"

# Optional list of roles that users are required to have. If no role
# is provided, roles checking  disabled.
#export PENPOT_OIDC_ROLES="role1 role2"

You check in the Web Terminal of the Penpot app if these variables exist and match with your system.

Example from my.demo.cloudron.io - Penpot app where I also confirmed the OIDC auth is working on a fresh installation:

printenv | grep -i OIDC
CLOUDRON_OIDC_PROFILE_ENDPOINT=https://my.demo.cloudron.io/openid/me
CLOUDRON_OIDC_KEYS_ENDPOINT=https://my.demo.cloudron.io/openid/jwks
CLOUDRON_OIDC_CLIENT_ID=c75fa80f-2edc-49e0-b50b-d3bf7d7d1a60-oidc
CLOUDRON_OIDC_PROVIDER_NAME=Cloudron Demo
CLOUDRON_OIDC_AUTH_ENDPOINT=https://my.demo.cloudron.io/openid/auth
CLOUDRON_OIDC_ISSUER=https://my.demo.cloudron.io/openid
CLOUDRON_OIDC_DISCOVERY_URL=https://my.demo.cloudron.io/openid/.well-known/openid-configuration
CLOUDRON_OIDC_TOKEN_ENDPOINT=https://my.demo.cloudron.io/openid/token
CLOUDRON_OIDC_CLIENT_SECRET=e30d42da66f055b3e214ebf3b971aafccfbaeb6ed8d134262ddc1aff695e4d0f

Note: the CLOUDRON_OIDC_CLIENT_ID and CLOUDRON_OIDC_CLIENT_SECRET are generated per app.
You can validate if the generated CLIENT_ID and CLIENT_SECRET exist in the Cloudron internal MySQL database.

SSH into your Cloudron server and run:
Note: Replace the id="$VALUE" in the SQL query with the CLOUDRON_OIDC_CLIENT_ID from your Penpot app

mysql --vertical -uroot -ppassword box -e 'SELECT * FROM oidcClients WHERE id="33ab2830-3db3-4da2-a057-c9e1b2d0eec0-oidc";'

Output:

mysql: [Warning] Using a password on the command line interface can be insecure.
*************************** 1. row ***************************
                     id: 33ab2830-3db3-4da2-a057-c9e1b2d0eec0-oidc
                 secret: bd643de389f84bb9ee1f1818ac830fb93c3de3a4be6cd38eb7845f1ad5595c8a
                  appId: 33ab2830-3db3-4da2-a057-c9e1b2d0eec0
                   name: OIDC Addon
       loginRedirectUri: /api/v1/callback,/api/v1/mobile/callback,org.getcubby://auth/callback
tokenSignatureAlgorithm: RS256

[hakunamatata]

@James many thanks for the tips. I have followed the instructions and was able to confirm that the app's CLIENT_ID and CLIENT_SECRET exist in the Cloudron internal MySQL database.

I will try to find some time this week to do some more troubleshooting and report back if I am able to resolve the problem.

[nebulon]

Given that you got a 400 status code error, did penpot server logs reveal anything about this?

[hakunamatata]

There is a 400 Error on OIDC POST:

Mar 11 11:37:00 172.18.0.1 - - [11/Mar/2026:08:37:00 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:37:10 172.18.0.1 - - [11/Mar/2026:08:37:10 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:37:20 172.18.0.1 - - [11/Mar/2026:08:37:20 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:37:25 172.18.0.1 - - [11/Mar/2026:08:37:25 +0000] "GET / HTTP/1.1" 200 163106 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:25 172.18.0.1 - - [11/Mar/2026:08:37:25 +0000] "GET /js/config.js?version=develop HTTP/1.1" 200 129 "https://[REDACTED_PENPOT_DOMAIN]/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "HEAD / HTTP/1.1" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "GET /api/main/methods/get-profile HTTP/1.1" 200 79 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "GET /rasterizer.html HTTP/1.1" 200 536 "https://[REDACTED_PENPOT_DOMAIN]/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "GET /js/config.js?version=develop HTTP/1.1" 200 129 "https://[REDACTED_PENPOT_DOMAIN]/rasterizer.html" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "GET /api/main/methods/get-profile HTTP/1.1" 200 79 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:26 172.18.0.1 - - [11/Mar/2026:08:37:26 +0000] "GET /api/main/methods/get-teams HTTP/1.1" 401 135 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:27 172.18.0.1 - - [11/Mar/2026:08:37:27 +0000] "POST /api/main/methods/logout HTTP/1.1" 400 218 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:27 172.18.0.1 - - [11/Mar/2026:08:37:27 +0000] "GET /fonts/WorkSans-VariableFont.ttf HTTP/1.1" 200 362304 "https://[REDACTED_PENPOT_DOMAIN]/css/main.css?version=develop" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
Mar 11 11:37:30 172.18.0.1 - - [11/Mar/2026:08:37:30 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:37:32 172.18.0.1 - - [11/Mar/2026:08:37:32 +0000] "POST /api/auth/oidc?provider=oidc HTTP/1.1" 400 138 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"**
Mar 11 11:37:40 172.18.0.1 - - [11/Mar/2026:08:37:40 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:37:50 172.18.0.1 - - [11/Mar/2026:08:37:50 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"
Mar 11 11:38:00 172.18.0.1 - - [11/Mar/2026:08:37:30 +0000] "GET /api/rpc/command/get-profile HTTP/1.1" 200 95 "-" "Mozilla (CloudronHealth)"

[hakunamatata]

Additionally, when I open the penpot homepage, there is an orange dialog box that briefly opens in the window and then immediately disappears before I can see what it is about. I will try to troubleshoot it this weekend.

[james]

Hello @hakunamatata
Before trying to log in with OIDC, open the Browser Network inspect console and ensure Preserve log is checked and Disable cache.
Reload penpot login screen, try to log in with OIDC.
After that failed again, press the Export HAR button and share this HAR file with me here.
With that file I can have a look what is happening on the browser site and might possibly find an issue.

[hakunamatata]

Hi @James , noted, will send you a DM with the link to the HAR file shortly. Thanks in advance for your assistance!

[james]

Hello @hakunamatata
Thanks for providing the HAR file.
After some analysis of the HAR file and thinking about the issue I got an idea.

@hakunamatata is using an co.ke ccTLD and not a TLD like .com or .de.
Perhaps this causes the issue with penpot and I instructed @hakunamatata to test with a "normal" TLD.
After some testing with a .se TLD he confirmed it is working.

So I am assuming, that this is a specific penpot issue and might be worthy to report upstream.

[hakunamatata]

Thank you @James for your support with this. I was looking at creating a bug report for Penpot but noticed that @brutalbirdie has already done it. Thanks all !

https://github.com/penpot/penpot/issues/8590