<![CDATA[Apps with OpenID Connect Provider (beta)]]>Autodiscovery does not work and after manual entry of endpoints:

ID token validate failed with error: Only RS256 signature validation is supported. Token reports using EdDSA

Maybe this is the reason -> https://github.com/BookStackApp/BookStack/issues/3206

]]>https://forum.cloudron.io/topic/8940/apps-with-openid-connect-provider-betaRSS for NodeTue, 14 Jul 2026 10:49:10 GMTSun, 02 Apr 2023 12:15:09 GMT60<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Wed, 07 Jun 2023 15:47:49 GMT]]>I'm still struggling to properly set up openID with my applications. For example with Leantime I get The received provider https://my.domain.tld/openid does not match the local setting https://my.domain.tld/.well-known/openid-configuration after authentification. And ctfreak will complain that redirect_uris for native clients using http as a protocol can only use loopback addresses as hostnames and using https won't work.

]]>https://forum.cloudron.io/post/67859https://forum.cloudron.io/post/67859Wed, 07 Jun 2023 15:47:49 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Mon, 10 Apr 2023 11:22:41 GMT]]>@luckow thanks, added it for next package release.

]]>https://forum.cloudron.io/post/64667https://forum.cloudron.io/post/64667Mon, 10 Apr 2023 11:22:41 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Mon, 10 Apr 2023 11:14:28 GMT]]>To test Superset with Oauth we need an additional library

Apr 10 13:10:48 from authlib.integrations.flask_client import OAuth
Apr 10 13:10:48 ModuleNotFoundError: No module named 'authlib'

Referring to https://superset.apache.org/docs/installation/configuring-superset/#custom-oauth2-configuration

]]>https://forum.cloudron.io/post/64665https://forum.cloudron.io/post/64665Mon, 10 Apr 2023 11:14:28 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Thu, 06 Apr 2023 12:21:52 GMT]]>I have removed the display of the secret now. Also 7.4.1 will support multiple redirectURIs with native app support. This was required for getting immich to work.

Lets keep those issues coming so we can fix that up one-by-one

]]>https://forum.cloudron.io/post/64503https://forum.cloudron.io/post/64503Thu, 06 Apr 2023 12:21:52 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Tue, 04 Apr 2023 14:25:40 GMT]]>@nebulon btw. we also have a UI glitch

a6c23b94-3e42-414c-a359-6c4ee7e5a9e7-image.png

]]>https://forum.cloudron.io/post/64337https://forum.cloudron.io/post/64337Tue, 04 Apr 2023 14:25:40 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Tue, 04 Apr 2023 13:45:01 GMT]]>Wrong forum section, I will move this to support as it is more like a generic OpenID thread now.

I managed to get freescout working now with https://freescout.net/module/oauth-login/ and the added RS256 signature validation. We should be able to get this into 7.4.1

]]>https://forum.cloudron.io/post/64335https://forum.cloudron.io/post/64335Tue, 04 Apr 2023 13:45:01 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Tue, 04 Apr 2023 13:01:33 GMT]]>@luckow Update: after going "back" to the Bookstack home page (with the sso login button) and clicking again (with a valid login on my oic provider), I get the error again:

ID token validate failed with error: Only RS256 signature validation is supported. Token reports using EdDSA
]]>https://forum.cloudron.io/post/64332https://forum.cloudron.io/post/64332Tue, 04 Apr 2023 13:01:33 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Tue, 04 Apr 2023 12:52:58 GMT]]>@nebulon I followed
https://www.bookstackapp.com/docs/admin/oidc-auth/

With OIDC_ISSUER_DISCOVER=true the error is

OIDC Discovery Error: Unexpected issuer value found on discovery response

With OIDC_ISSUER_DISCOVER=false the error is

unrecognized route or not allowed method (GET on /interaction/uNAJ4bnbXdzrsVTA7pIl9/confirm)

I have no idea, but maybe
OIDC_PUBLIC_KEY=https://my.example.org/openid/jwks is wrong.
The documentation says something with a .pem file:

# Path to identity provider token signing public RSA key
OIDC_PUBLIC_KEY=file:///keys/idp-public-key.pem
]]>https://forum.cloudron.io/post/64331https://forum.cloudron.io/post/64331Tue, 04 Apr 2023 12:52:58 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Tue, 04 Apr 2023 12:03:36 GMT]]>@luckow I have added RS256 now, but so far I haven't managed to get to the point to see the signature validation error. Can you spot something missing in my test env file:

OIDC_NAME=Cloudron
OIDC_DISPLAY_NAME_CLAIMS=name
OIDC_CLIENT_ID=bookstackid
OIDC_CLIENT_SECRET=bookstacksecret
OIDC_ISSUER=https://nebulon.space
OIDC_ISSUER_DISCOVER=false
OIDC_AUTH_ENDPOINT=https://my.nebulon.space/openid/auth
OIDC_TOKEN_ENDPOINT=https://my.nebulon.space/openid/token

The autodiscovery via .well-known also failed like you mentioned.

]]>https://forum.cloudron.io/post/64329https://forum.cloudron.io/post/64329Tue, 04 Apr 2023 12:03:36 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Sun, 02 Apr 2023 19:19:08 GMT]]>Yes we can support multiple ones https://github.com/panva/node-oidc-provider/blob/main/docs/README.md#jwks

I went for the recommended format first. Some more info about key algorithms https://www.scottbrady91.com/jose/jwts-which-signing-algorithm-should-i-use

]]>https://forum.cloudron.io/post/64206https://forum.cloudron.io/post/64206Sun, 02 Apr 2023 19:19:08 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Sun, 02 Apr 2023 14:58:35 GMT]]>@girish maybe the same problem with Freescout? https://freescout.net/module/saml/

Requirements
Signature Algorithm is RSA-SHA256.

]]>https://forum.cloudron.io/post/64175https://forum.cloudron.io/post/64175Sun, 02 Apr 2023 14:58:35 GMT<![CDATA[Reply to Apps with OpenID Connect Provider (beta) on Sun, 02 Apr 2023 14:50:48 GMT]]>@nebulon Can we have mulitple key algos?

]]>https://forum.cloudron.io/post/64170https://forum.cloudron.io/post/64170Sun, 02 Apr 2023 14:50:48 GMT