Google OpenID error

[ktoczyski]

Hi,

I have configured Google realm via OpenID but it is not working. When I tried login in, I received the following message:

Login failed. Please try again (api error (status = 401: Failed to contact token endpoint: Request failed))

The same configuration works on PBS.

Another bug occurs in the user tab. When I add user to realm OpenID, a password is required.

 

[sterzy]

Login failed. Please try again (api error (status = 401: Failed to contact token endpoint: Request failed))

Sounds like your PDM host cannot reach the Google host here. Are you sure PDM is configured with sufficient access to the internet?

Another bug occurs in the user tab. When I add user to realm OpenID, a password is required.

We are aware of that and a fix has already been send to the mailing list [1].

[1]: https://lore.proxmox.com/pdm-devel/.../T/#mb1ab048f62e44b2a0c6f2a42152e6410908e8111

 

[sterzy]

Sounds like your PDM host cannot reach the Google host here. Are you sure PDM is configured with sufficient access to the internet?

You may also need to adapt the "authorized redirect URIs" on Google's side [1].

[1]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred

 

[ktoczyski]

You may also need to adapt the "authorized redirect URIs" on Google's side [1].

[1]: https://developers.google.com/identity/protocols/oauth2/web-server#creatingcred

Yes, PDM is connected to the Internet:

pdm:~# ping accounts.google.com
PING accounts.google.com (142.250.27.84) 56(84) bytes of data.
64 bytes from ra-in-f84.1e100.net (142.250.27.84): icmp_seq=1 ttl=107 time=24.2 ms
64 bytes from ra-in-f84.1e100.net (142.250.27.84): icmp_seq=2 ttl=107 time=24.5 ms
64 bytes from ra-in-f84.1e100.net (142.250.27.84): icmp_seq=3 ttl=107 time=24.4 ms
64 bytes from ra-in-f84.1e100.net (142.250.27.84): icmp_seq=4 ttl=107 time=24.4 ms
64 bytes from ra-in-f84.1e100.net (142.250.27.84): icmp_seq=5 ttl=107 time=24.3 ms
^C
--- accounts.google.com ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 24.234/24.352/24.499/0.093 ms

pdm:~# telnet accounts.google.com 443
Trying 142.250.27.84...
Connected to accounts.google.com.
Escape character is '^]'.
^]

About URIs, I will check it out, but we use Google auth on many systems and all works ok.

 

[sterzy]

Yes, PDM is connected to the Internet:

Alright, that's good to know, thank you!

About URIs, I will check it out, but we use Google auth on many systems and all works ok.

Yes, but from my understanding each authorized redirect URI needs to configure specifically. So if you configured it for your other services and not PDM, that could explain why you are running into this issue. Hope that makes sense.

 

[ktoczyski]

Alright, that's good to know, thank you!



Yes, but from my understanding each authorized redirect URI needs to configure specifically. So if you configured it for your other services and not PDM, that could explain why you are running into this issue. Hope that makes sense.

Yes, I know about it. Our configuration (domain has been removed)

 

[sterzy]

Interesting, I'll look into setting up a reproducer here. Most of the code between pdm and pbs is shared, though, so really not sure what the difference here would be.