OpenID 401 with Azure AD

[amf]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

 

[saggy2]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

issue continues to exists. I guess no one here has any idea whats going on!

 

[ondrejvalenta]

Still seeing "Failed to contact token endpoint: Request failed" with 401 being returned by the Proxmox front end, with latest Proxmox install. I can see comms between proxmox and the endpoint occurring, but of course cannot see the response.

issuer URL:
https://login.microsoftonline.com/##/v2.0
realm: myazuredomain.com
client ID: "application ID" from Azure app
client key: "client secret" description set in Azure
username claim: username
autocreate users: Yes

Anyone have any suggestions please?

What does your log says when you try to log in and receive an error?

I assume you have the last version of Proxmox libraries and rebooted afterwards, right?

 

[amf]

What does your log says when you try to log in and receive an error?

I assume you have the last version of Proxmox libraries and rebooted afterwards, right?


View attachment 52211

Syslog says:

pvedaemon[1666035]: openid authentication failure; rhost=::ffff:<ipv4 of client> msg=Failed to contact token endpoint: Request failed

This is actually a fresh deployment, so everything is bang up-to-date.

 

[amf]

Revisiting this with a fresh head and starting from scratch has resulted in it now working. Clearly something was amiss but since it was re-implemented from scratch unfortunately I can't say what. Thanks for the help in any case.

 

[mira]

Glad you got it working!

A colleague had a wrong client key on Friday which resulted in the same error.
And I copied the client key ID instead of the actual client key in the past when setting up Azure.

 

[scyto]

wrong client key

i concur - i just spent 20 mins troubleshooting this and then realized i had accidentally added a ( at the front of my client key (aka the secret value in AAD)

 

[talos]

i concur - i just spent 20 mins troubleshooting this and then realized i had accidentally added a ( at the front of my client key (aka the secret value in AAD)

I know your pain, same happend to me and not just ones.

 

[rinseaid]

I have also just seen this issue when configuring Authentik OIDC with PVE. My issue turned out to be special characters in the client secret. Once I switched to a client secret with only alphanumeric characters, the login worked successfully.

I am not sure which character was the culprit and am out of time to further troubleshoot, but it was one of: ^ $ % or @.

 

[veo]

Same issue with ProxMox 8.3.2 and the latest Authentik... It used to work, but stop working.

libpve-rs-perl 0.9.1

Looks like the problem is because of the Nginx Proxy Manager. I able to authenticate if I login directly on the host

 

[anss]

Same issue with ProxMox 8.3.2 and the latest Authentik... It used to work, but stop working.

libpve-rs-perl 0.9.1

Looks like the problem is because of the Nginx Proxy Manager. I able to authenticate if I login directly on the host

Same issue here. ProxMox 8.3.2, libpve-rs-perl 0.9.1, latest authentik

I'm not using any proxy and it still does not work. Did you managed to solve this?

 

[mira]

Same issue here. ProxMox 8.3.2, libpve-rs-perl 0.9.1, latest authentik

I'm not using any proxy and it still does not work. Did you managed to solve this?

Can you provide the full error you get?
And the resulting logs in the journal of the failed login would be good to have as well.

 

[anss]

Sure, there is nothing in the logs except a log-in using credentials, the openID fail and then log-in again with credentials

an 22 14:05:23 pve pvedaemon[1665]: <root@pam> successful auth for user 'root@pam'
Jan 22 14:05:32 pve pvedaemon[1667]: <root@pam> successful auth for user 'root@pam'
Jan 22 14:11:38 pve pvedaemon[1665]: openid authentication failure; rhost=::ffff:x.x.x.x msg=Failed to contact token endpoint: Failed to parse server response
Jan 22 14:11:51 pve pvedaemon[1666]: <root@pam> successful auth for user 'root@pam'
Jan 22 14:12:09 pve pvedaemon[1665]: <root@pam> successful auth for user 'root@pam'

Let me know if any other logs helps

 

[SatyrLee]

Sure, there is nothing in the logs except a log-in using credentials, the openID fail and then log-in again with credentials



Let me know if any other logs helps

I have encountered same issue as you. After looking up Authentik Logs, it said that ProMox OpenID client could recongize RSA instead of EC keys. And this issue was solved by using another RSA keys. Hopefully that could solve your problem.
However, I have encountered another issue. While Authentik logged that it has already authorized to ProMox Daemon(or probably something else), ProMox daemon still stuck at OpenID failed(401), with log:

Jan 24 12:49:09 pvedaemon[214662]: openid authentication failure; rhost=<ip> msg=Failed to contact token endpoint: Failed to parse server response

Digging seems to be necessary, but I have no idea about how to do next.

 

[mira]

I have encountered same issue as you. After looking up Authentik Logs, it said that ProMox OpenID client could recongize RSA instead of EC keys. And this issue was solved by using another RSA keys. Hopefully that could solve your problem.
However, I have encountered another issue. While Authentik logged that it has already authorized to ProMox Daemon(or probably something else), ProMox daemon still stuck at OpenID failed(401), with log:

Jan 24 12:49:09 pvedaemon[214662]: openid authentication failure; rhost=<ip> msg=Failed to contact token endpoint: Failed to parse server response

Digging seems to be necessary, but I have no idea about how to do next.

Thank you for the information! I'll see if I can reproduce it with this information.

 

[anss]

I have encountered same issue as you. After looking up Authentik Logs, it said that ProMox OpenID client could recongize RSA instead of EC keys. And this issue was solved by using another RSA keys. Hopefully that could solve your problem.
However, I have encountered another issue. While Authentik logged that it has already authorized to ProMox Daemon(or probably something else), ProMox daemon still stuck at OpenID failed(401), with log:

Jan 24 12:49:09 pvedaemon[214662]: openid authentication failure; rhost=<ip> msg=Failed to contact token endpoint: Failed to parse server response

Digging seems to be necessary, but I have no idea about how to do next.

I did found the same two messages in authentik logs. First one lead to HTTP 500 and second one to HTTP 401

Last lines of authentik logs shows that proxmox in fact reach out to /tokens api, looks like the response JSON is not in a format proxmox expects (maybe missing some field?)

 auth_via=unauthenticated domain_url=<authentik url> event=/application/o/proxmox/.well-known/openid-configuration host=<authentik url> logger=authentik.asgi method=GET pid=51048 remote=<pve IP> request_id=89a766***1b0 runtime=520 schema_name=public scheme=https status=200 timestamp=2025-01-25T17:14:30.795668 user= user_agent=ureq/2.10.0

auth_via=unauthenticated domain_url=<authentik url> event=/application/o/proxmox/jwks/ host=<authentik url> logger=authentik.asgi method=GET pid=51048 remote=<pve IP> request_id=58f57***25e runtime=895 schema_name=public scheme=https status=200 timestamp=2025-01-25T17:14:31.940522 user= user_agent=ureq/2.10.0

auth_via=oauth_client_secret domain_url=<authentik url> event=/application/o/token/ host=<authentik url> logger=authentik.asgi method=POST pid=51048 remote=<pve IP> request_id=67630c***37d runtime=577 schema_name=public scheme=https status=200 timestamp=2025-01-25T17:14:32.766922 user= user_agent=ureq/2.10.0

 

[mira]

I have encountered same issue as you. After looking up Authentik Logs, it said that ProMox OpenID client could recongize RSA instead of EC keys. And this issue was solved by using another RSA keys. Hopefully that could solve your problem.
However, I have encountered another issue. While Authentik logged that it has already authorized to ProMox Daemon(or probably something else), ProMox daemon still stuck at OpenID failed(401), with log:

Jan 24 12:49:09 pvedaemon[214662]: openid authentication failure; rhost=<ip> msg=Failed to contact token endpoint: Failed to parse server response

Digging seems to be necessary, but I have no idea about how to do next.

Where exactly did you create those keys, and where do you use them?

Did any of you set an encryption key for tokens?