Proxmox auth behind Authentik using OpenID

[ThierryIT69]

Hello,
My proxmox server is accessible from outside, the FQDN is ok.
I have followed the procedure on Authentik website to configure proxmox using OpenID.
Authentik/traefik and Proxmox are in the same network.
I have as error message:

proxmox OpenID redirect failed. Request failed (500)

When trying to log:

 - - [28/03/2024:10:22:07 +0200] "POST /api2/extjs/access/openid/auth-url HTTP/1.1" 200 67
::ffff:192.168.200.50 - - [28/03/2024:10:22:07 +0200] "GET /pve2/ext6/theme-crisp/resources/images/tools/tool-sprites.png HTTP/1.1" 200 24404

The config of the realm "authentik" seems to be ok:

https://authentik.domain.tld/application/pve
authentik
FYhxxxxxxxxxxxxxxxxxxxxxxxxxQiq
FwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxGfGNkrLzji
username
Default (email profile)
Auth-Provider Default
Acces through Authentik

The only thing who can be wrong might be the issuer URL

Any ideas ?
Thx

 

[fireon]

Perhaps my documentation with Keycloak will help you a little with your problem, or give you an idea.

https://deepdoc.at/dokuwiki/doku.ph...kvm_und_lxc:openid_keycloak_anbindung_proxmox

 

[keezppc]

You might be missing an /o in your issuer URL

try https://authentik.domain.tld/application/o/pve

 

[jfoley22]

Hello,
My proxmox server is accessible from outside, the FQDN is ok.
I have followed the procedure on Authentik website to configure proxmox using OpenID.
Authentik/traefik and Proxmox are in the same network.
I have as error message:

proxmox OpenID redirect failed. Request failed (500)

When trying to log:

 - - [28/03/2024:10:22:07 +0200] "POST /api2/extjs/access/openid/auth-url HTTP/1.1" 200 67
::ffff:192.168.200.50 - - [28/03/2024:10:22:07 +0200] "GET /pve2/ext6/theme-crisp/resources/images/tools/tool-sprites.png HTTP/1.1" 200 24404

The config of the realm "authentik" seems to be ok:

https://authentik.domain.tld/application/pve
authentik
FYhxxxxxxxxxxxxxxxxxxxxxxxxxQiq
FwxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxGfGNkrLzji
username
Default (email profile)
Auth-Provider Default
Acces through Authentik

The only thing who can be wrong might be the issuer URL

Any ideas ?
Thx

Did you resolve this? I am seeing the same issue, nearly the same setup.

 

[ThierryIT69]

yep ... missing this f*** /o/

 

[jhmc93]

Im having the same error but my url includes the 'o'
`as stated below:

 

[wygglz]

Facing the same issue as you @jhmc93 did you end up finding a solution ?

Edit: Was a DNS problem on my end

 

[EricMarten]

The config below worked for my realm. I am not 100%, but pretty sure, that I had it created like that before and got into issues.
Maybe the "Realm" needs to be the hostname of Authentik?! (That's the only thing I can remember, that I had different in my failed attempt)

I selected these flows:


Also make sure to select your https certificate as Signing Key in the Provider Settings in Authentik.


Proxmox, create realm: (the "comment" will be shown instead the "Realm"-Name in Login-Prompt, if you write something in there)

 

[jhmc93]

Im having the same error but my url includes the 'o'
`as stated below:

View attachment 71007

Edit: I solved it, my traefik instance has staging certs, when i changed to production it worked perfect