Authentik - SSO Settings

[jasonlaguidice]

I'm attempting to set up SSO for my alist instance and I use Authentik for OIDC. Does anyone know to configure alist to interact with an Authentik application?

[CustomIcon]

Alist - SSO Guide

[jasonlaguidice]

I know this exists but it doesn't cover the setup required for Authentik specifically and I can't make sense of how to convert the fields.

In AList I've entered the following:

Login platform: OIDC
Sso client id: [Client ID from Authentik]
Sso client secret: [Secret key from Authentik]
Sso oidc username key: preferred_username
Sso organization name: [blank]
Sso application name: alist
Sso endpoint name: https://auth.[domain]/application/o/authorize
Sso jwt public key: [authentik cert.pem]

In Authentik I have created an application with stub alist

An example JWT payload as would be provided by Authentik is shown below:

{
    "sub": "75a3938de630f1e7153ef57eae14ac82a9e7bc4c3d35cd576e9ca2d18c2a2978",
    "aud": "kL4UODBD5rGV0uFnskVKkaMknP5MgUWM1UKxJep6",
    "exp": 1726510119,
    "iat": 1726508319,
    "auth_time": 1726508319,
    "acr": "goauthentik.io/providers/oauth2/default",
    "email": "redacted",
    "email_verified": true,
    "name": "Jason",
    "given_name": "Jason",
    "preferred_username": "jason",
    "nickname": "jason",
    "groups": [
        "authentik Admins"
    ]
}

And this is provided at an endpoint: https://auth.[domain]/application/o/token

Authentik is configured with the following redirect URIs as I've seen all of these in the documentation but am not sure which is correct:

https://alist.[domain]/api/auth/get_sso_id
https://alist.[domain]/api/auth/sso_get_token
https://alist.[domain]/callback

When I click the SSO button I get the following plaintext error which looks like downloaded text from Authentik with 400 and 404 errors:
{"code":400,"message":"404 Not Found: \n\n\n\n\u003c!DOCTYPE html\u003e\n\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\"\u003e\n \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1\"\u003e\n \u003ctitle\u003e\nauthentik\n\u003c/title\u003e\n \u003clink rel=\"icon\" href=\"/static/dist/assets/icons/icon.png\"\u003e\n \u003clink rel=\"shortcut icon\" href=\"/static/dist/assets/icons/icon.png\"\u003e\n \n\u003clink rel=\"prefetch\" href=\"/static/dist/assets/images/flow_background.jpg\" /\u003e\n\u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/patternfly.min.css\"\u003e\n\u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/theme-dark.css\" media=\"(prefers-color-scheme: dark)\"\u003e\n\n\n\n\u003cscript\u003e\n window.authentik = {\n locale: \"en-us\",\n config: JSON.parse(''),\n brand: JSON.parse(''),\n versionFamily: \"\",\n versionSubdomain: \"\",\n build: \"\",\n };\n window.addEventListener(\"DOMContentLoaded\", function () {\n \n });\n\u003c/script\u003e\n\n\n \u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/authentik.css\"\u003e\n \u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/custom.css\" data-inject\u003e\n \u003cscript src=\"/static/dist/poly-2024.6.4.js\" type=\"module\"\u003e\u003c/script\u003e\n \u003cscript src=\"/static/dist/standalone/loading/index-2024.6.4.js\" type=\"module\"\u003e\u003c/script\u003e\n \n\u003cstyle\u003e\n:root {\n --ak-flow-background: url(\"/static/dist/assets/images/flow_background.jpg\");\n --pf-c-background-image--BackgroundImage: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage-2x: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--sm: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--sm-2x: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--lg: var(--ak-flow-background);\n}\n/* Form with user */\n.form-control-static {\n margin-top: var(--pf-global--spacer--sm);\n display: flex;\n align-items: center;\n justify-content: space-between;\n}\n.form-control-static .avatar {\n display: flex;\n align-items: center;\n}\n.form-control-static img {\n margin-right: var(--pf-global--spacer--xs);\n}\n.form-control-static a {\n padding-top: var(--pf-global--spacer--xs);\n padding-bottom: var(--pf-global--spacer--xs);\n line-height: var(--pf-global--spacer--xl);\n}\n\u003c/style\u003e\n\n \u003cmeta name=\"sentry-trace\" content=\"\" /\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n \n\u003cdiv class=\"pf-c-background-image\"\u003e\n\u003c/div\u003e\n\u003cak-message-container\u003e\u003c/ak-message-container\u003e\n\u003cdiv class=\"pf-c-login stacked\"\u003e\n \u003cdiv class=\"ak-login-container\"\u003e\n \u003cmain class=\"pf-c-login__main\"\u003e\n \u003cdiv class=\"pf-c-login__main-header pf-c-brand ak-brand\"\u003e\n \u003cimg src=\"/static/dist/assets/icons/icon_left_brand.svg\" alt=\"authentik Logo\" /\u003e\n \u003c/div\u003e\n \u003cheader class=\"pf-c-login__main-header\"\u003e\n \u003ch1 class=\"pf-c-title pf-m-3xl\"\u003e\n \nNot Found\n\n \u003c/h1\u003e\n \u003c/header\u003e\n \u003cdiv class=\"pf-c-login__main-body\"\u003e\n \n\u003cform method=\"POST\" class=\"pf-c-form\"\u003e\n \u003cp\u003e\u003c/p\u003e\n \u003ca id=\"ak-back-home\" href=\"/\" class=\"pf-c-button pf-m-primary\"\u003e\n Go home\n \u003c/a\u003e\n\u003c/form\u003e\n\n \u003c/div\u003e\n \u003c/main\u003e\n \u003cfooter class=\"pf-c-login__footer\"\u003e\n \u003cul class=\"pf-c-list pf-m-inline\"\u003e\n \n \u003cli\u003e\n \u003cspan\u003e\n Powered by authentik\n \u003c/span\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/footer\u003e\n \u003c/div\u003e\n\u003c/div\u003e\n\n \n \n \u003c/body\u003e\n\u003c/html\u003e\n","data":null}

So what might I have setup incorrectly?

[CustomIcon]

Dear jason. sorry for a late reply. the documentation guide seems to work. here is my authentik + alist config which works:

[CustomIcon]

Demo.mp4

here is demo.

[jasonlaguidice]

Dear jason. sorry for a late reply. the documentation guide seems to work. here is my authentik + alist config which works:

Thank you so much! This got me closer. So I nearly had the correct setup but needed to change the endpoint name to my application stub.

The final settings that work - and for anyone else who may find this hoping to set up Authentik:

Sso login platform: OIDC
Sso client ID: Authentik Client ID
Sso client secret: Authentik Client Secret
Sso oidc username key: preferred_username
Sso organization name: user
Sso application name: user
Sso endpoint name: Path to your your application stub - OpenID Configuration Issuer in Authentik. Do not forget the trailing /
Sso jwt public key: Public certificate selected in Authentik
Compatibility mode should be off

If this project accepts pull requests I can detail this out further and submit a page which shows instructions similar to the other OIDC providers to help others in the future. Thank you so much for the help!

[CustomIcon]

You are most welcome. I agree it was challenging to deal with OIDC by authentik on Alist. took m a while to figure it out as well. the document project is at https://github.com/alist-org/docs. preferrably https://github.com/alist-org/docs/blob/main/docs/guide/advanced/sso.md needs to add Authentik guide to the table :D

[vitaaaaa1]

You are most welcome. I agree it was challenging to deal with OIDC by authentik on Alist. took m a while to figure it out as well. the document project is at https://github.com/alist-org/docs. preferrably https://github.com/alist-org/docs/blob/main/docs/guide/advanced/sso.md needs to add Authentik guide to the table :D非常欢迎。我同意在Alist上处理OIDC确实具有挑战性，我也花了一段时间才弄明白。该项目的文档位于以下网址：。最好访问，需要在表中添加Authentik指南：）

Hello bro I also use Authentik as my oidc provider, but I am not very skilled, I would like to know how to get the certificate "Sso jwt public key" Hope you can reply

[vitaaaaa1]

I have found the JWT certificate, but I am getting a new error when logging in. Authentik is throwing an error. {"code":400,"message":"cannot get username from OIDC provider","data":null}

[jasonlaguidice]

You may have something changed from the default configuration in Authentik. In case you haven't found it my pull request adding instructions for Authentik was accepted so instructions for it are now in the documentation:

https://alist.nn.ci/guide/advanced/sso.html#registration-binding-single-sign-on

AList's field Sso oidc username key is where it gets the username. By default Authentik provides a preferred_username key-value pair. If you have changed your Authentik configuration this may be different.

Open your Authentik admin interface and navigate to the provider you have created for AList. Select the Preview tab - this will show you the auth payload that Authentik is providing for AList. Choose a key-value pair that you have configured representing unique usernames for each user.

[vitaaaaa1]

Thank you brother, my oidc configuration is successful!

[dalamudx]

is there anyone can provide the oauth provider configuration?i am getting the following error after redirect

{"code":400,"message":"oidc: malformed jwt: square/go-jose: compact JWS format must have three parts","data":null}

alist

authentik

[jasonlaguidice]

The default settings for Authentik work. There has been a small change to Authentik that allows for regex or strict callback URIs and this change means that the escape characters are no longer needed in the URL as stated in the guide (so I guess it need updating).

Are you sure you're using the correct certificate as provided by Authentik?

[dalamudx]

thx for the reply,now it works,i shouldn't select a cert to encrypt the token😅