Portainer Authentication with Oauth/OIDC (via Pocket ID)

[Owl-Tec]

Ask a Question!

Hi Everyone,

I am trying to integrate Portainer authentication to work with Oauth/OIDC (via Pocket ID).

Should be straightforward but I cannot get it to work as I keep getting an "authorized error" on my end:

Now before proceeding - because I am using Tailscale with all my containers (so everything is "internal"), is that the current source of my problems? Typical networking issue with redirection? Maybe my container has to be in either bridge/host mode for the networking or maybe I have to use my container with the Tailscale container then publish it externally?

Portainer just tells me there is an authentication error:

While Pocket ID states the following:

In the console:

In the logs:

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.689767ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.737917ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.158306ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.199676ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  108.980719ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  109.013679ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:49 | 200 |     366.401µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:10:49 | 200 |     400.152µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     337.691µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     374.072µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     330.741µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     366.411µs |       127.0.0.1 | GET      "/api/application-configuration"

Here are my settings in Pocket ID and this is what I used in Portainer:

Here are some additional settings I have configured in Portainer:

As well as the Open ID configuration info:

{"authorization_endpoint":"https://id.owltec.ca/authorize","claims_supported":["sub","given_name","family_name","name","email","email_verified","preferred_username"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://id.owltec.ca","jwks_uri":"https://id.owltec.ca/.well-known/jwks.json","response_types_supported":["code","id_token"],"scopes_supported":["openid","profile","email"],"subject_types_supported":["public"],"token_endpoint":"https://id.owltec.ca/api/oidc/token","userinfo_endpoint":"https://id.owltec.ca/api/oidc/userinfo"}

Thanks for the help everyone.

[aerosteon]

I have a similar setup but using Traefik and have exactly the same problem

[Nick-Portainer]

@Owl-Tec What version of Portainer are you running?

[Owl-Tec]

I am currently running 20.10.23 (API: 1.41):

[Nick-Portainer]

@Owl-Tec, you can find your Portainer version in the bottom left corner of the Portainer UI

[Owl-Tec]

In that case, it is Portainer Business Edition 2.21.5.

[Nick-Portainer]

It seems like the “Invalid code verifier” error might be related to either mismatched Redirect URIs or networking issues with Tailscale. Here are a couple of things to check:

• Redirect URIs: Double-check that the Redirect URIs configured in Pocket ID match exactly with those set in Portainer. Ensure that the protocol (http/https), domain, port number, and path are all identical. Even small differences can cause the OAuth flow to fail.

• Network Configuration: Since you’re using Tailscale for internal networking, review your setup to ensure it doesn’t interfere with the OAuth flow. Pay particular attention to the handling of redirect and callback URLs within the Tailscale environment, as any inconsistencies here could break the PKCE flow.