Drop-OSS/drop
1
0
Fork 0
mirror of https://github.com/Drop-OSS/drop.git synced 2026-07-21 16:15:24 -04:00
Code Issues 77 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #361] OIDC not functioning #336

New Issue
Closed
opened 2026-06-05 14:21:51 -04:00 by yindo · 9 comments
yindo commented 2026-06-05 14:21:51 -04:00
Owner
Copy Link
Copy Source

Originally created by @Giggitybyte on GitHub (Feb 26, 2026).
Original GitHub issue: https://github.com/Drop-OSS/drop/issues/361

I'm trying out v0.4.0-rc2, and I can't seem to get OIDC working. It seems the callback endpoint returns 404.

Image

Image

Image

Image

Docker compose:

services:
  drop:
    image: ghcr.io/drop-oss/drop:0.4.0-rc-2
    environment:
      - DATABASE_URL=postgres://drop:REDACTED!@10.0.0.151:5432/drop
      - EXTERNAL_URL=https://drop.example.xyz
      - OIDC_CLIENT_ID=REDACTED
      - OIDC_CLIENT_SECRET=REDACTED
      - OIDC_SCOPES=openid,profile,groups,email
      - OIDC_ADMIN_GROUP=app_admin
      - OIDC_USER_GROUP=friends
      - OIDC_PROVIDER_NAME=Authelia
      - OIDC_WELLKNOWN=https://auth.example.xyz/.well-known/openid-configuration
      - DISABLE_SIMPLE_AUTH=false
    ports:
      - 127.0.0.1:13700:3000
    volumes:
      - /mnt/array/files/games:/library
      - ./data:/data

Authelia configuration:

      - client_id: 'REDACTED'
        client_name: 'Campfire Games (Drop)'
        client_secret: '{{ secret "/secrets/clients/drop.secret" }}'
        public: false
        authorization_policy: 'one_factor'
        redirect_uris:
          - 'https://drop.example.xyz/api/v1/auth/oidc/callback'          
        scopes:
          - 'openid'
          - 'profile'
          - 'groups'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
          - 'refresh_token'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_post'
Originally created by @Giggitybyte on GitHub (Feb 26, 2026). Original GitHub issue: https://github.com/Drop-OSS/drop/issues/361 I'm trying out v0.4.0-rc2, and I can't seem to get OIDC working. It seems the callback endpoint returns 404. <img width="323" height="497" alt="Image" src="https://github.com/user-attachments/assets/9597e2e5-acce-4712-aa8f-419659c073cf" /></br> <img width="242" height="310" alt="Image" src="https://github.com/user-attachments/assets/507cb2a7-bb74-4a70-bc78-9a9ce708a56b" /></br> <img width="436" height="498" alt="Image" src="https://github.com/user-attachments/assets/dddbe347-dbb8-42bf-9096-d8e945d1eb78" /></br> <img width="863" height="233" alt="Image" src="https://github.com/user-attachments/assets/b0d2c7db-cc42-40ee-8b79-b6266d49dffc" /> Docker compose: ```yaml services: drop: image: ghcr.io/drop-oss/drop:0.4.0-rc-2 environment: - DATABASE_URL=postgres://drop:REDACTED!@10.0.0.151:5432/drop - EXTERNAL_URL=https://drop.example.xyz - OIDC_CLIENT_ID=REDACTED - OIDC_CLIENT_SECRET=REDACTED - OIDC_SCOPES=openid,profile,groups,email - OIDC_ADMIN_GROUP=app_admin - OIDC_USER_GROUP=friends - OIDC_PROVIDER_NAME=Authelia - OIDC_WELLKNOWN=https://auth.example.xyz/.well-known/openid-configuration - DISABLE_SIMPLE_AUTH=false ports: - 127.0.0.1:13700:3000 volumes: - /mnt/array/files/games:/library - ./data:/data ``` Authelia configuration: ```yaml - client_id: 'REDACTED' client_name: 'Campfire Games (Drop)' client_secret: '{{ secret "/secrets/clients/drop.secret" }}' public: false authorization_policy: 'one_factor' redirect_uris: - 'https://drop.example.xyz/api/v1/auth/oidc/callback' scopes: - 'openid' - 'profile' - 'groups' - 'email' response_types: - 'code' grant_types: - 'authorization_code' - 'refresh_token' access_token_signed_response_alg: 'none' userinfo_signed_response_alg: 'none' token_endpoint_auth_method: 'client_secret_post' ```
yindo closed this issue 2026-06-05 14:21:51 -04:00
yindo commented 2026-06-05 14:21:51 -04:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Feb 26, 2026):

Give RC3 a go and let me know

<!-- gh-comment-id:3970708172 --> @DecDuck commented on GitHub (Feb 26, 2026): Give RC3 a go and let me know
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@Giggitybyte commented on GitHub (Feb 27, 2026):

@DecDuck Updated to v0.4.0-rc3 and I am still having issues.
I'm getting a different error this time around:

Image 
drop-1  | [09:34:21.841] ERROR (72): unexpected "iss" claim value
drop-1  |     err: {
drop-1  |       "type": "JWTClaimValidationFailed",
drop-1  |       "message": "unexpected \"iss\" claim value",
drop-1  |       "stack":
drop-1  |           JWTClaimValidationFailed: unexpected "iss" claim value
drop-1  |               at validateClaimsSet (file:///app/app/server/node_modules/.nitro/jose@6.1.3/dist/webapi/lib/jwt_claims_set.js:114:15)
drop-1  |               at Module.jwtVerify (file:///app/app/server/node_modules/.nitro/jose@6.1.3/dist/webapi/jwt/verify.js:9:21)
drop-1  |               at async OIDCManager.authorize (file:///app/app/server/chunks/nitro/nitro.mjs:1:1068013)
drop-1  |               at async Object.handler (file:///app/app/server/chunks/routes/api/v1/auth/oidc/callback.get.mjs:1:1520)
drop-1  |               at async Object.handler (file:///app/app/server/chunks/nitro/nitro.mjs:1:95921)
drop-1  |               at async Server.<anonymous> (file:///app/app/server/chunks/nitro/nitro.mjs:1:98901)
<!-- gh-comment-id:3971772149 --> @Giggitybyte commented on GitHub (Feb 27, 2026): @DecDuck Updated to v0.4.0-rc3 and I am still having issues. I'm getting a different error this time around: <img width="568" height="404" alt="Image" src="https://github.com/user-attachments/assets/126c10ed-789e-47a8-be4d-1afacbd76c64" /> ```log drop-1 | [09:34:21.841] ERROR (72): unexpected "iss" claim value drop-1 | err: { drop-1 | "type": "JWTClaimValidationFailed", drop-1 | "message": "unexpected \"iss\" claim value", drop-1 | "stack": drop-1 | JWTClaimValidationFailed: unexpected "iss" claim value drop-1 | at validateClaimsSet (file:///app/app/server/node_modules/.nitro/jose@6.1.3/dist/webapi/lib/jwt_claims_set.js:114:15) drop-1 | at Module.jwtVerify (file:///app/app/server/node_modules/.nitro/jose@6.1.3/dist/webapi/jwt/verify.js:9:21) drop-1 | at async OIDCManager.authorize (file:///app/app/server/chunks/nitro/nitro.mjs:1:1068013) drop-1 | at async Object.handler (file:///app/app/server/chunks/routes/api/v1/auth/oidc/callback.get.mjs:1:1520) drop-1 | at async Object.handler (file:///app/app/server/chunks/nitro/nitro.mjs:1:95921) drop-1 | at async Server.<anonymous> (file:///app/app/server/chunks/nitro/nitro.mjs:1:98901) ```
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Feb 27, 2026):

Are your JWTs signed by an issuer? There may be an option to attach a certificate to the configuration in your identity provider.

<!-- gh-comment-id:3971883339 --> @DecDuck commented on GitHub (Feb 27, 2026): Are your JWTs signed by an issuer? There may be an option to attach a certificate to the configuration in your identity provider.
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@Giggitybyte commented on GitHub (Feb 27, 2026):

Yes, that is already configured.

identity_providers:
  oidc:
    hmac_secret: '{{ secret "/secrets/hmac.secret" }}'
    jwks:
      - key: {{ secret "/secrets/oidc_private.pem" | mindent 10 "|" | msquote }}

My Authelia instance is configured properly, and I have it working with many other applications (including Gameyfin and RomM).

It honestly feels like the OIDC implementation in Drop is not spec compliant, as I had to use the OIDC_SCOPES environment variable to even get as far as I have, otherwise Drop would try to request every scope.

<!-- gh-comment-id:3971894702 --> @Giggitybyte commented on GitHub (Feb 27, 2026): Yes, that is already configured. ```yaml identity_providers: oidc: hmac_secret: '{{ secret "/secrets/hmac.secret" }}' jwks: - key: {{ secret "/secrets/oidc_private.pem" | mindent 10 "|" | msquote }} ``` My Authelia instance is configured properly, and I have it working with many other applications (including Gameyfin and RomM). It honestly feels like the OIDC implementation in Drop is not spec compliant, as I had to use the `OIDC_SCOPES` environment variable to even get as far as I have, otherwise Drop would try to request *every* scope.
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Feb 27, 2026):

Can you open the well-known URL and find the issuer field? It should be a URL. Can you let me know if it ends with a forward slash (like https://x.y.z/hello/issuer/)

<!-- gh-comment-id:3971922480 --> @DecDuck commented on GitHub (Feb 27, 2026): Can you open the well-known URL and find the `issuer` field? It should be a URL. Can you let me know if it ends with a forward slash (like `https://x.y.z/hello/issuer/`)
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@Giggitybyte commented on GitHub (Feb 27, 2026):

There is not a trailing slash in the issuer field.

  "issuer": "https://auth.example.xyz",
  "jwks_uri": "https://auth.example.xyz/jwks.json",
  "authorization_endpoint": "https://auth.example.xyz/api/oidc/authorization",
  "token_endpoint": "https://auth.example.xyz/api/oidc/token",
<!-- gh-comment-id:3971930794 --> @Giggitybyte commented on GitHub (Feb 27, 2026): There is not a trailing slash in the issuer field. ```json "issuer": "https://auth.example.xyz", "jwks_uri": "https://auth.example.xyz/jwks.json", "authorization_endpoint": "https://auth.example.xyz/api/oidc/authorization", "token_endpoint": "https://auth.example.xyz/api/oidc/token", ```
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Feb 27, 2026):

Thanks, looks like it's a bug.

@Huskydog9988 the URL we parse the issuer to, when converted back to a string, adds a trailing slash. The jwtVerify compares the issuer literally rather than semantically, so this fails.

<!-- gh-comment-id:3971968991 --> @DecDuck commented on GitHub (Feb 27, 2026): Thanks, looks like it's a bug. @Huskydog9988 the URL we parse the issuer to, when converted back to a string, adds a trailing slash. The `jwtVerify` compares the issuer literally rather than semantically, so this fails.
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@DecDuck commented on GitHub (Mar 1, 2026):

Just pushed a fix for this, I'll release it as a part of rc4 in a minute - I want to check some other bugs and see if I can throw in fixes for them.

<!-- gh-comment-id:3979736724 --> @DecDuck commented on GitHub (Mar 1, 2026): Just pushed a fix for this, I'll release it as a part of rc4 in a minute - I want to check some other bugs and see if I can throw in fixes for them.
yindo commented 2026-06-05 14:21:52 -04:00
Author
Owner
Copy Link
Copy Source

@Giggitybyte commented on GitHub (Mar 3, 2026):

Just gave RC4 a try, and I wanted confirm here that the flow works properly for me now. Thanks!

<!-- gh-comment-id:3993766428 --> @Giggitybyte commented on GitHub (Mar 3, 2026): Just gave RC4 a try, and I wanted confirm here that the flow works properly for me now. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
duplicate
feature
feature
good first issue
needs-triage
pull-request
Mirrored from GitHub Pull Request
 qol
support
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Drop-OSS/drop#336
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?