Cloudflare OpenID Connect and Authentik
reddit / selfhosted

----------------------------------------------------------------------
mario_io · 2023-10-27 22:50

Hello guys!

Right now I am trying to set up cloudflare zero trust + authentik. I
already have sucessfully established a Cloudflare Zero Trust tunnel to
my unraid server and it is calling Authentik via OIDC
authentification. Unfortunately whenever I try to test the OIDC
authentifikation in cloudflare I get the following error:

**"User email was not returned. API permissions are likely incorrect.
{   "id":
"f149d7758a976d68723e2e06e4424d63a585cb63b565182bb51489b7a0449930",
"oidc\_fields": {} } "**

I really tried a lot to fix this, but I don't know what to do anymore.
If someone can help me, I really would appreciate it.

I don't know what kind of extra information is needed to help me,
please just let me know.

Thanks in advance!

----------------------------------------------------------------------
JzJad12 · 2023-10-28 05:57

Given 'User email was not returned', In the providers OAuth2/OpenID
settings (In authentik) Under advanced, do you have the 3 OpenID's
selected? Also make sure you have an Application tied to that
provider.

----------------------------------------------------------------------
mario_io · 2023-10-28 06:28

email, openid and profile are selected and the provider is also bound
to an application. I also have all 3 defined in the claims section on
cloudflare. No idea what else it can be..

----------------------------------------------------------------------
JzJad12 · 2023-10-28 07:25

Here are my settings, I had to double check to make sure it was still
working as I dont personally use it often.

https://i.imgur.com/B2kPd4B.png

----------------------------------------------------------------------
mario_io · 2023-10-28 07:37

Thanks a lot! I will check it a bit later today, but so far it looks
similar to my settings.

What do you use alternatively? I basically just wanna achieve a
central user management and SSO for all my local and exposed services.

----------------------------------------------------------------------
JzJad12 · 2023-10-28 07:41

I use authentik, I just don't have alot of apps behind cloudflares
zero trust gateway as I try to avoid apps that either don't have any
SSO support or at least don't have se form of multi user and
permissions built in.

----------------------------------------------------------------------
mario_io · 2023-10-28 16:58

I now checked the configuration and it seems to be fine.

Here are screenshots of my Cloudflare configuration, my authentik
provider and application configuration and also a screenshot of the
error message.

[https://imgur.com/a/eiApWZm](https://imgur.com/a/eiApWZm)

In the Cloudflare configuration I also tried it with "PKCE" on and
off. Also I tried to add and remove the claims. It does not change
anything.

----------------------------------------------------------------------
JzJad12 · 2023-10-29 04:26

The only thing I dont have is the claims specified on cloudflare's
side so I guess try removing them. Otherwise PKCE would not work for
me before hand so I also have it off.

----------------------------------------------------------------------
SalamanderEuphoric82 · 2023-10-29 23:54

Same here hope somtone already found a solution:

----------------------------------------------------------------------
SalamanderEuphoric82 · 2023-10-30 01:19

Hu man, did you got a step further?

----------------------------------------------------------------------
mario_io · 2023-10-30 05:32

Unfortunately not. Even reinstalling everything (including dumping the
databases) did not help.

----------------------------------------------------------------------
SalamanderEuphoric82 · 2023-10-30 11:02

Same here for me no ly even reinstall, first initial setup

----------------------------------------------------------------------
SalamanderEuphoric82 · 2023-10-30 12:26

OIDC ERROR: Failed to exchange code for token. Make sure the client
secret is correct.
undefined

----------------------------------------------------------------------
SalamanderEuphoric82 · 2023-10-30 14:07

cany ou tell me how to exactly bind it to a application?

----------------------------------------------------------------------
captingeech · 2023-11-02 02:37

So I ran into the same issue and I thin i Found the fix.  In the
Authentik provider under the advanced settings, I had to check this
box.


I also noticed that after i 'Updated' the provider and went back in,
it un-toggles it, so just remember to make sure it is toggled Every
time.

----------------------------------------------------------------------
mario_io · 2023-11-02 12:52

I will try that, as soon as I am at home today. You will be my hero,
if this fixes the issue! :)

----------------------------------------------------------------------
mario_io · 2023-11-03 06:12

Test connection now succesfully worked, finally 🥳. Thanks a lot for
giving me this hint! Now you are my hero!