#[SOLVED] "invalid client secret" when using OIDC with headscale

1 messages · Page 1 of 1 (latest)

frail gate
#

I keep getting from headscale

2023-04-06T16:39:56+02:00 ERR github.com/juanfont/headscale/oidc.go:307 > Could not exchange code for token error="oauth2: cannot fetch token: 400 Bad Request\nResponse: {\"error\": \"invalid_client\", \"error_description\": \"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method)\"}"

and my Authentik keeps saying "invalid client secret". I re-generated client ID and secret and made sure they're in the configuration, and the secret is read via client_secret_path in headscale. As far as I'm able to say I have things configured properly, and I'm at a loss how to debug this further 🤔

dreamy mist
frail gate
#

I possibly misunderstood that ticket, to me it seems like it's about "when I generate an application using terraform, the client secret that results uses all printable characters, yet when I create it via the browser UI, it uses only (subset of?) alphanumeric ", whereas I'm using the alphanumeric secret I've gotten via web UI

dreamy mist
#

Hmm, I’ve done the same for my head scale setup and that works with OIDC

#

Ensure that the file you’re using for the secret in headscale doesn’t have a trailing new line

frail gate
#

It did work for me. It doesn't anymore.

#

Ah, I'll try to make sure of that, yeah

#

Ah, because nixos changed the way it was loading it, and instead of env var being set by head -n 1 now it reads the file directly. So indeed it was the newline in the file, thank you!

#

[SOLVED] "invalid client secret" when using OIDC with headscale

frail gate
#

So, that part is solved, but I've gotten something interesting on the headscale instance where I regenerated the provider today (the other headscale, where it worked a moment ago, uses an app created a while ago)

2023-04-06T19:27:14+02:00 ERR github.com/juanfont/headscale/oidc.go:356 > failed to verify id token error="oidc: id token signed with unsupported algorithm, expected [\"RS256\"] got \"HS256\""
dreamy mist
#

Make sure the provider has a signing key specified

frail gate
dreamy mist
#

Should probably have some docs for headscale