#OAuth to Ansible Semaphore - "http: named cookie not present"

1 messages · Page 1 of 1 (latest)

obtuse wadi
#

Semaphore Config

"oidc_providers": { "Authentik": { "display_name": "Login with Authentik", "provider_url": "https://auth.domain.com/application/o/ansible/", "client_id": "ID", "client_secret": "PRIVATE", "redirect_url": "https://ansible.domain.com/api/auth/oidc/authentik/redirect", "username_claim": "preferred_username", "name_claim": "preferred_username", "email_claim": "email", "scopes": ["openid", "profile", "email"] } }

Authentik

OAuth2/OpenID Provider. Confidential Redirect URIs/Origin - https://ansible.domain.com/api/auth/oidc/authentik/redirect

brittle current
#

I'm having the same problem, this config is working for you?

obtuse wadi
#

the issue for me.. ashamedly was a capital letter issue @brittle current

#

Authentik vs authentik

#

in my semaphore config.json the name of the oidc_provider

#

I had capitalized.. it shouldn't have been

brittle current
#

well, im not getting named cookie not present anymore, just msg="claim 'email' missing from id_token or not a string"

#

just for anyone having troubles, i did solve doing this

image.png
clever tide
#

May I ask where did you put the oidc_providers in? I just put it just 1 line before the billing option in /etc/semaphore/config.json, then my semaphore isn't starting anymore at all 😦

I guess I messed up with the , behind some of the closing }?

Here my part of the config.json:

{
    "mysql": {
        "host": "",
        "user": "",
        "pass": "",
        "name": "",
        "options": null
    },
//***
long code with more options here
***//
    "use_remote_runner": false,
    "runner": {
        "api_url": "",
        "registration_token": "",
        "config_file": "",
        "one_off": false,
        "webhook": "",
        "max_parallel_tasks": 0
    },
    "oidc_providers": {
        "Authentik": {
            "display_name": "Login with Authentik",
            "provider_url": "https://authentik.mydomain.org/application/o/semaphore/",
            "client_id": "##################",
            "client_secret": "################################",
            "redirect_url": "https://semaphore.mydomain.local/api/auth/oidc/authentik/redirect",
            "username_claim": "preferred_username",
            "name_claim": "preferred_username",
            "email_claim": "email",
            "scopes": ["openid", "profile", "email"]
        },
    },
    "billing_enabled": false
}```
#

ok... I guess I figured that part out => the , after the } after the "scopes" line was too much.
Now I have the button to login with authentik but it is always redirecting to the loginpage of semaphore again and again.

runic wren
#

Did you ever get your config working? I have everything working excep when i redirect i get a 404... then after removing the /api/auth/oidc/authentik/redirect/ from the url... it takes me right into the portal.

clever tide
#

hey guys, I'm trying hard with semaphore as well 😦

Semaphore is running on an alpine host on port 3000

This is my config:

        "oidc_providers": {
                "authentik": {
                        "display_name": "SSO-Login",
                        "provider_url": "https://auth.domain.local/application/o/semaphore/",
                        "client_id": "wJzfX###########591vsKKll",
                        "client_secret": "yVJqxumBumhZ3aC###################oKLYs3U3XKXNzooAYX",
                        "redirect_url": "https://semaphore.domain.local/api/auth/oidc/authentik/redirect/",
                        "scopes": ["email", "openid", "profile"],
                        "username_claim": "preferred_username",
                        "name_claim": "preferred_username"
                }
        }

If I hit the SSO-Login on semaphore just nothing happens, it just reloads the semaphore page 😦

I have a NGINX ProxyManager in an other subnet that forwards everything to the internal IP with port 3000 of semaphore. This is doing my ssl part. Anyone has an idea?

image.png image.png
#

the issue right now is this :

ERRO[0005] failed to verify signature: failed to verify id token signature

#

ok just switched to authentik's self signed cert in the oidc provider ❤️

#

working now

clever tide
runic wren
#

I’m out of town right now but I’ll
Post it here when I get back on Tuesday morning.