starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: Authelia SSO ends in Internal Server Error (Password mismatch) #1561

New Issue
Closed
opened 2026-04-24 23:50:01 +02:00 by adam · 6 comments
adam commented 2026-04-24 23:50:01 +02:00
Owner
Copy Link
Copy Source

Originally created by @eloo on GitHub (Nov 29, 2023).

Describe the issue

Hi there,
i really like the new OIDC integration!
But sadly i have trouble to set it up.

I have configured the OIDC client in ABS like described in
https://github.com/advplyr/audiobookshelf/issues/998#issuecomment-1822963823
and
https://github.com/adepssimius/audiobookshelf-web/blob/master/content/guides/11.sso_configuration.md

But i still end in "Internal Server Error" and the following log

OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). the passwords don't match)

From the network log in the browser the
"Callback" call for the authorize_flow is falling.

The "openid" and "authorize" calls are working.

I have checked already if the password (or the hash in authelia) is not working as expected but with "client_credentials" grant type i can get a token from Authelia as expected with the same credentials.

So i'm a bit clueless was could be wrong.

My best guess so far is that the client secret is send correctly from ABS to authelia.
Is there any limitation? maybe in length of the client secret?
My secret has 64 chars.
And for the hash in authelia i use argon2id (not sure if this is relevant)

Thanks a lot

Steps to reproduce the issue

  1. Setup authelia with argon2id
  2. Use this command to generate the hash and password
    docker run authelia/authelia:latest authelia crypto hash generate argon2 --random --random.length 64 --random.charset alphanumeric
  3. Setup oidc client in ABS
  4. Try login
  5. Fail with the callback "password mismatch"

Audiobookshelf version

v2.6.0

How are you running audiobookshelf?

Docker

Originally created by @eloo on GitHub (Nov 29, 2023). ### Describe the issue Hi there, i really like the new OIDC integration! But sadly i have trouble to set it up. I have configured the OIDC client in ABS like described in https://github.com/advplyr/audiobookshelf/issues/998#issuecomment-1822963823 and https://github.com/adepssimius/audiobookshelf-web/blob/master/content/guides/11.sso_configuration.md But i still end in "Internal Server Error" and the following log ``` OPError: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). the passwords don't match) ``` From the network log in the browser the "Callback" call for the authorize_flow is falling. The "openid" and "authorize" calls are working. I have checked already if the password (or the hash in authelia) is not working as expected but with "client_credentials" grant type i can get a token from Authelia as expected with the same credentials. So i'm a bit clueless was could be wrong. My best guess so far is that the client secret is send correctly from ABS to authelia. Is there any limitation? maybe in length of the client secret? My secret has 64 chars. And for the hash in authelia i use argon2id (not sure if this is relevant) Thanks a lot ### Steps to reproduce the issue 1. Setup authelia with argon2id 2. Use this command to generate the hash and password `docker run authelia/authelia:latest authelia crypto hash generate argon2 --random --random.length 64 --random.charset alphanumeric` 3. Setup oidc client in ABS 4. Try login 5. Fail with the callback "password mismatch" ### Audiobookshelf version v2.6.0 ### How are you running audiobookshelf? Docker
adam added the bug label 2026-04-24 23:50:01 +02:00
adam closed this issue 2026-04-24 23:50:02 +02:00
adam commented 2026-04-24 23:50:02 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Dec 2, 2023):

Make sure Authelia uses RS256 for the token. Also you can try the latest abs :edge image, it includes more detailed error logging.

@Sapd commented on GitHub (Dec 2, 2023): Make sure Authelia uses RS256 for the token. Also you can try the latest abs `:edge` image, it includes more detailed error logging.
adam commented 2026-04-24 23:50:03 +02:00
Author
Owner
Copy Link
Copy Source

@eloo commented on GitHub (Dec 2, 2023):

@Sapd
as mentioned.. i am unable to get a token because the "/token" request is not working.
so the algorithm used for tokens is here not relevant.

and i'm not sure what should i more expect as "password mismatch"

so something with sending the password from abs to authelia is not working as expected (at least that is what authelia is also indicating)

@eloo commented on GitHub (Dec 2, 2023): @Sapd as mentioned.. i am unable to get a token because the "/token" request is not working. so the algorithm used for tokens is here not relevant. and i'm not sure what should i more expect as "password mismatch" so something with sending the password from abs to authelia is not working as expected (at least that is what authelia is also indicating)
adam commented 2026-04-24 23:50:04 +02:00
Author
Owner
Copy Link
Copy Source

@eloo commented on GitHub (Dec 2, 2023):

okay.. looks like i have solved the issue by mistake

a restart of ABS seems to have fixed this.. so maybe there is an issue in abs saving and loading the used client_secret

@eloo commented on GitHub (Dec 2, 2023): okay.. looks like i have solved the issue by mistake a restart of ABS seems to have fixed this.. so maybe there is an issue in abs saving and loading the used client_secret
adam commented 2026-04-24 23:50:04 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (Dec 2, 2023):

as mentioned.. i am unable to get a token because the "/token" request is not working.
so the algorithm used for tokens is here not relevant.

Yes you are right.

But good to hear a restart fixed it!

@Sapd commented on GitHub (Dec 2, 2023): > as mentioned.. i am unable to get a token because the "/token" request is not working. so the algorithm used for tokens is here not relevant. Yes you are right. But good to hear a restart fixed it!
adam commented 2026-04-24 23:50:06 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Dec 2, 2023):

Ah yes once the passport strategy is initialized then updating those values won't do anything until a server restart. Alternatively you can toggle off oidc auth and save, then toggle it on again and this will re-initialize it.
Re-initializing the passport strategy can be a future enhancement

@advplyr commented on GitHub (Dec 2, 2023): Ah yes once the passport strategy is initialized then updating those values won't do anything until a server restart. Alternatively you can toggle off oidc auth and save, then toggle it on again and this will re-initialize it. Re-initializing the passport strategy can be a future enhancement
adam commented 2026-04-24 23:50:07 +02:00
Author
Owner
Copy Link
Copy Source

@eloo commented on GitHub (Dec 3, 2023):

@advplyr ah yeah that would exactly match my observation

maybe this should be added as a hint in the OIDC section where we configure it.. or as a dialog when we "save" the config?

@eloo commented on GitHub (Dec 3, 2023): @advplyr ah yeah that would exactly match my observation maybe this should be added as a hint in the OIDC section where we configure it.. or as a dialog when we "save" the config?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#1561
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?