mirror of
https://github.com/advplyr/audiobookshelf.git
synced 2026-05-30 23:40:40 +02:00
[Bug]: OIDC not working in mobile app #2051
Assignees
adam (Adam Melkus)
Clear assignees
adam (Adam Melkus)
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/audiobookshelf#2051
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Doug411 on GitHub (Jun 12, 2024).
What happened?
I'm unable to use oath in the mobile app. When I set my redirects in Authentik as you listed (on separate lines).... I get a redirect uri error. I'm using Nginx Proxy Manager. Not sure how to fix it. If I set my redirect URI to * it works, but I don't really want to do that. It has always worked in browser, just not in mobile app unless I set the redirect to *.
Reference...(tried setting redirect in authentik as stated in thread below. Not sure how to check x-forwarded-proto, but i've never had that issue on other OIDC apps.
for Authentik:
To add to this, in Authentik or other SSO software the redirect uri has to be set to:
https://youraudiobookdomain/auth/openid/callback
audiobookshelf://oauth
Don't use wildcards like .*, they are not required.
(In Authentik its seperated by new line, in Keycloak by comma afaik).
Also make sure your reverse proxy creates a X-Forwarded-Proto header correctly, otherwise you might receive a redirect_uri mismatch, because the redirect_uri is set to http even when the request was made using https.
What did you expect to happen?
Successful login in mobile app
Steps to reproduce the issue
Audiobookshelf version
v2.10.1
How are you running audiobookshelf?
Docker
What OS is your Audiobookshelf server hosted from?
Linux
If the issue is being seen in the UI, what browsers are you seeing the problem on?
None
Logs
Additional Notes
No response
@nichwall commented on GitHub (Jun 12, 2024):
Did you add the
mobile-redirectmentioned at the end of the docs?https://www.audiobookshelf.org/guides/oidc_authentication/
@Doug411 commented on GitHub (Jun 12, 2024):
No I missed that. I just made that change to add the mobile redirect, but kept getting a 400 error.
Then I uninstalled the app and reinstalled it. When I reinstall it, it launches straight away into my audiobookshelf server with my account. It didnt even direct me to authentik to get my login info.
However when I delete my audiobookshelf cache and app data, and try to set it up manually by entering my external audibookshelf url and clicking SSO login, I get a 400 error. Then I uninstall the app, reinstall and it launches right back into my server.
How does it know my server URL and ID from a fresh install. Is my database connection cached somewhere and somehow not fully deleted when i clear data/cache and uninstall the app, and therefore its not really doing a fresh install... Will new users will get the 400 error? Or is it just vudu magic and I can accept that it will work for new users (hopefully it routes them to authentik and they can login successfully)
FYI it was late last night... but I do think it was doing this before I added the mobile redirect... I seem to recall that I deleted the app and when I reinstalled it launched right into my server. I assumed it was still broken because I couldn't manually delete the server and readd it manually.
@advplyr commented on GitHub (Jun 12, 2024):
Make sure to restart the server after making changes to the OIDC settings. Updating that after it is initialized is a work in progress.
After a successful login the users api token is used for authentication for all future auth attempts. The api token is cached but uninstalling and clearing data will remove it.
@advplyr commented on GitHub (Jun 17, 2024):
Is this still an issue?
@JorisM commented on GitHub (Jun 19, 2024):
@advplyr for me yes, with the latest docker version and the latest android app i get the same behaviour as described by @Doug411
@Sapd commented on GitHub (Aug 1, 2024):
Probably access logs would be helpful (the one from the reverse proxy in front of authentik and the one in front of abs). I suspect a mismatch between http and https. Is x-forward-proto set correctly?
@JorisM
@JorisM commented on GitHub (Aug 5, 2024):
@Sapd
I have authentik + adb behind the same traefik instance. If clicked on the login button, the access log for traefik spit out:
where 192.168.1.216 is the audiobookshelf instance ip.
authentik doesn't show any logs related to adb.
on the adb logs view, i see the following:
which is not what i have set though:
maybe the android client sends a hardcoded value?
let me know if this helps or i can provide something else
@Sapd commented on GitHub (Aug 5, 2024):
@JorisM The redirect URls you specified is incorrect.
The ones you specified have to go into the Authentik configuration.
If you want to use the official app, you just have to specify in Audiobookshelf:
audiobookshelf://oauthif you also for example want to allow the 3rd party app plappa you have to also specifyplappa://oauthThe reason why you have to do this, is because Audiobookshelf itself (when you use the app) acts as a kind of oauth2 server, acting as middleman for your identity provider. It will replace the callback URL of the app
audiobookshelf://oauthwith the mobile-redirect URL against the iDP, because some identity providers do not like App-URL schemes. We also cannot allow every URL on default, as this would pose an open-redirect security vulnerability.@JorisM commented on GitHub (Aug 5, 2024):
ah you are right. sorry about that and thanks for the explanation! makes sense now. seems fixed for us. thanks again!
@jvines commented on GitHub (Mar 24, 2025):
Hi! I'm still having this problem 😓 I have both redirect URIs and it works from my desktop, but not from iOS using Chrome or Safari, as I get a 403 error.
It does work with '.*' but I obviously don't want to do that.
Could you help me out?
@jmadden91 commented on GitHub (Apr 1, 2025):
@jvines You probably need: to add
/audiobookshelfLike this:
Due to this setting: