starred/audiobookshelf
1
0
Fork 0
mirror of https://github.com/advplyr/audiobookshelf.git synced 2026-05-30 23:40:40 +02:00
Code Issues 1.0k Packages Projects Releases 10 Wiki Activity

[Bug]: "[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found" #2716

New Issue
Closed
opened 2026-04-25 00:09:50 +02:00 by adam · 11 comments
adam commented 2026-04-25 00:09:50 +02:00
Owner
Copy Link
Copy Source

Originally created by @Gibby503 on GitHub (Apr 19, 2025).

What happened?

Image

"[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found"

Getting this error when trying to sign in using a SaaS OIDC application via cloudflare, which in turn is using Authentik as its OIDC provider. The cloudflare Saas OIDC information is whats been popped in to audiobookshelf under the authentication settings.

Not sure why i'm getting this error, this setup is working with other services I host

Image

If I don't use cloudflare to pass the authenticaiton through to authentik, and only use authentik, I get a 403 error instead -
Image

What did you expect to happen?

sso via this cloudflare app/authentik setting in to audiobookshelf via mathched usernames

Steps to reproduce the issue

  1. see what happened section

Audiobookshelf version

v2.20.0

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Other (list in "Additional Notes" box)

If the issue is being seen in the UI, what browsers are you seeing the problem on?

None

Logs

2025-04-19 04:41:11.844

ERROR

"[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found"

Additional Notes

Unraid Docker, using a cloudflare tunnel to pubicly host the service and this is why I would like the SSO via cloudflare/authentik

Originally created by @Gibby503 on GitHub (Apr 19, 2025). ### What happened? ![Image](https://github.com/user-attachments/assets/482defa9-f061-47c4-aa2c-65e0723a8799) "[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found" Getting this error when trying to sign in using a SaaS OIDC application via cloudflare, which in turn is using Authentik as its OIDC provider. The cloudflare Saas OIDC information is whats been popped in to audiobookshelf under the authentication settings. Not sure why i'm getting this error, this setup is working with other services I host ![Image](https://github.com/user-attachments/assets/700c6861-4bad-49b0-87cc-660d803dfdd7) If I don't use cloudflare to pass the authenticaiton through to authentik, and only use authentik, I get a 403 error instead - ![Image](https://github.com/user-attachments/assets/69f5b0b4-c0ae-45fd-b6d5-f8f75754c858) ### What did you expect to happen? sso via this cloudflare app/authentik setting in to audiobookshelf via mathched usernames ### Steps to reproduce the issue 1. see what happened section ### Audiobookshelf version v2.20.0 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Other (list in "Additional Notes" box) ### If the issue is being seen in the UI, what browsers are you seeing the problem on? None ### Logs ```shell 2025-04-19 04:41:11.844 ERROR "[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found" ``` ### Additional Notes Unraid Docker, using a cloudflare tunnel to pubicly host the service and this is why I would like the SSO via cloudflare/authentik
adam added the bug label 2026-04-25 00:09:50 +02:00
adam closed this issue 2026-04-25 00:09:50 +02:00
adam commented 2026-04-25 00:09:51 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Apr 19, 2025):

How have you configured OIDC in ABS?

@nichwall commented on GitHub (Apr 19, 2025): How have you configured OIDC in ABS?
adam commented 2026-04-25 00:09:51 +02:00
Author
Owner
Copy Link
Copy Source

@Gibby503 commented on GitHub (Apr 19, 2025):

I have it setup as an application/provider, which is linked to a cloudflare saas oidc application, the details of that are what are in abs

@Gibby503 commented on GitHub (Apr 19, 2025): I have it setup as an application/provider, which is linked to a cloudflare saas oidc application, the details of that are what are in abs
adam commented 2026-04-25 00:09:51 +02:00
Author
Owner
Copy Link
Copy Source

@nichwall commented on GitHub (Apr 19, 2025):

I mean can you log in and share a screenshot of the configuration? Don't forget to block out any domain information, but someone may may come along and help point out what is wrong. This sounds like either something is set up wrong or something is configured incorrectly outside of ABS.

The website has instructions for bypassing SSO and how to set it up in general https://www.audiobookshelf.org/guides/oidc_authentication. It looks like you have not disabled the local login due to sharing screenshots of the logs so you should be able to get to the authentication settings page.

The redirect issue sounds like an issue outside of Audiobookshelf, though. Initial searching for the 302 return code is that Cloudflare or your other SSO provider is returning the wrong thing. This could be an issue if you are mixing protocols like http and https.

@nichwall commented on GitHub (Apr 19, 2025): I mean can you log in and share a screenshot of the configuration? Don't forget to block out any domain information, but someone may may come along and help point out what is wrong. This sounds like either something is set up wrong or something is configured incorrectly outside of ABS. The website has instructions for bypassing SSO and how to set it up in general https://www.audiobookshelf.org/guides/oidc_authentication. It looks like you have not disabled the local login due to sharing screenshots of the logs so you should be able to get to the authentication settings page. The redirect issue sounds like an issue outside of Audiobookshelf, though. Initial searching for the 302 return code is that Cloudflare or your other SSO provider is returning the wrong thing. This could be an issue if you are mixing protocols like http and https.
adam commented 2026-04-25 00:09:52 +02:00
Author
Owner
Copy Link
Copy Source

@Gibby503 commented on GitHub (Apr 19, 2025):

I've setup pocketid instead of authentik now and still getting [Auth] No data in openid callback - OPError: expected 200 errors.

If I point it directly to the pocket ID instance, and if I try and route it through cloudflare, one gets me a 403 error and the other a 302 -

Image

Image

I followed both the ABS, and PocketID instructions - https://pocket-id.org/docs/client-examples/audiobookshelf

@Gibby503 commented on GitHub (Apr 19, 2025): I've setup pocketid instead of authentik now and still getting [Auth] No data in openid callback - OPError: expected 200 errors. If I point it directly to the pocket ID instance, and if I try and route it through cloudflare, one gets me a 403 error and the other a 302 - ![Image](https://github.com/user-attachments/assets/74477779-4234-428c-aa76-bfb3645cbf64) ![Image](https://github.com/user-attachments/assets/6f163ce7-dcf6-4c51-b227-4c65abaed003) I followed both the ABS, and PocketID instructions - https://pocket-id.org/docs/client-examples/audiobookshelf
adam commented 2026-04-25 00:09:52 +02:00
Author
Owner
Copy Link
Copy Source

@advplyr commented on GitHub (Apr 19, 2025):

Make sure to restart your server any time you make changes to the auth settings. There is a known issue where settings are only applied on server init.

@advplyr commented on GitHub (Apr 19, 2025): Make sure to restart your server any time you make changes to the auth settings. There is a known issue where settings are only applied on server init.
adam commented 2026-04-25 00:09:52 +02:00
Author
Owner
Copy Link
Copy Source

@Gibby503 commented on GitHub (Apr 19, 2025):

Yep, I've restarted both the auth service and the abs service and still get the error sadly - [Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found

Swapped back to using the cloudflare saas oidc application thats using pocketid.
Even added more redirect uri's for http and the local IP incase that was the issue, but no luck.

I feel like it must be some tiny thing that's causing a conflict, whether its cloudflare or something on that side, i'm not sure, as i'm having 403 errors locally even if cloudflare isn't in the picture. Although, I guess I am accessing my abs via a cloudflare tunnel'd domain, even so, I get the same errors using the service locally. On the authentik/pocketID app side, it's always happy that the connection has been authorised, and the error is on the ABS side.

@Gibby503 commented on GitHub (Apr 19, 2025): Yep, I've restarted both the auth service and the abs service and still get the error sadly - [Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found Swapped back to using the cloudflare saas oidc application thats using pocketid. Even added more redirect uri's for http and the local IP incase that was the issue, but no luck. I feel like it must be some tiny thing that's causing a conflict, whether its cloudflare or something on that side, i'm not sure, as i'm having 403 errors locally even if cloudflare isn't in the picture. Although, I guess I am accessing my abs via a cloudflare tunnel'd domain, even so, I get the same errors using the service locally. On the authentik/pocketID app side, it's always happy that the connection has been authorised, and the error is on the ABS side.
adam commented 2026-04-25 00:09:53 +02:00
Author
Owner
Copy Link
Copy Source

@Gibby503 commented on GitHub (Apr 20, 2025):

I fixed this :).

Not sure exactly what did it, but, it works now via cloudflare with authentik and pocketid. Thank you for your input!

@Gibby503 commented on GitHub (Apr 20, 2025): I fixed this :). Not sure exactly what did it, but, it works now via cloudflare with authentik and pocketid. Thank you for your input!
adam commented 2026-04-25 00:09:53 +02:00
Author
Owner
Copy Link
Copy Source

@caesay commented on GitHub (Apr 29, 2025):

I also have this same issue with CloudFlare (no authentik): "[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found".

I don't think it's an issue with SSO configuration (since I use the same setup with lots of other apps) and I've tried updating and restarting everything prior to testing.

Steps to setup:

  • Create a SaaS (oidc) app in CloudFlare Access
  • Add the redirect url's, an access policy, and save.
  • In Audiobookshelf, enable oidc, paste issuer from CF, clientid, secret, and auto-register and save.

Steps to reproduce:

  • Click the "SSO Login" button
  • This will redirect to CF Access login page. Authenticate as usual
  • I watched in the network tab of devtools
    • there was a few internal cloudflare 302 redirects (expected)
    • I got redirected back to audiobookshelf https://mydomain.com/audiobookshelf/auth/openid/callback?code=[somecode]&state=[somestate] - looks correct and expected to me. This was a GET request, and the response from audiobookshelf was 302 Found (location: /login?error=Unauthorized)

So basically, the SSO auth was successful, the 302 redirect back to audiobookshelf was to the correct URL and contained the required access code. Why would audiobookshelf say "No data in openid callback" ?

(As an aside, I would actually prefer to not have to configure OIDC in audiobookshelf at all. My reverse proxy authenticates requests before audiobookshelf is even reached, and can supply a header containing the authenticated user's email for auto login.)

@caesay commented on GitHub (Apr 29, 2025): I also have this same issue with CloudFlare (no authentik): "[Auth] No data in openid callback - OPError: expected 200 OK, got: 302 Found". I don't _think_ it's an issue with SSO configuration (since I use the same setup with lots of other apps) and I've tried updating and restarting everything prior to testing. Steps to setup: - Create a SaaS (oidc) app in CloudFlare Access - Add the redirect url's, an access policy, and save. - In Audiobookshelf, enable oidc, paste issuer from CF, clientid, secret, and auto-register and save. Steps to reproduce: - Click the "SSO Login" button - This will redirect to CF Access login page. Authenticate as usual - I watched in the network tab of devtools - there was a few internal cloudflare 302 redirects (expected) - I got redirected back to audiobookshelf `https://mydomain.com/audiobookshelf/auth/openid/callback?code=[somecode]&state=[somestate]` - looks correct and expected to me. This was a GET request, and the response from audiobookshelf was 302 Found (location: `/login?error=Unauthorized`) So basically, the SSO auth was successful, the 302 redirect back to audiobookshelf was to the correct URL and contained the required access code. Why would audiobookshelf say "No data in openid callback" ? (As an aside, I would actually prefer to not have to configure OIDC in audiobookshelf at all. My reverse proxy authenticates requests before audiobookshelf is even reached, and can supply a header containing the authenticated user's email for auto login.)
adam commented 2026-04-25 00:09:53 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (May 16, 2025):

@caesay

I watched in the network tab of devtools
So basically, the SSO auth was successful, the 302 redirect back to audiobookshelf was to the correct URL and contained the required access code. Why would audiobookshelf say "No data in openid callback" ?

You are misinterpreting it a bit. Fairly said callback in this case is confusing.

It does not mean the OpenID Callback but the passport callback - which in the end is the identity providers token endpoint.

So basically what fails is this communication:
Audiobookshelf -> Idp Token endpoint

So you cannot verify that via the network tab of your browser, as that one is between ABS and the IDP.
Like the error message says, the problem is that the token endpoint returns 302 for some reason (which is wrong). One possibility could be a http vs https problem. For example if http://idp/token is used instead of https://idp/token because of wrong headers.

@Sapd commented on GitHub (May 16, 2025): @caesay > I watched in the network tab of devtools > So basically, the SSO auth was successful, the 302 redirect back to audiobookshelf was to the correct URL and contained the required access code. Why would audiobookshelf say "No data in openid callback" ? You are misinterpreting it a bit. Fairly said callback in this case is confusing. It does not mean the OpenID Callback but the passport callback - which in the end is the identity providers token endpoint. So basically what fails is this communication: Audiobookshelf -> Idp Token endpoint So you cannot verify that via the network tab of your browser, as that one is between ABS and the IDP. Like the error message says, the problem is that the token endpoint returns 302 for some reason (which is wrong). One possibility could be a http vs https problem. For example if http://idp/token is used instead of https://idp/token because of wrong headers.
adam commented 2026-04-25 00:09:53 +02:00
Author
Owner
Copy Link
Copy Source

@caesay commented on GitHub (May 17, 2025):

@Sapd thanks for the clarification. Cloudflare is my OIDC, so if what you're saying is that audiobookshelf code-behind (not front-end) is making a request to cloudflare, and cloudflare returns a 302, wouldn't that mean audiobookshelf should follow that redirect? Cloudflare (with the same config on both ends) works fine with every other self-hosted app I have, only audiobookshelf has issues, that leads me to believe either the request it's making is wrong or it's expected to follow. Is there any logs I can dig up that would help with further diagnosis?

@caesay commented on GitHub (May 17, 2025): @Sapd thanks for the clarification. Cloudflare is my OIDC, so if what you're saying is that audiobookshelf code-behind (not front-end) is making a request to cloudflare, and cloudflare returns a 302, wouldn't that mean audiobookshelf should follow that redirect? Cloudflare (with the same config on both ends) works fine with every other self-hosted app I have, only audiobookshelf has issues, that leads me to believe either the request it's making is wrong or it's expected to follow. Is there any logs I can dig up that would help with further diagnosis?
adam commented 2026-04-25 00:09:53 +02:00
Author
Owner
Copy Link
Copy Source

@Sapd commented on GitHub (May 18, 2025):

@caesay
The handling is done by https://github.com/panva/openid-client . I think a 302 is not defined in the standard and so it does not follow it.
I think there is some kind of configuration mistake. Double check the issuer (which must be really the issuer url - so usually something without an additional path or resource) and authorization url and restart ABS if changing that.
Also make sure X-Forwarded-Proto is correctly set by your reverse proxy.

Indeed it's a bit hard to debug. openid-client does not provide more advanced messages

@Sapd commented on GitHub (May 18, 2025): @caesay The handling is done by https://github.com/panva/openid-client . I think a 302 is not defined in the standard and so it does not follow it. I think there is some kind of configuration mistake. Double check the issuer (which must be really the issuer url - so usually something without an additional path or resource) and authorization url and restart ABS if changing that. Also make sure `X-Forwarded-Proto` is correctly set by your reverse proxy. Indeed it's a bit hard to debug. openid-client does not provide more advanced messages
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
authentication
backlog
bug
chapter editor
config-issue
ebooks
encoding/embedding
enhancement
help wanted
listening sessions & progress
planned
possible plugin
progress sync
pull-request
Mirrored from GitHub Pull Request
 sorting/filtering/searching
unable to reproduce
upload
users & permissions
waiting
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam (Adam Melkus)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/audiobookshelf#2716
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?