starred/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2026-01-11 20:00:28 +01:00
Code Issues 98 Packages Projects Releases 10 Wiki Activity

[Bug] OIDC Token Verification Fails When Authentik Encrypts "id_token" #952

New Issue
Closed
opened 2025-12-29 02:26:39 +01:00 by adam · 7 comments
adam commented 2025-12-29 02:26:39 +01:00
Owner
Copy Link

Originally created by @rolestack on GitHub (Feb 24, 2025).

Is this a support request?

  • This is not a support request

Is there an existing issue for this?

  • I have searched the existing issues

Current Behavior

When both the signing key and the encryption key are applied in Authentik, the following error is output:

2025-02-24T15:53:18Z ERR user msg: failed to verify id_token error="failed to verify ID token: oidc: failed to unmarshal claims: invalid character '\\x0f' looking for beginning of value" code=403

Expected Behavior

It seems that the error occurs because the OIDC code does not decrypt the encrypted token.

Steps To Reproduce

After removing the encryption key and attempting the login again, it works as expected.

Login fail

Image

Login success

Image

Environment

- Headscale version: 0.25.0
- Authentik version: 2025.2.0

config.yml

oidc:
  only_start_if_oidc_is_available: true
  issuer: "https://authentik.my.domain/application/o/headscale/"
  client_id: "------"
  client_secret: "------"

  use_expiry_from_token: false

  scope: ["openid", "profile", "email"]

  pkce:
    enabled: true
    method: S256

Runtime environment

  • Headscale is behind a (reverse) proxy
  • Headscale runs in a container

Anything else?

No response

Originally created by @rolestack on GitHub (Feb 24, 2025). ### Is this a support request? - [x] This is not a support request ### Is there an existing issue for this? - [x] I have searched the existing issues ### Current Behavior When both the signing key and the encryption key are applied in Authentik, the following error is output: ``` 2025-02-24T15:53:18Z ERR user msg: failed to verify id_token error="failed to verify ID token: oidc: failed to unmarshal claims: invalid character '\\x0f' looking for beginning of value" code=403 ``` ### Expected Behavior It seems that the error occurs because the OIDC code does not decrypt the encrypted token. ### Steps To Reproduce After removing the encryption key and attempting the login again, it works as expected. # Login fail ![Image](https://github.com/user-attachments/assets/e0d933c1-ccf4-4d79-a787-3d6692c20d6e) # Login success ![Image](https://github.com/user-attachments/assets/d7f07645-0028-4112-b193-b35a76002dd9) ### Environment ```markdown - Headscale version: 0.25.0 - Authentik version: 2025.2.0 config.yml oidc: only_start_if_oidc_is_available: true issuer: "https://authentik.my.domain/application/o/headscale/" client_id: "------" client_secret: "------" use_expiry_from_token: false scope: ["openid", "profile", "email"] pkce: enabled: true method: S256 ``` ### Runtime environment - [x] Headscale is behind a (reverse) proxy - [x] Headscale runs in a container ### Anything else? _No response_
adam added the stalebugOIDC labels 2025-12-29 02:26:39 +01:00
adam closed this issue 2025-12-29 02:26:39 +01:00
adam commented 2025-12-29 02:26:40 +01:00
Author
Owner
Copy Link

@kradalby commented on GitHub (Feb 25, 2025):

Is this a separate encryption key that is specific to Authentik? or is it part of any spec?

If it is part of a spec, we can have a look at implementing it, if it is only present in Authentik, we likely will not support it, or at least prioritise it.

@kradalby commented on GitHub (Feb 25, 2025): Is this a separate encryption key that is specific to Authentik? or is it part of any spec? If it is part of a spec, we can have a look at implementing it, if it is only present in Authentik, we likely will not support it, or at least prioritise it.
adam commented 2025-12-29 02:26:40 +01:00
Author
Owner
Copy Link

@rolestack commented on GitHub (Feb 25, 2025):

According to the OpenID Connect Core 1.0, ID token encryption is optional.

That said, encryption is still a good idea. It helps keep the token's contents private and prevents sensitive data from being exposed. If the ID token includes anything sensitive, turning on encryption adds an extra layer of security.

So, while it’s not a requirement, enabling encryption is definitely worth considering, especially in high-security environments.

@rolestack commented on GitHub (Feb 25, 2025): According to the [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation), ID token encryption is optional. That said, encryption is still a good idea. It helps keep the token's contents private and prevents sensitive data from being exposed. If the ID token includes anything sensitive, turning on encryption adds an extra layer of security. So, while it’s not a requirement, enabling encryption is definitely worth considering, especially in high-security environments.
adam commented 2025-12-29 02:26:40 +01:00
Author
Owner
Copy Link

@rolestack commented on GitHub (Feb 25, 2025):

Authentik added JWE support for OAuth in their 2024.10.0 release.
I'm not sure if other products have implemented this feature yet.

@rolestack commented on GitHub (Feb 25, 2025): Authentik added JWE support for OAuth in their [2024.10.0 release](https://docs.goauthentik.io/docs/releases/2024.10?utm_source=chatgpt.com#new-features). I'm not sure if other products have implemented this feature yet.
adam commented 2025-12-29 02:26:40 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (May 27, 2025):

This issue is stale because it has been open for 90 days with no activity.

@github-actions[bot] commented on GitHub (May 27, 2025): This issue is stale because it has been open for 90 days with no activity.
adam commented 2025-12-29 02:26:41 +01:00
Author
Owner
Copy Link

@github-actions[bot] commented on GitHub (Jun 3, 2025):

This issue was closed because it has been inactive for 14 days since being marked as stale.

@github-actions[bot] commented on GitHub (Jun 3, 2025): This issue was closed because it has been inactive for 14 days since being marked as stale.
adam commented 2025-12-29 02:26:41 +01:00
Author
Owner
Copy Link

@regiolis commented on GitHub (Sep 4, 2025):

Still not working on my side

headscale | 2025-09-04T08:10:51Z ERR user msg: failed to verify id_token error="failed to verify ID token: oidc: malformed jwt: unexpected signature algorithm "HS256"; expected ["RS256"]" code=403

Image
@regiolis commented on GitHub (Sep 4, 2025): Still not working on my side headscale | 2025-09-04T08:10:51Z ERR user msg: failed to verify id_token error="failed to verify ID token: oidc: malformed jwt: unexpected signature algorithm \"HS256\"; expected [\"RS256\"]" code=403 <img width="1315" height="750" alt="Image" src="https://github.com/user-attachments/assets/fde9bf93-de6a-468e-b27b-a296f07e5a6a" />
adam commented 2025-12-29 02:26:41 +01:00
Author
Owner
Copy Link

@rudstone commented on GitHub (Sep 11, 2025):

+1 any news?

@rudstone commented on GitHub (Sep 11, 2025): +1 any news?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
CLI
DERP
DNS
Nix
OIDC
SSH
bug
database
documentation
duplicate
enhancement
faq
good first issue
grants
help wanted
might-come
needs design doc
needs investigation
no-stale-bot
out of scope
performance
policy 📝
pull-request
Mirrored from GitHub Pull Request
 question
regression
routes
stale
tags
tailscale-feature-gap
well described ❤️
wontfix
No Label OIDC bug stale
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/headscale#952
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?