System Information
| Field |
Value |
| Operating System |
Linux - Debian GNU/Linux 13 on x86_64 |
| Product |
AMP ‘Proteus’ v2.8.0.0 (Mainline) |
| Virtualization |
Docker |
| Application |
Minecraft |
| Module |
MinecraftModule |
| Running in Container |
Yes |
| Current State |
Ready |
Problem Description
Issue
(I mistakenly used a new discourse account with Google for my last ticket because I did not remember I had this one)
I successfully configured OIDC using my IdP (Authelia) but now it always redirects to the IdP in every URL. Also it doesn’t seem to be saving the session.
On the other hand, SFTP is not working even though I’ve enabled keypair-only authentication.
I’m putting the OIDC and SFTP problems in one ticket because I believe the SFTP one is a consequence of setting OIDC up.
Reproduction Steps
- (OIDC) Refresh the page
- Redirects to IdP from any AMP URL
- (SFTP) Can’t login
I don’t use OIDC, but did some LLM checking and came up with this you might check until someone else replies:
This can happen if the OIDC session cookie isn’t being set or honored across your domain, causing the IdP to re-authenticate on every request. Check that your reverse proxy (e.g., Traefik, Nginx) is forwarding headers like X-Forwarded-Proto and X-Forwarded-Host correctly to Authelia.
docs.mealie.io
authelia.com
Possible Causes of Continuous Redirection to IdP
When experiencing continuous redirection to your Identity Provider (IdP) like Authelia, it often indicates issues with session management or configuration. Here are some common causes and solutions:
Session Cookie Issues
- OIDC Session Cookie Not Set: The session cookie may not be set correctly, which can lead to repeated authentication requests.
- Cookie Not Honored Across Domain: If the cookie is not recognized across your domain, the IdP will prompt for re-authentication.
Reverse Proxy Configuration
Ensure that your reverse proxy (e.g., Traefik, Nginx) is configured to forward the necessary headers. This is crucial for maintaining session integrity. Check the following headers:
| Header Name |
Description |
| X-Forwarded-Proto |
Indicates the original protocol (HTTP/HTTPS) |
| X-Forwarded-Host |
Indicates the original host requested by the client |
Recommended Actions
- Check Reverse Proxy Settings: Verify that your reverse proxy is correctly forwarding the headers mentioned above.
- Inspect Cookie Settings: Ensure that the session cookie is configured to be valid across your domain.
- Review Authelia Configuration: Make sure that Authelia is set up to recognize and handle the forwarded headers properly.
By addressing these areas, you should be able to resolve the issue of continuous redirection to your IdP.
I have fixed the SFTP. It was the key format (AMP SSH server only supports RSA and mine was ED25519).
The OIDC redirect still happens… It’s a kinda annoying atp.
EDIT: Just discovered there’s an open issue on gh (#1420) which seems to be similar to my case. There’s nothing I can do but wait ig…