OIDC using Authentik

[goug76]

I setup Authentik this weekend and I am stuck on getting Semaphore working. I followed the instructions found here, but when I try to login with Authentik it goes out to Authentik, but comes back to the login screen. No message of any kind, but looking at the logs in Portainer I get this:
time="2024-05-12T18:42:31-04:00" level=error msg="OIDC user 'admin' conflicts with local user"

The only reason why my user in Semaphore is admin, I thought in was conflicting with my Authentik user since it was the same. However, no matter what username I give it I get the same error, but with the username at that time.

I read the instructions for OIDC and added all the endpoint stuff, but nothing seems to work. Any idea why I am seeing this error?

My last attempt looked like this:

"oidc_providers": {
	"authentik": {
		"display_name": "Sign in with Authentik",
		"icon": "ansible",
		"provider_url": "https://authentik.domain.com/application/o/semaphore/",
		"client_id": "<client code>",
		"client_secret": "<secret>",
		"redirect_url": "https://semaphore.domain.com/api/auth/oidc/authentik/redirect",
		"endpoint": {
			"auth": "https://authentik.domain.com/application/o/authorize/",
			"token": "https://authentik.domain.com/application/o/token/",
			"userinfo": "https://authentik.domain.com/application/o/userinfo/"
		},
		"username_claim": "|",
		"email_claim": "email | {{ .id }}@authentik.domain.com",
		"name_claim": "name"
	}
},

Sorry forgot to mention my versions:
Semaphore UI: v2.9.75
Authentik: 2024.4.2

[tboerger]

The username claim | doesn't make sense

[fiftin]

Hi @tboerger It is new syntax :) It is mean "random".
Created to support GitHub because user can disable sharing email/username in the account settings.

https://docs.semui.co/administration-guide/openid#claim-expression

[fiftin]

Hi @goug76 you are took GitHub example. It is not suitable for Authentik. I experimented with it and this is my config:

  "authentik": {
   "display_name": "Authentik",
   "provider_url": "http://localhost:9000/application/o/test/",
   "client_id": "***",
   "client_secret": "***",
   "redirect_url": "http://localhost:8081/api/auth/oidc/authentik/redirect/",
   "scopes": ["openid", "profile", "email"],
   "username_claim": "preferred_username",
   "name_claim": "preferred_username"
  }

[fiftin]

Added to docs: https://docs.semui.co/administration-guide/openid/authentik

[goug76]

Thank you for the response, I will give it a try and let you know.

[CFenner]

IS there a way configure this via env vars for docker compose?

[fiftin]

@goug76 I found similar discussion here: #1663

[goug76]

That's the discussion I was following, but after doing everything I am still receiving the same error message.
time="2024-05-13T12:57:16-04:00" level=error msg="OIDC user 'admin' conflicts with local user

Setup:

"oidc_providers": {
	"authentik": {
		"display_name": "Sign in with Authentik",
		"provider_url": "https://authentik.example.com/application/o/semaphore/",
		"client_id": "***",
		"client_secret": "***",
		"redirect_url": "https://semaphore.example.com/api/auth/oidc/authentik/redirect",
		"scopes": ["openid", "profile", "email"],
		"username_claim": "preferred_username",
		"name_claim": "preferred_username"
	}
},

And for the document you updated, it doesn't like the / at the end of the redirect_url.

[goug76]

I was reading another article, it was for a different app, but it had a similar error message. They said they switched their database to MySQL and it worked. I am using the Postgres database; do you think it would make a difference if I switched?

[fiftin]

What app do you mean?

[goug76]

I don't recall what app it was, but when I was searching the error message it came up. It doesn't sound like it would work, but spit balling.

[goug76]

Holy crap, when I switched everything over to a MySQL database it worked.

[goug76]

Scratch that I forgot to login when I first created everything, still getting the same error even on MySQL. When it did work and let me in, I had no rights to do anything. Worth a shot.

[goug76]

OK so I have it working now. The issue I was having was while I did change up the username, I didn't change up the email address and both apparently have to be unique. I'm not sure if this should be raised as a bug, the expected behavior would be if user already exists then use that account, else create a new one. Portainer has something similar where it doesn't create a new account, but uses the one that matches, or it creates a new one if it doesn't. For now, I will keep the two accounts separate or better yet delete the admin account once I give my user admin rights.

By the way I absolutely love Semaphore, makes managing all my servers a breeze. Keep up the GREAT work!