tranquil-pds
Our Personal Data Server from scratch! tranquil.farm
pds rust database fun oauth atproto
Star 547
Fork 39
Watch

Authentik OIDC issuer setup #143

Closed fox1e.dev
Closed opened by fox1e.dev

Hi, I've been trying to set up tranquil and mostly succeeded, however I cannot figure out which URL I should put into the issuer variable?

Authentik offers Configuration URL and Configuration Issuer as the foremost options, neither of which seem to be working...

Thanks a lot ^^

Note

Changed the title for easier searching for references for anyone struggling with the same issue 😃

oyster.cafe

hi :3

should be something like issuer = "https://authentik.oyster.cafe/application/o/my-evil-sso/, so just OpenID Configuration Issuer, without /.well-known/openid-configuration

fox1e.dev

That's weird, that doesn't seem to work for me...

Whenever I try to link my SSO I get Failed to build authorization URL

I have my env var set to SSO_OIDC_ISSUER=https://sso.example.com/application/o/fox1e-atproto-pds/

Logs:

2026-09-22T07:15:44.937986766Z 2026-09-22T07:15:44.937826Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO record_blobs (repo_id, …" db.statement="\n\n\n            INSERT INTO record_blobs (repo_id, record_uri, blob_cid)\n            SELECT $1, record_uri, blob_cid\n            FROM UNNEST($2::text[], $3::text[]) AS t(record_uri, blob_cid)\n            ON CONFLICT (repo_id, record_uri, blob_cid) DO NOTHING\n            \n" rows_affected=3 rows_returned=0 elapsed=11.50507369s elapsed_secs=11.50507369 slow_threshold=1s
2026-09-22T07:15:44.938027486Z 2026-09-22T07:15:44.937876Z  INFO tranquil_pds::scheduled: Backfilled record_blobs user_id=f3a47106-16bd-4cf5-b7b7-6f2185ffd3db did=did:plc:7k4fe7oynunpmhrxezgljlf7 blob_refs=3
2026-09-22T07:15:44.938034353Z 2026-09-22T07:15:44.937885Z  INFO tranquil_pds::scheduled: Completed record_blobs backfill success=1 failed=0
2026-09-22T07:16:06.167712450Z 2026-09-22T07:16:06.167574Z  INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None
2026-09-22T07:16:08.793954921Z 2026-09-22T07:16:08.793858Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_authorization_request (id, …" db.statement="\n\n\n            INSERT INTO oauth_authorization_request\n                (id, did, device_id, client_id, client_auth, parameters, expires_at, code)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n            \n" rows_affected=0 rows_returned=0 elapsed=2.510149799s elapsed_secs=2.510149799 slow_threshold=1s
2026-09-22T07:16:08.802194918Z 2026-09-22T07:16:08.802130Z  INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None
2026-09-22T07:16:09.460633168Z 2026-09-22T07:16:09.460514Z  INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None
2026-09-22T07:16:13.112840502Z 2026-09-22T07:16:13.112664Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_authorization_request (id, …" db.statement="\n\n\n            INSERT INTO oauth_authorization_request\n                (id, did, device_id, client_id, client_auth, parameters, expires_at, code)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n            \n" rows_affected=0 rows_returned=0 elapsed=3.651794154s elapsed_secs=3.651794154 slow_threshold=1s
2026-09-22T07:16:13.113087977Z 2026-09-22T07:16:13.112989Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_authorization_request (id, …" db.statement="\n\n\n            INSERT INTO oauth_authorization_request\n                (id, did, device_id, client_id, client_auth, parameters, expires_at, code)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n            \n" rows_affected=0 rows_returned=0 elapsed=4.31049654s elapsed_secs=4.31049654 slow_threshold=1s
2026-09-22T07:16:13.114593605Z 2026-09-22T07:16:13.114520Z  INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None
2026-09-22T07:16:14.155361957Z 2026-09-22T07:16:14.155226Z  INFO tranquil_oauth_server::endpoints::par: PAR request received (form) login_hint=None
2026-09-22T07:16:15.285113321Z 2026-09-22T07:16:15.284965Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_authorization_request (id, …" db.statement="\n\n\n            INSERT INTO oauth_authorization_request\n                (id, did, device_id, client_id, client_auth, parameters, expires_at, code)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n            \n" rows_affected=1 rows_returned=0 elapsed=2.169958562s elapsed_secs=2.169958562 slow_threshold=1s
2026-09-22T07:16:15.285143561Z 2026-09-22T07:16:15.284998Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_authorization_request (id, …" db.statement="\n\n\n            INSERT INTO oauth_authorization_request\n                (id, did, device_id, client_id, client_auth, parameters, expires_at, code)\n            VALUES ($1, $2, $3, $4, $5, $6, $7, $8)\n            \n" rows_affected=1 rows_returned=0 elapsed=1.129286617s elapsed_secs=1.129286617 slow_threshold=1s
2026-09-22T07:16:18.936241899Z 2026-09-22T07:16:18.936074Z ERROR tranquil_oauth_server::sso_endpoints: Failed to build auth URL: Discovery("JWKS parse failed: error decoding response body")
2026-09-22T07:16:25.562906049Z 2026-09-22T07:16:25.562797Z  INFO tranquil_oauth_server::endpoints::authorize::passkey: Passkey authentication successful did=did:plc:7k4fe7oynunpmhrxezgljlf7
2026-09-22T07:16:27.011318685Z 2026-09-22T07:16:27.011143Z  INFO tranquil_oauth_server::endpoints::token::grants: Authorization code grant requested has_dpop=true client_id=Some("https://pds.atproto.fox1e.dev/oauth-client-metadata.json")
2026-09-22T07:16:27.891645163Z 2026-09-22T07:16:27.891535Z  INFO tranquil_oauth_server::endpoints::token::grants: Authorization code grant completed, token created did=did:plc:7k4fe7oynunpmhrxezgljlf7 token_id=3e9a01dd-7034-4139-9dbe-cbb6f74e55d0 client_id=https://pds.atproto.fox1e.dev/oauth-client-metadata.json
2026-09-22T07:16:56.165224372Z 2026-09-22T07:16:56.165036Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_dpop_jti (jti) …" db.statement="\n\n\n            INSERT INTO oauth_dpop_jti (jti)\n            VALUES ($1)\n            ON CONFLICT (jti) DO NOTHING\n            \n" rows_affected=1 rows_returned=0 elapsed=2.383555727s elapsed_secs=2.383555727 slow_threshold=1s
2026-09-22T07:16:56.168915244Z 2026-09-22T07:16:56.168787Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO oauth_dpop_jti (jti) …" db.statement="\n\n\n            INSERT INTO oauth_dpop_jti (jti)\n            VALUES ($1)\n            ON CONFLICT (jti) DO NOTHING\n            \n" rows_affected=1 rows_returned=0 elapsed=2.292866799s elapsed_secs=2.292866799 slow_threshold=1s
2026-09-22T07:17:03.672955836Z 2026-09-22T07:17:03.672820Z ERROR tranquil_oauth_server::sso_endpoints: Failed to build auth URL: Discovery("JWKS parse failed: error decoding response body")
2026-09-22T07:35:29.963728359Z 2026-09-22T07:35:29.963564Z  INFO tranquil_sync::subscribe_repos: New firehose subscriber cursor=Some(77) subscribers=5
2026-09-22T07:42:54.055422457Z 2026-09-22T07:42:54.055292Z  INFO tranquil_oauth_server::endpoints::authorize::login: No login_hint in request
2026-09-22T07:43:37.564821006Z 2026-09-22T07:43:37.564636Z  INFO tranquil_oauth_server::endpoints::authorize: authorize_redirect performing 303 redirect final_url=https://pds.atproto.fox1e.dev/app/?iss=https%3A%2F%2Fpds.atproto.fox1e.dev&state=c2ea24239b7f2609d647287b497d84950628bf99ddfb8b37a38cf7ee83165d5a&code=NRzsX35TZvSAlZ7oGUJ5AW1YHPJBLRQyrdX9ci6KbMI client_redirect=https://pds.atproto.fox1e.dev/app/
2026-09-22T07:43:46.915705799Z 2026-09-22T07:43:46.915542Z ERROR tranquil_oauth_server::sso_endpoints: Failed to build auth URL: Discovery("JWKS parse failed: error decoding response body")
2026-09-22T07:45:32.275502568Z 2026-09-22T07:45:32.275372Z  INFO tranquil_oauth_server::endpoints::authorize::login: Checking login_hint for delegation login_hint=did:plc:7k4fe7oynunpmhrxezgljlf7
2026-09-22T07:45:32.275546575Z 2026-09-22T07:45:32.275403Z  INFO tranquil_oauth_server::endpoints::authorize::login: Normalized login_hint normalized=did:plc:7k4fe7oynunpmhrxezgljlf7
2026-09-22T07:45:32.277824091Z 2026-09-22T07:45:32.277713Z  INFO tranquil_oauth_server::endpoints::authorize::login: Found user for login_hint did=did:plc:7k4fe7oynunpmhrxezgljlf7 has_password=true
2026-09-22T07:45:32.279304103Z 2026-09-22T07:45:32.279231Z  INFO tranquil_oauth_server::endpoints::authorize::login: Delegation check is_delegated=false has_password=true
2026-09-22T07:45:42.162734087Z 2026-09-22T07:45:42.162563Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="INSERT INTO webauthn_challenges (id, …" db.statement="\n\nINSERT INTO webauthn_challenges (id, did, challenge, challenge_type, state_json, expires_at)\n               VALUES ($1, $2, $3, $4, $5, $6)\n" rows_affected=1 rows_returned=0 elapsed=3.713153871s elapsed_secs=3.7131538710000003 slow_threshold=1s
2026-09-22T07:45:43.283406782Z 2026-09-22T07:45:43.283220Z  WARN sqlx::query: slow statement: execution time exceeded alert threshold summary="UPDATE oauth_authorization_request SET did …" db.statement="\n\n\n            UPDATE oauth_authorization_request\n            SET did = $2, device_id = $3, expires_at = $4\n            WHERE id = $1\n            \n" rows_affected=1 rows_returned=0 elapsed=1.120239544s elapsed_secs=1.120239544 slow_threshold=1s
2026-09-22T07:45:46.805683650Z 2026-09-22T07:45:46.805561Z  INFO tranquil_oauth_server::endpoints::authorize: authorize_redirect performing 303 redirect final_url=https://tangled.org/oauth/callback?iss=https%3A%2F%2Fpds.atproto.fox1e.dev&state=7c3H6BnWS_cHQCMMqWE7ug&code=dYTNrPahX_mgLf94mLETWZ_S6LScGWRttB2tA5lrJmk client_redirect=https://tangled.org/oauth/callback
oyster.cafe

i'm gonna be honest I have no idea anything about authentik specifically :p

what do you get if you try curl https://sso.example.com/application/o/fox1e-atproto-pds/jwks?

if it's {} then you're probably missing a signing key on your side, so then if you add one on authentik and then restart tranquil maybe it'll work

fox1e.dev

Yeah iirc that was the case when I tried the jwks endpoint.

Thanks for the tip, will update once I get back to it ^^'

fox1e.dev

Well, apparently my original closing comment is not visible

Thanks a lot for the tip; I found it! ^w^

For anybody else struggling with Authentik:

  1. SSO_OIDC_ISSUER is https://sso.your.domain/application/o/app-identifier/ or as Authentik (2026.8.3) calls it OpenID Configuration Issuer
  2. Make sure the Signing Key in your OAuth2/OpenID Provider is selected Related GH Issue
  3. As for Redirect URIs I used a regex (Authorization): ^https://pds.atproto(\.staging)?\.fox1e.dev/.*
oyster.cafe

yippie!!

Sign up or Sign in to add to the discussion.