OIDC provider not available

[samuelkdavis]

First Check

• This is not a feature request
• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the documentation, with the integrated search.
• I already read the docs and didn't find an answer.
• I can replicate the issue inside the Demo install.

Homebox Version

v0.25.0

What is the issue you are experiencing?

When updating images, or restarting docker, homebox doesn't load correctly - only displaying the text "OIDC provider not available" on the home page.

The dockerfile is:

services:
  homebox:
    image: ghcr.io/sysadminsmedia/homebox:latest
    container_name: homebox
    restart: always
    environment:
      - HBOX_LOG_LEVEL=info
      - HBOX_LOG_FORMAT=text
      - HBOX_WEB_MAX_FILE_UPLOAD=10
      # Please consider allowing analytics to help us improve Homebox (basic computer information, no personal data)
      - HBOX_OPTIONS_ALLOW_ANALYTICS=true
      - HBOX_OIDC_ENABLED=true
      - HBOX_OIDC_ISSUER_URL=https://authentik.xxxxxxxx/application/o/homebox/
      - HBOX_OIDC_CLIENT_ID=xxxxxx
      - HBOX_OIDC_CLIENT_SECRET=xxxxxx
      - HBOX_OPTIONS_TRUST_PROXY=true
      - HBOX_OIDC_AUTO_REDIRECT=true
    volumes:
      - ${DATABASE_FOLDER}/homebox/homebox-data:/data/
    ports:
      - 7745:7745
    depends_on:
      - authentik
      - authentik_worker
      - authentik_database
      - caddy

volumes:
  homebox-data:
    driver: local

How can the maintainer reproduce the issue?

Run authentik and homebox in docker compose
run docker down
run docker up

Deployment

Docker (Linux)

Database Type

SQLite

OS Architechture

x86_64 (AMD, Intel)

Deployment Details

No response

[tankerkiller125]

Authentik must be fully online and responding to the metadata URL requests before Homebox comes online. If Homebox cannot get the metadata endpoint within a pre-defined time it will fail the OIDC provider.

[samuelkdavis]

Is there a way to make this dependency able to be read on first use rather than initialization? Or re-initialize on a page load?

[tankerkiller125]

The dependency checks when Homebox loads, there isn't (as far as I'm aware) a way to defer it. We can probably fine tune and adjust the timeouts and retry logic. But at the end of the day, Authentik (or any OIDC provider) will always have to be online before Homebox starts.

[hugoovf]

Workaround

Add this service on the same compose:

  oidc-ready:
    image: curlimages/curl:latest
    restart: "no"
    environment:
      OIDC_ISSUER_URL: {{ HBOX_OIDC_ISSUER_URL }}
    command: >
      sh -c 'ISSUER="$${OIDC_ISSUER_URL%/}";
      until curl -fsS "$${ISSUER}/.well-known/openid-configuration" | grep -q "\"issuer\"";
      do echo "waiting for authentik oidc..."; sleep 5; done'

Add on Homebox service:

depends_on:
  oidc-ready:
    condition: service_completed_successfully

[ndmax]

Workaround

Add this service on the same compose:

  oidc-ready:
    image: curlimages/curl:latest
    restart: "no"
    environment:
      OIDC_ISSUER_URL: {{ HBOX_OIDC_ISSUER_URL }}
    command: >
      sh -c 'ISSUER="$${OIDC_ISSUER_URL%/}";
      until curl -fsS "$${ISSUER}/.well-known/openid-configuration" | grep -q "\"issuer\"";
      do echo "waiting for authentik oidc..."; sleep 5; done'

Add on Homebox service:

depends_on:
  oidc-ready:
    condition: service_completed_successfully

If your OIDC provider (e.g. Authentik) is a service/container specified in a different compose file, would the above strategy be more like a solution than a workaround?

[pogora]

I got this working. For me the issue was that I didn't have a Signing Key set in Authentik under Providers.
Once that was done it worked like a charm.