mirror of
https://github.com/actualbudget/actual.git
synced 2026-03-10 04:02:38 -05:00
[Feedback] OpenID and multi-user #1707
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/actual#1707
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @matt-fidd on GitHub (Dec 23, 2024).
Thanks to @lelemm, OpenID and multi-user support was added to Actual in #3878 as an experimental feature. This issue is to track feedback/bugs/issues/requests related specifically to that feature.
@shaankhosla commented on GitHub (Dec 24, 2024):
Thanks @lelemm for this amazing feature!
I'm having some trouble setting this up with Authelia. I'm getting the following error after trying to sign in with OpenId:
When I look at the logs for Actual I see the following:
Anyone know what I might be doing wrong?
@lelemm commented on GitHub (Dec 24, 2024):
I'm not on the PC right now, but maybe authelia does not implement openid, but oauth2.
If that's the case, you have to setup it using the config.json on the server specifying the authMethod to oauth2 instead of openid
Check this PR for more details https://github.com/actualbudget/actual-server/pull/527/files
@shaankhosla commented on GitHub (Dec 24, 2024):
Thanks, I'll dig around! I think Authelia has OpenID based on this, but I'll try the config.json.
@shaankhosla commented on GitHub (Dec 24, 2024):
I tried with the config.json and set the authMethod to "oauth2" but still got the same error.
@lelemm commented on GitHub (Dec 24, 2024):
To use the configuration in the file, you need to run the commands.
First disable the openid
yarn/npm run disable-openid
Then run
yarn/npm run enable-openid
This script will take the configuration from the file into the database
@shaankhosla commented on GitHub (Dec 24, 2024):
Ah thanks, I didn't realize I had to run that command for it to use the config. That worked! I had to switch my docker container from edge-alpine to just edge to have npm in it.
@shaankhosla commented on GitHub (Dec 24, 2024):
Actually, that seemed like it fixed the issue but I don't think it did.
After I run those commands I'm able to sign in (with account A) and assign a budget file to myself as admin. However, if I try to sign in through a different user account (with account B) in incognito mode I get the same
openid-grant-failederror I was seeing before. I then re-ran the disable/enable commands again and signed in with account B, at which point account B became the admin and I couldn't see account A in the user directory list. Then I tried signing in with account A and got the sameopenid-grant-failederror as before.@lelemm commented on GitHub (Dec 24, 2024):
You have to give access to the second user in the user directory
@lelemm commented on GitHub (Dec 24, 2024):
@shaankhosla https://deploy-preview-447.www.actualbudget.org/docs/experimental/multi-user
@shaankhosla commented on GitHub (Dec 24, 2024):
Got it, it's working as expected. I thought that new users would be added to that automatically at sign in. Thanks for all of your help!
@feyleth commented on GitHub (Dec 29, 2024):
it is possible to use multi-user without need to login with openID ?
@lelemm commented on GitHub (Dec 29, 2024):
Nope. They are tied together for now. One can expand for internal user management
@alexsalex commented on GitHub (Jan 2, 2025):
HI! Thank you for this future! Amazing!
But could you write some documentation about it? For example: what is the redirect URL for OAuth2?
@lelemm commented on GitHub (Jan 2, 2025):
https://your-actual-server-domain:your-actual-server/openid/callback
@nichtdu commented on GitHub (Jan 7, 2025):
just added via authentik. worked flawless so far. Enabling was quiet easy as well.
The fact that it deletes the url in case you change auth-provider in setup is a little confusing though - or rather the fact that it accepts invalid url and does not tell you (it resetted to placeholders but i did not notice and hit ok again - and i was not able to see error on first sight)
@mocdaniel commented on GitHub (Jan 7, 2025):
I noticed that arbitrary users seem to be able to access budget files of other users as long as they log in from the same device.
Consider the following situation - I got two users in my IAM solution (Authentik), one is called Daniel Bodky and is Admin in Actualbudget, the other is called John Doe and got added to the user directory of Actualbudget manually:
There is only one budget file available on the server, called Daniel. It has been created by the admin user and is configured to be accessible only by him:
However, if I log in to Actualbudget with the second user John Doe, I am offered to open the budget file. It even states that the supposedly unprivileged user is the file owner. Consequently, I can open and edit the budget with the unprivileged user (note the username in the top right):
If I login as John Doe from a private browser window, the behavior is as expected: The user doesn't have a budget file yet, so none is displayed; the budget file(s) of other users don't show either.
I guess this is due to the offline capabilities of Actualbudget, and the fact that all local files are available in the device/browser? So once a budget file has been downloaded to a device/browser, it's accessible to all users that might log in on that device/browser?
@lelemm commented on GitHub (Jan 7, 2025):
You are completely right. That's how its working atm
@mocdaniel commented on GitHub (Jan 7, 2025):
Are there plans to mitigate this behavior in the future? Maybe by 'disabling' offline mode when enabling OIDC auth/multi-user support?
@lelemm commented on GitHub (Jan 7, 2025):
AFAIK, not planned, but I guess with enough feedback for it will probably be mitigated
@ReclaimedBytes commented on GitHub (Jan 7, 2025):
Working well here with Pocket ID. Thanks for implementing!
@lelemm commented on GitHub (Jan 7, 2025):
Would be nice if someone is using a different OpenID provider, give some information like this:
So the list of validated providers can be increased for future users
@ReclaimedBytes commented on GitHub (Jan 7, 2025):
Where would I find that?
@lelemm commented on GitHub (Jan 7, 2025):
That would be built by you, if you have the knowledge
@woolfyx commented on GitHub (Jan 7, 2025):
Firstly, thanks for this great features ! 😍
Quick question regarding claims used to retrieve user information.Actually, at least for Entra ID, the username seems to be mapped to the display name? Is it correct? Maybe it can be interesting to be customized to use the UPN (which is unique in Entra ID - not sure it's the case for display name), for example?
This question aside, authentication process works perfectly.
@lelemm commented on GitHub (Jan 7, 2025):
The username saved is a little clunky honestly.
in the spec, there are definitions of the name of the fields, but I guess some providers just do what they want lol.
probably for Entra Id is catching a bad value (on the big list of possible values).
@Arnoud-B commented on GitHub (Jan 7, 2025):
To test this, I:
@jsimcina commented on GitHub (Jan 7, 2025):
Am I missing something? When trying to set OpenID via env variables, do I need to set a config.json file or activate things in the UI?
I'm using authentik and I've got:
ACTUAL_OPENID_DISCOVERY_URL
ACTUAL_OPENID_CLIENT_ID
ACTUAL_OPENID_CLIENT_SECRET
ACTUAL_OPENID_SERVER_HOSTNAME
vars set, but I see nothing in the logs, and actual is still prompting for password only. Is there an env var counterpart for authMethod or is actual supposed to infer that by the env vars?
@lelemm commented on GitHub (Jan 7, 2025):
this has being discussed at discord, take a look here:
https://discord.com/channels/937901803608096828/1245792355748155392/1326221059724410901
@joewashear007 commented on GitHub (Jan 7, 2025):
Thank you very much for this feature! it works great so far! My only comment is the User management menu being hidden behind the "Server Online" button is very non-intuitive and hard to discover. I thought something was broken until I can to this issue and researched it. It a small UI thing, but it definite help.
@deathblade666 commented on GitHub (Jan 7, 2025):
First logon is the owner of the server (admin), to my knowledge the budget files are not associated with the server owner aside from being available to serve from the server. I think having them unassigned makes sense especially for the case where people have already been sharing their instance. they can just assign to the appropriate person(s) instead of having to remember to reassign each file
@lelemm commented on GitHub (Jan 7, 2025):
Just to clarify about the owner naming.
You can change the owner anytime at the user access page. There is a button at the bottom right "Transfer Ownership"
@jsimcina commented on GitHub (Jan 7, 2025):
Ahhhh thank you for that. I just joined the discord so I hadn't looked there. That step should probably make it into the docs. I'm running in a K8S container rather than docker, and it's been operating beautifully.
So for anyone else trying to figure this out, the long and short of it is, npm has to be run once within the container to toggle the setting on in order for it to even read the env vars.
I did manage to get it up and running, here are a couple caveats I experienced though:
@Arnoud-B commented on GitHub (Jan 7, 2025):
Is it expected that basic users cannot link bank accounts? It seems only the admin can link bank accounts now, while I would expect basic users that are owners of the current budget file to also be able to link bank accounts. It's their own budget, after all.
Would be a pain for the admin to manage this for all users too (where every account needs to log in again every 180 days, with the login details of the user and not the admin).
@deathblade666 commented on GitHub (Jan 7, 2025):
lelemm will have to comment on access, but i know as of current if you have bank sync setup it is not per budget. that is to say, the token with the sync provider is set on the server and not associated with the budget files directly.
@cromelex commented on GitHub (Jan 8, 2025):
Okay I managed to get this working with Authelia, thanks to the above.
For Authelia, I added the following to configuration.yml and then restarted it.
For Actual, I had to create the
config.jsonin /dataThen, go into the actualbudget docker container and run
npm run disable-openid#to ensure it was disabledThen run
npm run enable-openidI went back into my Actual-Budget instance, logged out and logged back in, selecting the OpenID option. This triggered the request to Authelia and assigned my user as owner for the budget.
Then I added a second user based on this
https://deploy-preview-447.www.actualbudget.org/docs/experimental/multi-user
ie,
https://actualbudget.example.com/user-directoryand manually added the 2nd user, and the gave them access to the budget viahttps://actualbudget.example.com//user-access.Logged in via Authelia with said user successfully.
Seems to be working as intended!
@bennesp commented on GitHub (Jan 8, 2025):
Can we have it documented somewhere? I had to create a discord user, click many "accept" "skip" and so on 😕
To everyone that do not want to create a discord user, the solution is to run the following command inside the container:
Also:
ACTUAL_OPENID_SERVER_HOSTNAMEshould be actual-ly (🤭) be calledACTUAL_OPENID_SERVER_URLsince it requires the schema (https://)Thank you for the great progress on this feature though!
@hendrik1120 commented on GitHub (Jan 8, 2025):
Hi, I am happy to see the ongoing development of actualbudget and the new addition of SSO using OIDC and OAuth2.0.
I have tested the OpenID feature using the WebUI with Authelia. I get the following error:
To me, this looks like actual is expecting the
iss(issuer) parameter to be present in the Authentication Response.However theissparameter is not required to be present in the response by section 3.1.2.5 of the openid standard or section 4.1.2 of the oauth2.0 standard. Authelia correctly encodes theissparameter in the IDToken as required.Actually authelia supports RFC9207 which basically only implements the
issparameter in the Authrization Response. However there must be some sort of issue either in the library used or the implementation where theissvalidation fails. The parameter is included in the authelia response:It is possible that I interpreted the error wrong, but I think this might be a bug.
Authelia oidc client configuration for reference:
@ilovepancakes95 commented on GitHub (Jan 8, 2025):
I was able to setup OpenID Auth using Synology DSM SSO Server with their OIDC feature enabled. I can login to Actual, etc. however what doesn't seem to be working is the setting of the "Server Owner" when the first account logs in after OIDC is enabled. I can see my user in User Directory but there is no check mark next to Server Owner. This causes the warning to still appear on the login page about server owner being set to first user and it also is preventing the regular password login from being disabled.
Any ideas why the server owner isn't be set automatically to first user to login (me) after OIDC setup is enabled, and is there anyway to force set the server owner now... I tried clearing cookies and restarting the docker container and signing in from scratch, didn't help.
@DennaGherlyn commented on GitHub (Jan 8, 2025):
Can you even disable the regular password? I'm Server Owner but I still have the option to use the password. And I don't see any settings for that either. I would guess that deactivating the password option is not a thing yet.
@ilovepancakes95 commented on GitHub (Jan 8, 2025):
Hmm, I was under the impression that once a server owner is set after the first OIDC login happens that it disables regular password based access and goes into multi-user mode only. Maybe I misunderstood, and can't test because my install isn't properly setting server owner by itself anyway and getting rid of the ability to edit OIDC settings before login. So right now, anybody could just edit OIDC settings to their own provider and get in.
@DennaGherlyn commented on GitHub (Jan 8, 2025):
Okay, so. I finally managed to get onto Discord (it was very stubborn today) and there lelemm said that disabling the password is not possible because the API needs it and auto-login is not available yet.
@ilovepancakes95 commented on GitHub (Jan 8, 2025):
OK if that is the case, then it seems the only downside to my situation is without a server owner being set, anyone coming upon the login page can now change the OIDC settings to their own provider and then login. Obviously this prevents me from "launching" using this yet, completely not secure.
@shall0pass commented on GitHub (Jan 8, 2025):
If you're referring to the link to change the OIDC settings on the login page, that link disappears once you login using openid.... at least it did for me.
I too would welcome an option (probably an environment option in the compose file that is easy to change before spinning up a container) to disable the web page password prompt. I do understand not totally locking it out for the API to continue to have access.
@ilovepancakes95 commented on GitHub (Jan 8, 2025):
That is exactly what I mean. On my system, I get that prompt, I sign-in, but after I log out, the prompt is still there and I (or anyone else) can still change OIDC settings. And when I do login, under User Directory, my user (or any user) is not checked as "System Owner". Like whatever process that sets the system owner isn't working.
Hoping there is an easy quick fix.
@lelemm commented on GitHub (Jan 8, 2025):
you probably had an error but somehow the flow went until the end so you system owner was never created. I highly suggest you to disable openid and enable again to check for errors and to be sure the system owner is created
@ilovepancakes95 commented on GitHub (Jan 9, 2025):
Think you are right. If I disable OIDC and then re-enable and go throw the flow from scratch I get
{"status":"error","reason":"user-already-exists"}as the error in the web browser immediately after clicking "Sign In with Open ID".@lelemm commented on GitHub (Jan 9, 2025):
I guess the username returned by the provider is empty string.
because there is a empty username string in the server (the fallback server password user has empty username)
@hendrik1120 commented on GitHub (Jan 9, 2025):
I have updated my initial bug report with additional information for troubleshooting. I still believe this a bug in the actualbudget oidc client.
@nicedevil007 commented on GitHub (Jan 9, 2025):
hey guys, just a small thing for you => authentik is written with a lowercase "a". Can you change this on the dropdown menu for the openID provider? I'm already on my PR for the documentation of authentik's official page and the guys that are reviewing my PR already told this to me :)
https://github.com/goauthentik/authentik/pull/12590#discussion_r1909137417
I mean this part here during the configuration:
@tugdualenligne commented on GitHub (Jan 11, 2025):
I there, just wanted to say thanks!
And that OpenID set-up worked fine for me using Authentik 24.12.2
It should be precised though, that the Redirect URI should be https://actual.domain.tld/openid/callback
And that you cannot chose as an Encryption key the "Authentik self-signed certificate" as it doesn't work if you do
@savely-krasovsky commented on GitHub (Jan 12, 2025):
Configured with Casdoor, works without any issues for me.
@ajf15cc commented on GitHub (Jan 12, 2025):
Just want to say thank you to all who were involved with developing this, seriously useful now that partner and I can share a single budget.
Just to add, due to issues with Entra / Azure AD using the Display Name (rather than the UPN or username), I've configured with Cloudflare Access OIDC as the IDP and it works perfectly!
Thanks Again!
@marouamghar commented on GitHub (Jan 14, 2025):
Hey, just to add, it works great in my setup using the config workaround with Authelia.
However, I tried to disable all but opened using allowedLoginMethods in the config file, but it's not picked/applied. I can still login with either the password or openid. Is that behaviour wanted, at least for the experimental phase?
@bobokun commented on GitHub (Jan 16, 2025):
Not sure if you're aware but it could be something related to the openID/multi-user integration that was introduced caused header auth to be broken in v25.1.0
@NateMcKenzie commented on GitHub (Jan 18, 2025):
This is a great feature! My brother and I have self-hosted individual instances of Actual so that we can each have separate budgets. That's not a huge deal, but it is nice to just have one instance. This feature almost gets us there, but it seems like there is only one SimpleFIN token for the whole instsance, so we couldn't use separate SimpleFIN accounts. Is this correct? Are there any plans to say let each user have their own token?
@helloWorld44-89 commented on GitHub (Jan 19, 2025):
I have a similar issue as OP. I am using authentik and my account work as intended. I then tried to login as my wife’s account and got {"status":"error","reason":"openid-grant-failed"}. I checked and no user was created for the login.
Logs for actual budget server:
2025-01-18T23:35:50.199Z info: GET 200 /admin/owner-created/
2025-01-18T23:35:57.068Z info: GET 200 /account/needs-bootstrap
2025-01-18T23:35:57.097Z info: GET 200 /account/needs-bootstrap
2025-01-18T23:35:57.117Z info: GET 200 /account/needs-bootstrap
2025-01-18T23:35:57.158Z info: GET 200 /admin/owner-created/
Logging in via openid
2025-01-18T23:36:00.111Z info: POST 200 /account/login
2025-01-18T23:36:02.549Z info: GET 400 /openid/callback?code=4bec1426c3664e20977da978e750e693&state=HH-1bO-teG2MRKTXeiSSXvKv2y5vDgf40veduVCio8M
Logging in via openid
2025-01-18T23:41:47.867Z info: POST 200 /account/login
2025-01-18T23:41:50.388Z info: GET 400 /openid/callback?code=97bb298a0ccb45c3bd9006993019f9ab&state=azBkGiaWgKUnmJxdH5udZHMew37xpWm0ayHwOTZPzfo
UPDATE: I solved the issue. I had to create the user in Actual prior to them logging in.
Will the open id not create the new user?
@RubenOlsen commented on GitHub (Jan 19, 2025):
On the UX side of the Enable OpenID dialog box I believe we should add a sentence saying that people must export their data before continuing. I am aware that there are no technical reason for this, but it's all about 1) making people feel safe; 2) reducing the number of potential support request on the variant of I enabled OpenID - now my data is lost.
@deathblade666 commented on GitHub (Jan 19, 2025):
OpenID at this time does not create the user accounts within actual so they need to be created manually
@deathblade666 commented on GitHub (Jan 19, 2025):
on that thought, why wouldn't we have it for every experimental feature? and could even go a step further to create a flow that steps people through backing up their data?
@UncleArya commented on GitHub (Jan 19, 2025):
Hello. Thank you so much for implementing an OIDC login. I have been switching as many services as I can over to Pocket ID and I got it setup with Actual Budget and was able to login without issue first try. Initial setup was very easy and straightforward.
The only issue I am now facing is when I open the User Directory and attempt to add a new user for my partner manually (as reading higher in this thread I see OIDC can't create a new user yet). I am getting an error that states:
It prevents me from adding a new user. I have recreated the image and restarted the container, without success.
I added OIDC login via GUI and have the following environment variables set in my compose file:
Client version: v25.1.0
Server version: v25.1.0
Image: sha-45d53ff-alpine
@Mikhail773 commented on GitHub (Jan 19, 2025):
Hello, thank you for all the hard work that was put into openid. I noticed an interesting bug/issue:
When having openid setup it would be expected that each Budget would be able to set up their own simplefin account linking. Instead if you have multiple budgets/accounts each budget will be using the same simple fin token. This means that personal sharing info will be shared between users/budgets. I'm not certain what the solution is, but I would imagine there would need to be a dedicated simplefin/gocardless for each budget/user
@Frankynov commented on GitHub (Jan 23, 2025):
Hi,
Just a note to let you know that I was able to setup the openID connection with Authentik, without any issue :)
Thanks a lot for the hard work !
@ezcafe commented on GitHub (Jan 26, 2025):
Hi team,
I'm using pocket-id with this config
Name:
actual-budgetCallback URLs:
https://actual.budget.tld/openid-cbWhen login to pocket-id, it shows this error
Invalid callback URL, it might be necessary for an admin to fix this. Please try again.Is the Callback URLs correct? Which callback url should I use?
@savely-krasovsky commented on GitHub (Jan 26, 2025):
@ezcafe you should set this: https://actual.budget.tld/openid/callback
@ezcafe commented on GitHub (Jan 26, 2025):
It's working now. Thanks @savely-krasovsky
@tr-io commented on GitHub (Jan 26, 2025):
Hi, I'm trying to setup OpenID with Authentik in the ActualBudget UI and I'm running into the following error:
I have a custom internal domain and I'm using Caddy as a reverse proxy. I've had similar issues with other selfhosted apps which were resolved by adding the custom certs to those containers. I've tried adding the following to a
Dockerfile:And I've also tried the
ca-certificates.caas a volume in thedocker-compose.ymlfile:I'm not too familiar with
nodeso I'm probably adding the certs incorrectly? My authentik domain ishttps://authentik.customdomain@tr-io commented on GitHub (Jan 26, 2025):
Oh it was the path. I changed the
COPYline to:per the instructions here and it worked! My bad, was a user error!
@sgloutnikov commented on GitHub (Jan 29, 2025):
Are we able to disable password auth on the login screen at the moment? I have OpenID working, and have disabled password login method via an ENV variable, but the password login option is still available in the dropdown.
My docker-compose.yaml:
@nicedevil007 commented on GitHub (Jan 29, 2025):
Would be cool when this can be implemented.
@SplendidAppendix commented on GitHub (Jan 31, 2025):
Came here to ask the same thing.
I'm trying to update the config to disable both Password login, and to make OpenID the only allowed login per the docs here, but still getting the dropdown. Because of that, I can't tell if the config is actually working for that or if it's just not implemented. Also, it would be helpful to have an option to bypass the login screen completely when using OpenID so it just goes straight to the identity provider.
@lelemm commented on GitHub (Feb 6, 2025):
based on this topic, I asked chatgpt to summarize what was discussed here:
Consolidated Feedback on OpenID and Multi-User Support for Actual Budget
General Overview
This discussion tracks feedback, bug reports, and improvement suggestions related to the OpenID and multi-user support feature in Actual Budget. Below is a consolidated summary of reported issues, solutions, and requested improvements.
1. Setup Issues & Troubleshooting
Common Errors Reported:
"openid-grant-failed" due to missing
issin responseauthMethodto OAuth2 inconfig.json.disable-openidandenable-openidcommands was required to apply changes.Error: "unable to get local issuer certificate"
/usr/local/share/ca-certificates/and update CA certs accordingly.Error: "Invalid callback URL" when using Pocket ID
https://actual.budget.tld/openid/callback.Users need to be manually created before logging in
Switching Docker container from
edge-alpinetoedgenpmfor running OpenID setup commands.Login works for the first user but fails for additional users
openid-grant-failederrors, and signing back in with the first user caused the same issue.2. User Experience (UX) & Documentation Improvements
Proposed UX Enhancements:
Add a warning in the "Enable OpenID" dialog
Consider adding a guided data backup flow
Clarify in the documentation that OpenID does not create users automatically
Provide an option to bypass the login screen
3. Feature Requests & Enhancements
Feature Requests:
Support multi-user login without OpenID
Fix SimpleFin token sharing issue
Ability to disable password login when OpenID is enabled
ACTUAL_LOGIN_METHOD=openid) does not remove password login from the dropdown.Automatic user provisioning with OpenID
4. User Experiences & Success Stories
Users Who Successfully Set Up OpenID
Users Who Faced Challenges
5. Summary of Next Steps
Fixes & Enhancements Required:
⏳ Clarify in documentation that OpenID does not auto-create users.
⏳ Fix SimpleFin token sharing issue for multi-user environments.
⏳ Allow disabling password login completely when OpenID is enforced.
✔ Provide a direct redirect option when OpenID is the only method. https://github.com/actualbudget/actual/pull/4399
⏳ Improve OpenID user provisioning (automatic user creation on first login).
⏳ Improve UX with data backup prompts before enabling OpenID.
Final Thoughts
The OpenID and multi-user feature in Actual is highly appreciated but still requires refinements, particularly in automatic user creation, improved UX, and better support for multiple budgets.
@JazzyJosh commented on GitHub (Feb 7, 2025):
Is there a specific reason there's not an environment variable for auth type and it has to be set manually in the config?
Seems like it'll be a pain to set up Github/other OAuth2 mechanisms on hosts like fly.io and pika pods. Presumably you'd need to extend the released docker image to customize the config
I'd tinker with the change myself, but I don't have a ton of auth experience so don't want to mess around with that too much.
@lelemm commented on GitHub (Feb 7, 2025):
I'm very busy at work lately. I will do changes on this when I'm more available.
@JazzyJosh commented on GitHub (Feb 8, 2025):
No rush of course, appreciate your contributions.
@ishanjain28 commented on GitHub (Feb 9, 2025):
Hi @lelemm I would like to add a feature request here.
I do not expose actual budget's web interface to public for security reasons and it sits behind the Authelia Login page. I have configured open id and right now, I have to login twice to get to the AB dashboard.
Would you consider adding a flag to auto redirect user to the open id login page if open id is configured when the user opens the AB website ?
Auto redirect in combination with pre configured consent would mean that I can have a better login flow where people have to login just once to Authelia. After which, They'll come to AB login page which redirects them to the open id page. Then, We have pre configured consent so they are immediately sent back to AB with the login token.
This'll result in a better login flow without compromising on security in any way
@danielgraycode commented on GitHub (Feb 9, 2025):
This feature is working great, just one suggestion:
I run actual over several domains to provide convinient access methods for different persons, however with the openID functionality it is restricted to one callback URL, meaning it isn't compatible with my current setup. Is it possible to implement a list of allowed hostnames to redirect to/auto grab from the current URL to allow for multi domain functionality?
@pboling commented on GitHub (Feb 11, 2025):
I'd like to get some clarity on what type of OpenID this feature targets. Based on a tiny number of references in comments, and the release notes, it looks like OpenID Connect, which is based on the OAuth 2 standard. If that is the case, what is the difference between the
openidandoauth2settings? OpenID, when used without "Connect", tends to refer to the older OpenID v1 and OpenID v2 standards, which are now deprecated in favor of OpenID Connect (OIDC), which is OpenID v3 in spirit, but never referred to as such.@lelemm commented on GitHub (Feb 11, 2025):
this is for OIDC, it serves as authentication and identity.
the oauth2 is just for backward compatibility, when there is no identity endpoint, so you can specify other endpoint to search for identity (like github https://api.github.com/user )
@jantznick commented on GitHub (Feb 14, 2025):
I'm running into some issues where when I go to the user directory page and it makes a get call to get the user list, it's giving me a 'Too many requests, please try again later' error. This is then preventing me from creating a new user as well when it tries to make the new user post. Sometimes it seems to log me out too. It seems to be hitting the server over and over making the get user list request, interestingly, after a little bit of this the requests start to run just fine, but the POST to create the new user is still broke.
Running in docker on linux and accessing on a mac. Only local network, use authentik as the provider. I'm happy to help troubleshoot with any more info that might be needed. I will try and get a video of it happening in the next day or so.
Otherwise, very appreciative of everyone working on this feature.
Edit to add, it's definitely hammering the server with the get users request, over 2000 of them while I wrote up that comment, was able to copy the POST to create a user as curl from the network tab and sent it from the hosting server and it worked just fine to create the new user.
@lelemm commented on GitHub (Feb 14, 2025):
I noticed that too. I'm investigating
@SplendidAppendix commented on GitHub (Feb 14, 2025):
Tell me you haven't read the discussion without telling me you haven't read the discussion 😛. Auto redirect to the IDP has already been called out.
@ishanjain28 commented on GitHub (Feb 14, 2025):
Ah okay. I did read it but I must have missed it. Thanks for the correction
@lelemm commented on GitHub (Feb 15, 2025):
Auto redirect is already developed for my branch, I just need to implement the OIDC Provider logout to avoid login again after a logout
@pboling commented on GitHub (Feb 15, 2025):
@lelemm Wondering if there has been any thought to separating the data synced back to local devices from the server when multi-user is enabled.
If a single server is used to host budgets of multiple people who have no connection to each other it seems like all their data would sync to all of their individual devices. Is that how it works? Is there any documentation or link to a discussion about how this works from a security and privacy perspective?
With ElectricSQL (Sqlite in browser and PostgreSQL on Server) it uses DDLX rules and Shapes to control what each device receives from the cloud (I.e. from potential other users).
ref: https://legacy.electric-sql.com/docs/intro/sync-controls
@lelemm commented on GitHub (Feb 18, 2025):
5. Summary of Next Steps
Fixes & Enhancements Required:
⏳ Clarify in documentation that OpenID does not auto-create users.
⏳ Fix SimpleFin token sharing issue for multi-user environments.
⏳ Allow disabling password login completely when OpenID is enforced.
✔ Provide a direct redirect option when OpenID is the only method. https://github.com/actualbudget/actual/pull/4399
⏳ Improve OpenID user provisioning (automatic user creation on first login).
⏳ Improve UX with data backup prompts before enabling OpenID.
@SplendidAppendix commented on GitHub (Feb 18, 2025):
I was just teasing, hope it didn't come off as anything else. I just wanted to make sure you saw that it was already in the works at the time.
@lelemm commented on GitHub (Feb 20, 2025):
5. Summary of Next Steps
Fixes & Enhancements Required:
⏳ Enhance docs with the many OpenID changes.
⏳ Fix SimpleFin token sharing issue for multi-user environments.
✔️ Allow disabling password login completely when OpenID is enforced. https://github.com/actualbudget/actual/pull/4423
✅ Provide a direct redirect option when OpenID is the only method. https://github.com/actualbudget/actual/pull/4399
✔️ Improve OpenID user provisioning (automatic user creation on first login). https://github.com/actualbudget/actual/pull/4421
⏳ Improve UX with data backup prompts before enabling OpenID.
@rcrisanti commented on GitHub (Feb 21, 2025):
I also am running into this exact issue. Just want to make sure I'm not missing anything, is there a diagnosis/solution to this?
@lelemm commented on GitHub (Feb 21, 2025):
There is a fix for this on next release
@cswrd commented on GitHub (Feb 23, 2025):
Are there any plans to be able to migrate or merge existing actual budget instances into one with multi-user support?
@tugdualenligne commented on GitHub (Feb 23, 2025):
Not sure I get it: aren’t existing instances natively Multi-user? I just
upgraded the container to the latest version and that’s it
@cswrd commented on GitHub (Feb 23, 2025):
I mean multiple separate instances that were create before there was an (experimental) multi-user support, e.g. when hosting separate instances for family members. So will it be possible to migrate / merge them into one instance facilitating the integrated multi-user feature.
@lelemm commented on GitHub (Feb 23, 2025):
Just export the budget and import in the final instance
@sebastianfredette commented on GitHub (Feb 23, 2025):
Heyo, first -- thank you for doing this!
Second, I might be doing something wrong (or hopping on this before it's ready), but I'm having a bit of trouble with the new
ACTUAL_OPENID_ENFORCE=trueenvironmental variable (added by #4423 ). Adding it to mycompose.ymlseems to have the intented effect (i.e., only the OpenID button is available when navigating to my Actual instance). Clicking "Sign in with OpenID" also directs me to my SSO provider as expected. But, if I hit the back button on my SSO page (before signing in), Actual offers to let me sign in with my password.This might be intentional (in case SSO is misconfigured maybe?) but, if so, "enforce" might be a bit misleading.
@g4m3r7ag commented on GitHub (Feb 24, 2025):
Is there a way to disable the login with password option after OIDC is configured? I setup the app/provider in Authentik, setup OIDC in Actual using the UI, it took me back to the login and I chose login with OpenID and it authenticated me through Authentik correctly and seems to be working fine. But if I logout, the login screen gives me the option to login with either Open ID or Password. I was hoping to disable the password option from the login screen before exposing my Actual URL so that I can make transaction entries while out from my phone.
@lelemm commented on GitHub (Feb 24, 2025):
its not intentional. probably not triggering the filter when you hit back
@lelemm commented on GitHub (Feb 24, 2025):
its being added next release: https://github.com/actualbudget/actual/pull/4423
@savely-krasovsky commented on GitHub (Feb 27, 2025):
At "User Directory" page something crazy is going on, it's trying to fetch
/api/usersforever until it starts to get 429:Screenshot
I use the latest
v25.2.1, it's behind Traefik, anything special.UPD. My guess problem is related to Traefik: https://community.traefik.io/t/http-router-removes-upstream-content-type-under-specific-conditions/25539
@lelemm commented on GitHub (Feb 27, 2025):
There is a bug fix ready for next release
@Fgdou commented on GitHub (Mar 1, 2025):
EDIT : fixed, I had a DNS issue with this container, not able to contact my local DNS
Hi,
I'm having issues when trying to configure oidc in actual settings for authentik :
My authentik is working fine for any other app
Here is my docker compose :
@yieldhog commented on GitHub (Mar 2, 2025):
I'm having an issue with Authelia
App: v25.3.0 | Server: v25.3.0
I use the config.json to config as follows:
{ "openId": { "issuer": "https://auth.mydomain.com", "client_id": "actual-budget", "client_secret": "mysecret", "server_hostname": "https://budget.mydomain.com", "authMethod": "oauth2" } }Authelia is setup exactly per the documentation here:
When I connect through OIDC, I get this error every time: {"status":"error","reason":"openid-grant-failed"} in the browser
Logs:
`GET 400 /openid/callback?code=authelia_ac_ejEmI7FqKWWG2jYY4Kzagu2niepX95dFvDg13RRzGqA.oSRafP55gQnVs50adrhWS8X-I0BxqKJeVGgdkCECXr8&iss=https%3A%2F%2Fauth.mydomain.com&scope=openid+email+profile&state=9Ld_FtiRpuUpnAAdO26nnJnMRovPhWEIj7MPkgh3UPI
'authelia_ac_ejEmI7FqKWWG2jYY4Kzagu2niepX95dFvDg13RRzGqA.oSRafP55gQnVs50adrhWS8X-I0BxqKJeVGgdkCECXr8'[39m,
params: {
at async [90mfile:///app/[39msrc/app-openid.js:87:26 {
at process.processTicksAndRejections (node:internal/process/task_queues:95:5)[39m
at loginWithOpenIdFinalize [90m(file:///app/[39msrc/accounts/openid.js:178:31[90m)[39m
at Client.callback [90m(/app/[39mnode_modules/[4mopenid-client[24m/lib/client.js:463:13[90m)[39m
OpenID grant failed: RPError: iss missing from the response`
@yieldhog commented on GitHub (Mar 2, 2025):
It appears I was able to fix this by loading config.json using the following response, perhaps it would make sense to update documentation at least for those of us using Authelia. https://github.com/actualbudget/actual/issues/4029#issuecomment-2561272700
@lelemm commented on GitHub (Mar 3, 2025):
This will change in a near future, the command enable-openid will be removed to avoid this issue
@atgrey24 commented on GitHub (Mar 3, 2025):
Just set up OpenID and Multi-user and really digging it so far! The big area of improvement I see is SimpleFIN/bank sync integration. Currently, all banks connected to SimpleFIN are visible to all users in the Actual Server. I would like a way to restrict it so that each user only sees their own bank accounts. Let me know if this should be a new feature request instead.
Otherwise, it's working great!
@lelemm commented on GitHub (Mar 3, 2025):
I was trying to do this, sadly this requires major refactor to gocardless. I will revisit this in the future
@atgrey24 commented on GitHub (Mar 3, 2025):
Is it an issue for both gocardless and simpleFIN, or just the former? I guess it doesn't make sense to fix it on only simpleFIN, even if it was possible.
@lelemm commented on GitHub (Mar 3, 2025):
We would need to rework how keys are stored in the database. This affects all bank sync
@Chinoman10 commented on GitHub (Mar 6, 2025):
Came here to share a few things:
https://domain/openid/callback, and Google requires an exact match for redirect URI's; I had to see which URL was being passed as an argument in the Dev Tools and find out about that path and change that...The first user to login with OpenID will be the server owner. This can't be changed using UI.... and when I look at theUser Directory, my openID user is still not displayed as 'Server Owner' (despite the fact that I transferred the ownership to it). Also, on the login page, even withACTUAL_OPENID_ENFORCEset totrue, if I refresh the/loginpage, it'll still show me the "old" password login (probably since that account is still the server owner for some reason), this might be related to #4509.@lelemm commented on GitHub (Mar 6, 2025):
Thanks for your feedback @Chinoman10
I'm working on improving the docs, but since this experimental feature is new, it's changing a lot. So, I'm holding new docs changes until some more improvements are in, so I don't have to keep changing the docs all the time.
This looks like a faulty openid setup, the server owner should be created on first login and never show this warning again. I saw that there is a edge case (I was not able to reproduce it yet tho) that the user gets redirected to actual but no valid token. This causes the faulty configuration (openid enables, but no master user created). I need help to get the right steps to fix this.
Usually, now that you know how to enable with your provider, if you disable and enable again (caution: it will erase all openid users), it will correctly create the server owner on first login
There is a bug on
ACTUAL_OPENID_ENFORCE. There is a PR to fix this on the way.https://github.com/actualbudget/actual/pull/4533
@chrisanicolaou commented on GitHub (Mar 10, 2025):
Setup with Authentik, expected difficulty (I'm also new to Authentik).
It was easy & pain-free, especially the integrating with Actual part. For an experimental feature, this felt very polished & stable!
I would also like to agree with @atgrey24's suggestion. Bank sync integration on a per-user basis would be an incredible feat if it were possible.
Thank you for your hard work on this!
@savely-krasovsky commented on GitHub (Mar 11, 2025):
I guess the last thing I am missing is a kind of api keys to securely disable password auth but still be able to integrate with Actual.
@Chinoman10 commented on GitHub (Mar 12, 2025):
Did what you said (disable & reenable via UI), and rebuilt the container, everything was fine integration-wise, but the users had to 'transfer ownership' of their 'orphaned' files back to them, which wasn't that big of a deal.
I have noticed that there is one bug that still remains though.
Every time I force a bank account sync, I get:
Although encryption keys are set, and I can confirm that the other users cannot access my files without the encryption key/password.
I noticed that I can simply ignore this pop-up altogether, since the sync happens anyway, and I tested that encryption is also working.
Note: I'm assuming that the sync also only works when I login (the sync is done client-side, since technically the data has to be decrypted first?), right? Or...? The only way to do a sync on encrypted data is using homomorphic encryption (computation on encrypted data), but that's fairly bleeding edge, so wouldn't expect this to have it 😅 (also, when it's used, it's often "broadcasted" so people know about it).
@saahiljaffer commented on GitHub (Mar 15, 2025):
Looks like actual isn't passing the iss parameter to the library so it thinks it's missing. I've created a PR to fix this.
@anderspitman commented on GitHub (Mar 17, 2025):
Thank you for implementing this @lelemm!
It was pretty easy to get working on PikaPods with LastLogin (my project - https://lastlogin.net/) as provider.
No rush, but one feature request I have would be similar to @ishanjain28's redirect request. If you were to implement forward auth (aka trusted header auth - https://www.authelia.com/integration/trusted-header-sso/introduction/), the UX would be even more seamless. If the user is already signed in to the auth server, the username can be passed through as an HTTP header. If Actual trusts the header, then no additional login is necessary. In practice, this lets you log into your auth provider once, then any app that supports forward auth is automatically logged in.
@oddlama commented on GitHub (Mar 22, 2025):
The current documentation doesn't reflect that I need to run a
enable-openidscript to use the configuration from the json file or from the environment. It took me a while to realize this, since it is only mentioned in a single comment in this comment thread. Is there a reason why I need to do that at all? Why can actual not automatically enable openid when the configuration variables are set?The current process makes it impossible to automatically setup a new server with openid. Theres always a manual step involved even though all the relevant information already exists.
Another thing that I noticed is that the configuration variables are just copied into the database once, so if they are changed in the future, this will not be reflected by actual unless someone manually calls disable-openid and enable-openid.
@imryanslade commented on GitHub (Mar 26, 2025):
Can someone review #4626?
@lelemm commented on GitHub (Mar 26, 2025):
I want to review and test this with
autheliabut I don't use it.If you do, can you share a basic
configuration.ymlso I can run authelia with openid support quick?@lelemm commented on GitHub (Mar 26, 2025):
I was able to run it with openid
@imryanslade commented on GitHub (Mar 26, 2025):
@lelemm can you share the config that worked for you? I still get the 'grant failed' error.
@lelemm commented on GitHub (Mar 26, 2025):
please, don't use the same private key if someone is using this config as base
@imryanslade commented on GitHub (Mar 26, 2025):
@lelemm that PR should fix it 100%, it's a very simple bug. Just an issuer field "iss" not being parsed from the callback url. Example URL that my Authelia instance sends to actual server:
https://actual.myserver.com/openid/callback?code=authelia_ac_mRkoQ...&iss=...&scope=openid+email+profile&state=...abc
As you can see "iss" field is present but my actual server throws this error:
It seems that it only picks out code and state out of the redirect URL.
@imryanslade commented on GitHub (Mar 26, 2025):
@lelemm Below is my Authelia configuration (rest is almost exact same as yours). I tried your client configuration as well, but no luck. Still getting the
{"status":"error","reason":"openid-grant-failed"}.Additionally I tried leaving last two params out, and still got the error.
Redirect URI comes with all parameters needed by Actual, iss + code + state. But it just doesn't take it from the URL.
@lelemm commented on GitHub (Mar 26, 2025):
I'm reviewing the PR. asked for changes, they already changed.
when I said this:
I was talking about Authelia, not Actual
@imryanslade commented on GitHub (Mar 26, 2025):
Sounds good, thank you. I also just applied the one liner from @saahiljaffer straight into the
src/accounts/openid.jsfrom the latest release and it worked perfectly!Thanks @saahiljaffer for taking the time!
@MatissJanis commented on GitHub (Mar 28, 2025):
Multi-user issue reported here: https://github.com/actualbudget/actual/issues/4441
@Rihan9 commented on GitHub (Mar 28, 2025):
Hi all,
I applied the fix on PR #4626 and worked for the first user. The second user instead can't login.
In the log I have the following error:
@Rihan9 commented on GitHub (Mar 28, 2025):
I solved the problem in my latest comment by adding the second user before letting her log in. I don't know if it's the correct operation or a workaround
@lelemm commented on GitHub (Mar 28, 2025):
For the current flow, you must add the user to the user directory before login
@hobbit44 commented on GitHub (Mar 31, 2025):
Got an issue with login redirection: #4488
@delize commented on GitHub (Apr 5, 2025):
The path listed in the doc:
Doesn't appear to be correct.
Shouldn't this be:
https://<your-domain.tld>/openid/callbackThis is what it looks like when checking Docker Container Logs:
Additionally, Okta works as a Provider.
@Crispychickenlegs commented on GitHub (Apr 6, 2025):
Hello,
After the latest update, this seems to be broken.
If you make a mistake in the OpenID config when setting it up, the only way you can fix this seems to be to login with password, disable OpenID, then reenable it with the updated config.
Changing the config by clicking on 'Review OpenID configuration' on the initial sign in screen has no effect. It takes you to the form to change the config, but after submitting the broken config is still used.
@lelemm commented on GitHub (Apr 8, 2025):
The [Review OpenID configuration] does not show the values (it's fixed on a PR not approved yet), but it saves the value properly
@Crispychickenlegs commented on GitHub (Apr 8, 2025):
That's not the experience I have had. The screenshots were just to show which part I was talking about.
The issue I was having was that the values didn't seem to be saving properly when reviewing after incorrect config was entered initially.
Scenario:
I'm not 100% sure where to find the config on the backend to see if the details are actually being changed when reviewing. Perhaps they are as you say and something else is going on, but I can't be certain.
@delize commented on GitHub (Apr 12, 2025):
Have been having issues today with logging out, and, accessing my actual instance a week or so after logging in.
When logging in, the server either states "trouble syncing", "trouble connecting", "error accessing" or some extent.
And just sits here.
When trying to close the budget file, I then end up here:
For a while. Eventually, something times out... and then I am sitting here:
With the budget file selector briefly appearing and disappearing every 30 seconds or so.
Now, with all that said, if I clear cookies... I can login without any issue.
Is what I see in the console log.
Once I clear cookies, "Server online" immediately appears instead of syncing. Then am presented with:
Seems like their needs to be some UI / Timeout issues resolved in the authentication, or maybe I don't have a specific OIDC claim enabled, but, something appears to be missing / being buggy.
EDIT:
Just to add more technical aspects.
@dr3nch commented on GitHub (Apr 18, 2025):
Setting up openID with the available Docker image (actualbudget/actual-server:latest, Debian-based 25.4.0) in an environment with a local CA is a bit finicky right now.
Usually, it's enough to bind-mount a CA certificate into the container to make it trust a local CA:
Apparently, the
latestandedgeversions of this image don't haveca-certificatesandcurlpre-installed, despite being recommended by the official docs https://actualbudget.org/docs/install/docker/Without
ca-certificates, additional CAs will not install automatically, and the only way to install them is to inject the package manually:Node.js doesn't trust the system store by default and will output errors like
unable to verify the first certificateandUNABLE_TO_VERIFY_LEAF_SIGNATUREon every openID activation attempt. Even with a correctly installed CA, Node.js must be forced to trust it using environment variables:I think at least some of this should be, if not fixed, then included into the docs.
@vanchaxy commented on GitHub (Apr 25, 2025):
How can I get it working with PWA on Android/Chrome? When the app is installed, I'm forwarded to the app after the login with this error:
{"status":"error","reason":"openid-grant-failed"}Pixel 7, Android 16, Chrome 135, Actual v25.4.0, Pocket ID v0.45.0
Pocked ID logs:
Actual logs:
It works if I request desktop mode, log in, and then open PWA. But then the session randomly expired, and I need to log in again. At the same time, everything works fine on the desktop version.
@MaxwellJP commented on GitHub (Apr 27, 2025):
Is it intentional that Multi-User OpenID shares Simplefin across all users/budgets? I have OpenID successfully setup with Authelia, as myself and other users can all log in and authenticate with OpenID, but anybody can link bank accounts to a single users SimpleFin account.
I'd like to share my Budget instance with multiple people, but only allowing a single person to link SimpleFin accounts makes it a bit unusable.
@Cilenco commented on GitHub (Apr 29, 2025):
I'm using docker to host my own server but for the love of god I cannot setup OIDC via env variables or the config file. I tried:
This file is mounted as
config.jsonunder the/datadirectory in the container but when I startup the container I have to setup a password and then setup OIDC via the UI. After configuring OIDC through the UI the login works perfectly well so it's not a problem with the auth provider (Authelia btw). From the logs I can see that theloginMethodandallowdLoginMethodsare correctly pulled from the config but theopenIdsection seems to not be recognized. I also tried using env variables but with the same result.Server version is 25.4.0 so the
enable-openidoption is no longer valid.EDIT: Switch to the latest edge tag, everything works fine now :)
P.S: env ACTUAL_USER_CREATION_MODE=login is a really nice addition to auto create users
@lelemm commented on GitHub (Apr 30, 2025):
Bank credentials are a separate feature of a multi-user system. They don't depend on the logged user (and shouldn't).
To support what you need, it would require implementing bank credentials per budget file, not per user.
Some users want that, but no one has implemented it yet.
@lelemm commented on GitHub (Apr 30, 2025):
My PWA credentials "migrated" from the browser into the PWA.
I didn't have to login again
@MaxwellJP commented on GitHub (Apr 30, 2025):
That makes sense, bank credentials per budget file would be fine. I guess I misunderstood your comment on Feb. 06:
My question would be, what is the purpose of a muti-user system if only a single user can use bank-sync? As always, many thanks for both the contributions and commentary :)
@lelemm commented on GitHub (Apr 30, 2025):
This is for families/friends that don't mind sharing the same bank sync account or not using one.
Actual is not ready for SAAS usage.
@MaxwellJP commented on GitHub (Apr 30, 2025):
Apologies! I did not mean to suggest that it would be used with people outside of my direct family and close friends.
To clarify my specific scenario, I have myself, a direct family member, and a life-long friend I was hoping to share Actual with. Although both of these people are incredibly close to me, I didn't think it made sense for my friend to see the family members financials (and vice versa). They also both want to utilize bank sync.
Currently, my workaround is running multiple instances of Actual which seems to defeat the purpose of a multi-user system. Of course, this is just my opinion as I'm not a contributor, just wanted to share my thoughts (I hope this comes across in the right way). Not to belabor the topic, but could you please clarify the plan/vision for the multi-user system?
Thanks again!
@darthkali commented on GitHub (May 1, 2025):
Hello,
I have successfully set up Actual with OpenID and Keycloak. However, I'm facing an issue with logging out:
when I sign out of Actual, the Keycloak session remains active, so I'm automatically logged back in without being prompted.
Is there a configuration in either Keycloak or Actual to ensure that the Keycloak session is properly terminated during logout?
Thank you in advance!
@lelemm commented on GitHub (May 2, 2025):
There is a PR on the way for this. Still missing the desktop client support for it.
@guspimentel commented on GitHub (May 2, 2025):
I'm new to Actual, but allow me to support @MaxwellJP's suggestion.
I also have a close friend hoping we could share the same Actual server, but have separate budgets and users in isolation. The main reason is that we both could help each other to setup the environment and extend the application to our need. But I understand that adding this feature would be a giant step to turn Actual into a SaaS, and I don't know if this is the maintainers intention.
@dojoca commented on GitHub (May 6, 2025):
I've happily gotten this all set up nicely and it's working well.
My main aim was to have 2FA using authentik.
However, i still see a "Select the login method", which allows me to sign in with a password. Is there a way to disable this option? I only want OpenID to be usable, as if a person can just choose to log in with a password then the 2FA is not useful.
@ajf15cc commented on GitHub (May 6, 2025):
If you add the env variable ACTUAL_OPENID_ENFORCE=true that should force OIDC always.
@dojoca commented on GitHub (May 6, 2025):
You are an absolute star. Thank you so much!
@ParametricToroid commented on GitHub (May 8, 2025):
Hello everyone, I've been trying to implement multi-user via OpenID, though Authelia, and have had limited success. I chose to build from source, and have been trying to leverage config.json for the authentication parameters for Authelia.
After providing the server password, Actual Budget sends me to Authelia to authenticate, and back to Actual Budget, however I get the following error (that I've seen a few times here):
For reference my
config.jsonlooks like:The log from Actual Budget:
This is a snippet of my
configuration.ymlfrom Authelia:I'm copying the client_id and client_secret directly from Authelia, so I don't imagine it is an issue of the actual credential's mismatching.
Anyone have any ideas? Thanks in advance!
@lelemm commented on GitHub (May 8, 2025):
Any logs in Authelia?
@ParametricToroid commented on GitHub (May 8, 2025):
Thanks for the reply!
Yes, this is the log entry for the authentication attempt:
The client_secrets match exactly, so perhaps there is a configuration issue with Actual Budget pulling my
config.json?@lelemm commented on GitHub (May 8, 2025):
Looks like the client_id in the config is wrong.
Look for hidden unicode characters. May be regenerate the client_id and add to the config.json again (erase the entire line just in case for hidden characters in the parameter.
Also, look if you are not setting the ENV var for it by mistake.
@ParametricToroid commented on GitHub (May 8, 2025):
I'll give that a try and report back, thanks for your help!
@ParametricToroid commented on GitHub (May 9, 2025):
I was able to get Authelia - Actual Budget authentication working thanks to James (Authelia Core Maintainer) via the Authelia Discord. I wanted to post my configurations here for posterity in case anyone else runs into issues. Thanks to everyone who helped me, I appreciate it.
From Authelia /etc/authelia/configuration.yml:
From Actual Budget /opt/actualbudget-data/config.json:
@Shazib commented on GitHub (May 10, 2025):
#4974 FYI
@mitchplze commented on GitHub (May 14, 2025):
Just popped in to mention that OpenID in Actual is working great with Pocket ID!
I wrote a how-to, in the hope it helps others!
@m-schwob commented on GitHub (May 23, 2025):
I didn't followed lately. OpenID works for me for about 2 months without issue. I'm running it in docker along with Authelia and Traefik.
Hope to upgrade to the latest version soon.
@0x2142 commented on GitHub (May 28, 2025):
So far working great for me 👍
One request - Can there be an additional role created for a read-only user? In my case, it would be helpful for other people to see how the household is tracking against the budget for a month - but I would prefer to restrict the ability for other people to modify any of the transactions / accounts.
@Shazib commented on GitHub (May 28, 2025):
+1 This is working well for me for the last couple weeks using authelia and cloudflare tunnels.
@m-schwob commented on GitHub (Jun 5, 2025):
Hi, regarding the OIDC experimental feature and user management:
Admin User Behavior
Currently, the admin user sees all budget files. This can be inconvenient if the admin is also a regular user, as they typically want to view only their own files or those explicitly shared with them. Full access is usually only needed for management purposes.
A simple solution could be to add a toggle or button that allows the admin to hide files they don't own or that aren't shared with them. Kind of and enable/disable admin mode/view.
Of course, a dedicated admin dashboard would be ideal, but the toggle would be a good start and an easy fix.
First-Time Sign-In Behavior
Right now, if a user signs in for the first time before the admin has added them, they encounter a black screen with the error:
{"status":"error","reason":"openid-grant-failed"}A better experience might use part of the behavior of the first user. For example, new users could be automatically added in a "pending approval" state "with no access" while displaying a message like "Waiting for admin approval."
The admin would then see the user in the management list and could approve them, with all necessary details pulled from the OIDC scopes.
It would also be great to allow automatic approval based on specific OIDC claims, such as group membership (e.g., if the user belongs to an
actualgroup).Bug Report: Authelia Session Not Properly Refreshed
I believe I found a bug when using Authelia as the OIDC provider:
Now, instead of showing the "Start Fresh" screen, Actual displays user1’s budget. The UI shows it is logged in as user2, but the "User Access Management" option is missing.
Clearing the cookies solved the issue, so it seems like the session wasn't properly refreshed.
I know RP-initiated logout isn't supported by Authelia yet, which makes the logout flow problematic. I've worked with this using Python’s Authlib and found that a good way to detect logout is by monitoring the
authelia_sessioncookie. When logging out via Authelia, this cookie is deleted, and it’s regenerated with a new value upon login. This change can be used to detect session switches.I'd be happy to contribute to these features. However, I'm not very experienced with JavaScript.
@youngcw commented on GitHub (Jun 5, 2025):
Thanks all that have commented on multi-user and OIDC. The feature is no longer experimental and is an mainlined feature. Please open issues or feature requests going forward.