github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-03-09 11:42:54 -05:00
Code Issues 250 Packages Projects Releases 53 Wiki Activity

[Bug]: Server ignores that ACTUAL_OPENID_ENFORCE was set to true if its unable to communicate with OpenID server #2700

New Issue
Open
opened 2026-02-28 20:24:59 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-02-28 20:24:59 -06:00
Owner
Copy Link

Originally created by @wjam on GitHub (Dec 8, 2025).

Verified issue does not already exist?

  • I have searched and found no existing issue

What happened?

I'm playing with setting up Authelia and Actual in my home lab and noticed that Actual comes up and displays the 'set password' page even if the ACTUAL_OPENID_ENFORCE environment variable was set to true.

How can we reproduce the issue?

Start the server afresh so it requires bootstrapping, set the ACTUAL_OPENID_DISCOVERY_URL to be something that the server cannot/doesn't want to communicate with (such as an endpoint with a self-signed certificate), and set ACTUAL_OPENID_ENFORCE to be true. Note that the server is serving the same bootstrap page as if ACTUAL_OPENID_ENFORCE was false.

Here are the logs from my test server:

2025-12-08T17:03:48.394423565Z Checking if there are any migrations to run for direction "up"...
2025-12-08T17:03:48.534708992Z Migrations: DONE
2025-12-08T17:03:49.409182075Z Running in production mode - Serving static React app
2025-12-08T17:03:49.409439570Z OpenID configuration found. Preparing server to use it
2025-12-08T17:03:49.429230654Z configuration-error
2025-12-08T17:03:49.429251243Z Error setting up OpenID client: Error: unable to get local issuer certificate
2025-12-08T17:03:49.429262935Z     at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34)
2025-12-08T17:03:49.429267855Z     at TLSSocket.emit (node:events:519:28)
2025-12-08T17:03:49.429271611Z     at TLSSocket._finishInit (node:_tls_wrap:1078:8)
2025-12-08T17:03:49.429275269Z     at ssl.onhandshakedone (node:_tls_wrap:864:12) {
2025-12-08T17:03:49.429278765Z   code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY'
2025-12-08T17:03:49.429282182Z }
2025-12-08T17:03:49.430817924Z Listening on :::5006...
2025-12-08T17:04:13.810061313Z 2025-12-08T17:04:13.809Z info: GET 200 /account/needs-bootstrap
2025-12-08T17:04:13.824868967Z 2025-12-08T17:04:13.824Z info: GET 304 /account/needs-bootstrap

Where are you hosting Actual?

Docker

What browsers are you seeing the problem on?

Firefox

Operating System

Linux

Originally created by @wjam on GitHub (Dec 8, 2025). ### Verified issue does not already exist? - [x] I have searched and found no existing issue ### What happened? I'm playing with setting up Authelia and Actual in my home lab and noticed that Actual comes up and displays the 'set password' page even if the `ACTUAL_OPENID_ENFORCE` environment variable was set to `true`. ### How can we reproduce the issue? Start the server afresh so it requires bootstrapping, set the `ACTUAL_OPENID_DISCOVERY_URL` to be something that the server cannot/doesn't want to communicate with (such as an endpoint with a self-signed certificate), and set `ACTUAL_OPENID_ENFORCE` to be `true`. Note that the server is serving the same bootstrap page as if `ACTUAL_OPENID_ENFORCE` was `false`. Here are the logs from my test server: ``` 2025-12-08T17:03:48.394423565Z Checking if there are any migrations to run for direction "up"... 2025-12-08T17:03:48.534708992Z Migrations: DONE 2025-12-08T17:03:49.409182075Z Running in production mode - Serving static React app 2025-12-08T17:03:49.409439570Z OpenID configuration found. Preparing server to use it 2025-12-08T17:03:49.429230654Z configuration-error 2025-12-08T17:03:49.429251243Z Error setting up OpenID client: Error: unable to get local issuer certificate 2025-12-08T17:03:49.429262935Z at TLSSocket.onConnectSecure (node:_tls_wrap:1679:34) 2025-12-08T17:03:49.429267855Z at TLSSocket.emit (node:events:519:28) 2025-12-08T17:03:49.429271611Z at TLSSocket._finishInit (node:_tls_wrap:1078:8) 2025-12-08T17:03:49.429275269Z at ssl.onhandshakedone (node:_tls_wrap:864:12) { 2025-12-08T17:03:49.429278765Z code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY' 2025-12-08T17:03:49.429282182Z } 2025-12-08T17:03:49.430817924Z Listening on :::5006... 2025-12-08T17:04:13.810061313Z 2025-12-08T17:04:13.809Z info: GET 200 /account/needs-bootstrap 2025-12-08T17:04:13.824868967Z 2025-12-08T17:04:13.824Z info: GET 304 /account/needs-bootstrap ``` ### Where are you hosting Actual? Docker ### What browsers are you seeing the problem on? Firefox ### Operating System Linux
GiteaMirror added the openidbug labels 2026-02-28 20:24:59 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label bug openid
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#2700
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?