[GH-ISSUE #306] Debug failing SSO #3705

Open
opened 2026-06-01 22:26:22 -05:00 by GiteaMirror · 3 comments
Owner

Originally created by @DunklerPhoenix on GitHub (May 28, 2026).
Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/306

Originally assigned to: @arunavo4 on GitHub.

Heho
You wrote in your doc https://github.com/RayLabsHQ/gitea-mirror/blob/main/docs/SSO_TESTING.md that the env DEBUG=better-auth:* bun run dev will enable debug mode for sso.

I tried it, but neither in docker logs nor in browser console are more informations.

The problem I have is that a click on sso just bring me back to the login screen again and I don't understand why.

How can I debug this?

SSO Provider: Authentik

Browser log:

card.hkr9-JM4.js:1 
 GET https://gitmirror.redacted.com/api/sso/applications 401 (Unauthorized)
card.hkr9-JM4.js:1 [HTTP Client] Authentication failed for /api/sso/applications
card.hkr9-JM4.js:1 [HTTP Client] Response: {"success":false,"error":"Unauthorized - Please log in"}

console log at start

gitea-mirror-1  | Using BETTER_AUTH_URL: https://gitmirror.redacted.com
gitea-mirror-1  | Trusted origins (static): [ "http://localhost:4321", "http://localhost:8080", "https://gitmirror.redacted.com",
gitea-mirror-1  |   "https://auth.redacted.com"
gitea-mirror-1  | ]
gitea-mirror-1  | [Deprecation] The "oidc-provider" plugin is deprecated and will be removed in the next major version. Migrate to @better-auth/oauth-provider. See: https://www.better-auth.com/docs/plugins/oauth-provider
Originally created by @DunklerPhoenix on GitHub (May 28, 2026). Original GitHub issue: https://github.com/RayLabsHQ/gitea-mirror/issues/306 Originally assigned to: @arunavo4 on GitHub. Heho You wrote in your doc https://github.com/RayLabsHQ/gitea-mirror/blob/main/docs/SSO_TESTING.md that the env `DEBUG=better-auth:* bun run dev` will enable debug mode for sso. I tried it, but neither in docker logs nor in browser console are more informations. The problem I have is that a click on sso just bring me back to the login screen again and I don't understand why. How can I debug this? SSO Provider: Authentik Browser log: ``` card.hkr9-JM4.js:1 GET https://gitmirror.redacted.com/api/sso/applications 401 (Unauthorized) card.hkr9-JM4.js:1 [HTTP Client] Authentication failed for /api/sso/applications card.hkr9-JM4.js:1 [HTTP Client] Response: {"success":false,"error":"Unauthorized - Please log in"} ``` console log at start ``` gitea-mirror-1 | Using BETTER_AUTH_URL: https://gitmirror.redacted.com gitea-mirror-1 | Trusted origins (static): [ "http://localhost:4321", "http://localhost:8080", "https://gitmirror.redacted.com", gitea-mirror-1 | "https://auth.redacted.com" gitea-mirror-1 | ] gitea-mirror-1 | [Deprecation] The "oidc-provider" plugin is deprecated and will be removed in the next major version. Migrate to @better-auth/oauth-provider. See: https://www.better-auth.com/docs/plugins/oauth-provider ```
Author
Owner

@arunavo4 commented on GitHub (May 29, 2026):

@DunklerPhoenix looks like there is an email linking issue. I will also take the chance to migrate the soon to be deprecated oidc plugin.

<!-- gh-comment-id:4569601641 --> @arunavo4 commented on GitHub (May 29, 2026): @DunklerPhoenix looks like there is an email linking issue. I will also take the chance to migrate the soon to be deprecated oidc plugin.
Author
Owner

@arunavo4 commented on GitHub (May 31, 2026):

@DunklerPhoenix Can you help test the PR.

<!-- gh-comment-id:4586067071 --> @arunavo4 commented on GitHub (May 31, 2026): @DunklerPhoenix Can you help test the PR.
Author
Owner

@DunklerPhoenix commented on GitHub (May 31, 2026):

Heho
The only thing that changed is a new step inbetween.

So:

  1. I click on SSO
  2. get redirected to authentik
  3. Accept the login in authentik
  4. come back to GM
  5. see new this url: https://giteamirror.domain.com/?error=UNKNOWN
  6. get redirected to /login

EDIT2 (sry):

gitea-mirror-1  | Using BETTER_AUTH_URL: https://giteamirror.domain.com
gitea-mirror-1  | Trusted origins (static): [ "http://localhost:4321", "http://localhost:8080", "https://giteamirror.domain.com",
gitea-mirror-1  |   "https://auth.domain.com"
gitea-mirror-1  | ]
gitea-mirror-1  | 2026-05-31T17:43:38.039Z WARN [Better Auth]: Please ensure '/.well-known/oauth-authorization-server/api/auth' exists. Upon completion, clear with silenceWarnings.oauthAuthServerConfig.

EDIT:
image: ghcr.io/raylabshq/gitea-mirror:pr-307

<!-- gh-comment-id:4587523584 --> @DunklerPhoenix commented on GitHub (May 31, 2026): Heho The only thing that changed is a new step inbetween. So: 1. I click on SSO 2. get redirected to authentik 3. Accept the login in authentik 4. come back to GM 5. see new this url: https://giteamirror.domain.com/?error=UNKNOWN 6. get redirected to /login EDIT2 (sry): ``` gitea-mirror-1 | Using BETTER_AUTH_URL: https://giteamirror.domain.com gitea-mirror-1 | Trusted origins (static): [ "http://localhost:4321", "http://localhost:8080", "https://giteamirror.domain.com", gitea-mirror-1 | "https://auth.domain.com" gitea-mirror-1 | ] gitea-mirror-1 | 2026-05-31T17:43:38.039Z WARN [Better Auth]: Please ensure '/.well-known/oauth-authorization-server/api/auth' exists. Upon completion, clear with silenceWarnings.oauthAuthServerConfig. ``` EDIT: image: ghcr.io/raylabshq/gitea-mirror:pr-307
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea-mirror#3705