OpenID Connect Auto Discovery using wrong authorize URL #13438

New Issue

GiteaMirror · 2025-11-02T10:42:21-06:00

GiteaMirror commented

2025-11-02 10:42:21 -06:00

Originally created by @Hi-ImKyle on GitHub (Aug 28, 2024).

Description

I am using Authentik and Gitea in docker containers. They are both on the same network.

I can't use my auth domain url for the auto discovery url because of some unknown timeout issue I have with containers trying to connect to said domain.

That being said, I can give Gitea a URL that points to the Authentik container directly, and doing so Gitea gets the OpenID configuration that way which is fine.

The problem is that OpenID configuration has a authorization_endpoint field which Gitea is ignoring.

Here is the step by step

So I set the Auto Discovery URL to http://authentik-server-1:9000/application/o/gitea/.well-known/openid-configuration.
It gets the config successfully, now I sign out and go to sign in with Authentik.
Gitea redirects me to http://authentik-server-1:9000/application/o/authorize/ which is wrong.

I am on a nightly version because I can't go back and I was testing a fix I had previously brought up about something else.

Gitea Version

1.23.0+dev-211-gfc2d75f86d

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

No response

Screenshots

Here is the timeout message

Using the authentik container name directly instead

If I browse to the OpenID auto config URL in a browser. Here is the authorization_endpoint

Then when I click Sign in with Authentik, it redirects me to the container name and not the correct authorization_endpoint

Git Version

No response

Operating System

No response

How are you running Gitea?

Docker Container

Database

None

Originally created by @Hi-ImKyle on GitHub (Aug 28, 2024). ### Description I am using Authentik and Gitea in docker containers. They are both on the same network. I can't use my auth domain url for the auto discovery url because of some unknown timeout issue I have with containers trying to connect to said domain. That being said, I can give Gitea a URL that points to the Authentik container directly, and doing so Gitea gets the OpenID configuration that way which is fine. The problem is that OpenID configuration has a `authorization_endpoint` field which Gitea is ignoring. Here is the step by step 1) So I set the Auto Discovery URL to `http://authentik-server-1:9000/application/o/gitea/.well-known/openid-configuration`. 2) It gets the config successfully, now I sign out and go to sign in with Authentik. 3) Gitea redirects me to `http://authentik-server-1:9000/application/o/authorize/` which is wrong. I am on a nightly version because I can't go back and I was testing a fix I had previously brought up about something else. ### Gitea Version 1.23.0+dev-211-gfc2d75f86d ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist _No response_ ### Screenshots Here is the timeout message ![image](https://github.com/user-attachments/assets/1f17e259-f40c-4eea-875f-fdba0beb53f2) Using the authentik container name directly instead ![image](https://github.com/user-attachments/assets/f735e2f6-cae8-4f00-b1e7-a7a1b2e446fd) If I browse to the OpenID auto config URL in a browser. Here is the `authorization_endpoint` ![image](https://github.com/user-attachments/assets/8248768f-636e-499f-9d68-52900ccf1eff) Then when I click `Sign in with Authentik`, it redirects me to the container name and not the correct `authorization_endpoint` ![image](https://github.com/user-attachments/assets/9e60b5da-7793-4bf5-a1cb-68a7986a74fb) ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Docker Container ### Database None

GiteaMirror added the type/bug label 2025-11-02 10:42:21 -06:00

GiteaMirror closed this issue

2025-11-02 10:42:21 -06:00

GiteaMirror commented

2025-11-02 10:42:22 -06:00

@Hi-ImKyle commented on GitHub (Aug 28, 2024):

If I replace authentik-server-1:9000 with the correct domain when signing in, everything else works fine. It's just Gitea is pointing me to the wrong authorization endpoint

@Hi-ImKyle commented on GitHub (Aug 28, 2024): If I replace `authentik-server-1:9000` with the correct domain when signing in, everything else works fine. It's just Gitea is pointing me to the wrong authorization endpoint

GiteaMirror commented

2025-11-02 10:42:22 -06:00

@Hi-ImKyle commented on GitHub (Aug 29, 2024):

On further investigation. I believe this to actually be an Authentik thing.

Sorry

@Hi-ImKyle commented on GitHub (Aug 29, 2024): On further investigation. I believe this to actually be an Authentik thing. Sorry

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/gitea#13438