mirror of
https://github.com/fosrl/pangolin.git
synced 2026-05-06 00:22:42 -05:00
[GH-ISSUE #1458] External access not working anymore after update to Pangolin 1.9.0 #1918
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/pangolin#1918
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @thimplicity on GitHub (Sep 14, 2025).
Original GitHub issue: https://github.com/fosrl/pangolin/issues/1458
Originally assigned to: @miloschwartz on GitHub.
Hi everyone,
I have the following setup:
I run two Pangolin instances, one externally on a VPS and one internally. I only run one Pocket-ID instance externally that serves both Pangolin instances. Both instances and access worked well with Pocket-ID 1.10.0 and Pangolin 1.6.2. Then I updated the external Pangolin instance to 1.9.0 and since then the external access does not work anymore. I receive the following error message when trying to log into a service directly, e.g. into uptime kuma, from externally:
When I log into Pangolin (on VPS) directly, I receive this screen, which shows that the user is not connected to an organization. I have automatic user provisioning activated, which does not work anymore. Everytime, I create the user manually, it is gone after I tried to log in.
The docker logs are below:
Pangolin:
2025-09-12T07:08:12.306Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-12T07:08:12.307Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-12T07:08:12.307Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-12T07:08:12.310Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-12T07:08:12.311Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-12T07:08:12.312Z [info]: Exit node request successful: {"method":"POST","url":"http://gerbil:3003/peer","status":"Peer added successfully"} 2025-09-14T12:38:28.762Z [info]: Checking Docker socket for site 1 with Newt ft8luaohkalmf 2025-09-14T12:38:28.775Z [info]: Handling Docker socket check response 2025-09-14T12:38:28.775Z [info]: Newt ID: ft8luaohkalmf, Site ID: 1 2025-09-14T12:38:28.775Z [info]: Docker socket availability for Newt ft8luaohkalmf: available=false, socketPath= 2025-09-14T12:38:28.775Z [warn]: Newt ft8luaohkalmf does not have Docker socket access 2025-09-14T12:38:28.775Z [info]: Handling Docker socket check response 2025-09-14T12:38:28.775Z [info]: Newt ID: ft8luaohkalmf, Site ID: 1 2025-09-14T12:38:28.775Z [info]: Docker socket availability for Newt ft8luaohkalmf: available=false, socketPath= 2025-09-14T12:38:28.775Z [warn]: Newt ft8luaohkalmf does not have Docker socket accessPocket-ID:
time=2025-09-14T12:55:57.524Z level=INFO msg="Incoming request" app=pocket-id version=1.10.0 request.time=2025-09-14T12:55:57.524Z request.method=GET request.host=auth.... request.path=/.well-known/jwks.json request.query="" request.params=map[] request.route=/.well-known/jwks.json request.ip=136.... request.referer="" request.length=0 response.time=2025-09-14T12:55:57.524Z response.latency=21.66µs response.status=200 response.length=430 time=2025-09-14T12:56:57.584Z level=INFO msg="Incoming request" app=pocket-id version=1.10.0 request.time=2025-09-14T12:56:57.584Z request.method=GET request.host=auth.... request.path=/.well-known/openid-configuration request.query="" request.params=map[] request.route=/.well-known/openid-configuration request.ip=136.... request.referer="" request.length=0 response.time=2025-09-14T12:56:57.584Z response.latency=42.451µs response.status=200 response.length=1020 time=2025-09-14T12:56:57.618Z level=INFO msg="Incoming request" app=pocket-id version=1.10.0 request.time=2025-09-14T12:56:57.618Z request.method=GET request.host=auth.... request.path=/.well-known/jwks.json request.query="" request.params=map[] request.route=/.well-known/jwks.json request.ip=136.... request.referer="" request.length=0 response.time=2025-09-14T12:56:57.618Z response.latency=35.471µs response.status=200 response.length=430Any help would be appreciated - the setup worked perfectly for me before the update
@miloschwartz commented on GitHub (Sep 21, 2025):
With auto provisioning enabled, on each login it reruns a check on all the organization policies on the identity provider to determine if the user should have access to the organization/role. IT sounds like when you log in this check is happening and you're getting removed from your org because the policies aren't returning the expected org ID or role name.
Can you screenshot your policies (JMES path) from the edit IdP screen and I could take a look?
Also as a tip, if you have debug logs enabled, when you complete the OAuth flow, it should still print out the token response from Pocket ID (IdP) which you can use manually run the JMES Path expression against for debugging/checking purposes. Some docs on auto provisioning if you haven't see it already here.
@thimplicity commented on GitHub (Sep 22, 2025):
Hi @miloschwartz,
thanks for pointing me in the correct direction. Seems like I added a typo to the policies when debugging. Seems to work now that I corrected that. Thanks a lot!