OIDC with PocketID not working #768

New Issue

GiteaMirror · 2025-11-13T12:10:23-06:00

GiteaMirror commented

2025-11-13 12:10:23 -06:00

Originally created by @L0sWach0s on GitHub (Nov 9, 2025).

Describe the Bug

Hey!

I try to use my PocketID as my OIDC provider, but it doesn't work.
I tried to update pangolin, update PocketID, use Authentik, delete the IDP and set it up again, nothing helps.

PocketID is on my HomeServer, connected via Pangolin (no authentication, it's reachable). The green checkmark at PocketID is also appearing.

Pangolin is not using newt, all my connections are "local" via Tailscale.

Attached the log.

Making login request to: http://localhost:3000/api/v1/auth/login
Making login request to: http://localhost:3000/api/v1/auth/login
Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/4/oidc/generate-url
Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/4/oidc/validate-callback
2025-11-09T21:08:58+00:00 [error]: Failed to send request
Stack: Error: Failed to send request
    at sendTokenRequest (file:///app/node_modules/arctic/dist/request.js:35:15)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async OAuth2Client.validateAuthorizationCode (file:///app/node_modules/arctic/dist/client.js:66:24)
    at async validateOidcCallback (file:///app/dist/server.mjs:24361:20)

Environment

OS Type & Version: Ubuntu 22.04
Pangolin Version: 1.10.x ---> 1.12.2
Gerbil Version: 1.0.0
Traefik Version: 3.6.0
Newt Version: -
Olm Version: -
tailscale: 1.90.6

To Reproduce

Each and every attempt is failing with the same error.

Expected Behavior

IDP can be used

Originally created by @L0sWach0s on GitHub (Nov 9, 2025). ### Describe the Bug Hey! I try to use my PocketID as my OIDC provider, but it doesn't work. I tried to update pangolin, update PocketID, use Authentik, delete the IDP and set it up again, nothing helps. PocketID is on my HomeServer, connected via Pangolin (no authentication, it's reachable). The green checkmark at PocketID is also appearing. Pangolin is not using newt, all my connections are "local" via Tailscale. Attached the log. ``` Making login request to: http://localhost:3000/api/v1/auth/login Making login request to: http://localhost:3000/api/v1/auth/login Making OIDC URL generation request to: http://localhost:3000/api/v1/auth/idp/4/oidc/generate-url Making OIDC callback validation request to: http://localhost:3000/api/v1/auth/idp/4/oidc/validate-callback 2025-11-09T21:08:58+00:00 [error]: Failed to send request Stack: Error: Failed to send request at sendTokenRequest (file:///app/node_modules/arctic/dist/request.js:35:15) at process.processTicksAndRejections (node:internal/process/task_queues:105:5) at async OAuth2Client.validateAuthorizationCode (file:///app/node_modules/arctic/dist/client.js:66:24) at async validateOidcCallback (file:///app/dist/server.mjs:24361:20) ``` <img width="442" height="243" alt="Image" src="https://github.com/user-attachments/assets/0e9efddf-20c6-4fa4-8e4a-949167264afb" /> ### Environment - OS Type & Version: Ubuntu 22.04 - Pangolin Version: 1.10.x ---> 1.12.2 - Gerbil Version: 1.0.0 - Traefik Version: 3.6.0 - Newt Version: - - Olm Version: - - tailscale: 1.90.6 ### To Reproduce Each and every attempt is failing with the same error. ### Expected Behavior IDP can be used

GiteaMirror commented

2025-11-13 12:10:24 -06:00

@shanelord01 commented on GitHub (Nov 10, 2025):

Try leaving everything set to your public Pocket ID URL's in Pangolin's Identity Provider setup for Pocket ID, except for your Token URL.

Use your local/internal/tailscale address. For me I have it on an accessible docker network : http://pocket-id:1411/api/oidc/token

This works for me and as long as your Pangolin can see your Pocket ID over Tailscale, it should hopefully work for you.

@shanelord01 commented on GitHub (Nov 10, 2025): Try leaving everything set to your public Pocket ID URL's in Pangolin's Identity Provider setup for Pocket ID, except for your Token URL. Use your local/internal/tailscale address. For me I have it on an accessible docker network : http://pocket-id:1411/api/oidc/token This works for me and as long as your Pangolin can see your Pocket ID over Tailscale, it should hopefully work for you.

GiteaMirror commented

2025-11-13 12:10:24 -06:00

@L0sWach0s commented on GitHub (Nov 10, 2025):

Internally I am using a reverse proxy (traefik), so I can’t use the port of my PocketID instance.
However: the url should work fine with pangolin or am I wrong?

@L0sWach0s commented on GitHub (Nov 10, 2025): Internally I am using a reverse proxy (traefik), so I can’t use the port of my PocketID instance. However: the url should work fine with pangolin or am I wrong?

GiteaMirror commented

2025-11-13 12:10:24 -06:00

@thelastblt commented on GitHub (Nov 11, 2025):

I'm having this same issue. Pocketid is accessible with Pangolin but results in a failed to send request.

@thelastblt commented on GitHub (Nov 11, 2025): I'm having this same issue. Pocketid is accessible with Pangolin but results in a failed to send request.