Repository: manyfold3d/manyfold

Issue #3021: Incorrect redirect URLs from OIDC if PUBLIC_PORT isn't set
Created: 2024-10-22T20:21:57Z
Even if PUBLIC_PORT is a standard value, if it's not set, the redirects are wrong. This shouldn't be necessary.

Duplicate issue #3119: Manyfold adds :3214 port to OIDC callback URL despite PUBLIC_HOSTNAME setting
Created: 2024-11-07T00:44:38Z
Describe the bug
When using Manyfold with OpenID Connect (Authentik) behind a Cloudflare Tunnel, authentication fails because Manyfold includes the container port (3214) in the redirect_uri. This port inclusion bypasses the Cloudflare Tunnel routing, breaking the authentication flow.
To Reproduce

Set up Manyfold with OpenID Connect configuration:

-e 'PUBLIC_HOSTNAME'='manyfold.example.com'
-e 'OIDC_CLIENT_ID'='client_id'
-e 'OIDC_CLIENT_SECRET'='secret'
-e 'OIDC_ISSUER'='https://auth.example.com/application/o/app/'
-e 'OIDC_NAME'='Authentik'
-p '3214:3214/tcp'

Configure Cloudflare Tunnel to route domain
Click "Login with Authentik" button
Get redirected to Authentik
See "Redirect URI Error" or timeout depending on configuration

Expected behavior
Manyfold should generate the redirect_uri without the port when PUBLIC_HOSTNAME is set:
https://manyfold.example.com/users/auth/openid_connect/callback
Screenshots
callback filled automatically by Authentik and manyfold
(This sets its automatically to https://.com:3214/users/auth/openid_connect/callback)

Setting it to https://.com/users/auth/openid_connect/callback


Desktop (please complete the following information):

OS: Windows
Browser: Firefox
Version: 132.0 (64-bit)
Manyfold Version:  v0.87.0

Additional context
Documentation states redirect URL should be http{s}://{PUBLIC_HOSTNAME}/users/auth/openid_connect/callback but actual behavior differs.
I realize that this might be an issue with Authentik or Cloudflare. However, I am able to log with other dockerized applications, I would appreciate if you could help me in finding out why I can't log in via Authentik. (FYI, I can log in via Cloudflare without Authentik)
If you think this is an issue with either, any lead would be appreciated.
docker run -d \
--name='manyfold3d' \
--net='bridge' \
--pids-limit 2048 \
-e TZ="America/New_York" \
-e HOST_OS="Unraid" \
-e HOST_HOSTNAME="SERVER-HOSTNAME" \
-e HOST_CONTAINERNAME="manyfold3d" \
-e 'DATABASE_ADAPTER'='postgresql' \
-e 'DATABASE_HOST'='192.168.x.x' \
-e 'manyfold'='manyfold' \
-e 'DATABASE_USER'='manyfold3d' \
-e 'DATABASE_PASSWORD'='xxxxx' \
-e 'REDIS_URL'='redis://xxxxx@192.168.x.x:6379/1' \
-e 'PUID'='99' \
-e 'PGID'='100' \
-e 'SECRET_KEY_BASE'='xxxxx' \
-e 'REDIS_PASSWORD'='xxxxx' \
-e 'PUBLIC_HOSTNAME'='manyfold.example.com' \
-e 'MULTIUSER'='enabled' \
-e 'SITE_NAME'='MY 3D STASH' \
-e 'SITE_TAGLINE'='Thingiverse? I think you mean Free-giverse! Tee-hee' \
-e 'HTTPS_ONLY'='disabled' \
-e 'OIDC_CLIENT_ID'='xxxxx' \
-e 'OIDC_CLIENT_SECRET'='xxxxx' \
-e 'OIDC_ISSUER'='https://auth.example.com/application/o/manyfold3d/' \
-e 'OIDC_NAME'='Authentik' \
-l net.unraid.docker.managed=dockerman \
-p '3214:3214/tcp' \
-v '/path/to/libraries/':'/libraries':'rw' \
'ghcr.io/manyfold3d/manyfold:latest'

Log from manyfold docker
19:39:57 rails.1              | I, [2024-11-06T19:39:57.447156 #347]  INFO -- : [45195f66-268f-408b-882b-b3208a25002e] {"method":"GET","path":"/users/sign_in","format":"html","controller":"Users::SessionsController","action":"new","status":200,"allocations":19840,"duration":44.88,"view":14.38,"db":4.09,"@timestamp":"2024-11-07T00:39:57.447Z","@version":"1","message":"[200] GET /users/sign_in (Users::SessionsController#new)"}
19:40:00 rails.1              | D, [2024-11-06T19:40:00.487194 #347] DEBUG -- omniauth: (openid_connect) Request phase initiated.

Log from authentik
{"auth_via": "session", "domain_url": "auth.example.com", "event": "Invalid redirect uri (regex comparison)", "host": "auth.example.com", "level": "warning", "logger": "authentik.providers.oauth2.views.authorize", "pid": 18505, "redirect_uri_expected": ["https://manyfold.example.com/users/auth/openid_connect/callback"], "redirect_uri_given": "http://manyfold.example.com:3214/users/auth/openid_connect/callback", "request_id": "xxxxxx", "schema_name": "public", "timestamp": "2024-11-07T00:40:00.916039"}

{"auth_via": "session", "domain_url": "auth.example.com", "event": "The request fails due to a missing, invalid, or mismatching redirection URI (redirect_uri).", "host": "auth.example.com", "level": "warning", "logger": "authentik.providers.oauth2.views.authorize", "pid": 18505, "request_id": "xxxxxx", "schema_name": "public", "timestamp": "2024-11-07T00:40:00.916194"}

{"auth_via": "session", "domain_url": "auth.example.com", "event": "/application/o/authorize/?client_id=xxxxx&nonce=xxxxx&redirect_uri=http%3A%2F%2Fmanyfold.example.com%3A3214%2Fusers%2Fauth%2Fopenid_connect%2Fcallback&response_type=code&scope=openid%20email%20profile&state=xxxxx", "host": "auth.example.com", "level": "info", "logger": "authentik.asgi", "method": "GET", "pid": 18505, "remote": "x.x.x.x", "request_id": "xxxxxx", "runtime": 7, "schema_name": "public", "scheme": "https", "status": 400, "timestamp": "2024-11-07T00:40:00.917561", "user": "admin", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}

Closing comment (2024-11-07T12:36:01Z): Duplicate of #3021