Portainer Authentication with Oauth/OIDC (via Pocket ID) #12485

Owl-Tec · 2025-01-13T19:22:49Z

Owl-Tec
Jan 13, 2025

Ask a Question!

Hi Everyone,

I am trying to integrate Portainer authentication to work with Oauth/OIDC (via Pocket ID).

Should be straightforward but I cannot get it to work as I keep getting an "authorized error" on my end:

Now before proceeding - because I am using Tailscale with all my containers (so everything is "internal"), is that the current source of my problems? Typical networking issue with redirection? Maybe my container has to be in either bridge/host mode for the networking or maybe I have to use my container with the Tailscale container then publish it externally?

Portainer just tells me there is an authentication error:

While Pocket ID states the following:

In the console:

In the logs:

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.689767ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:13 | 200 |   35.737917ms |      172.20.0.1 | POST     "/api/oidc/authorize"

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.158306ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  106.199676ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  108.980719ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:15 | 400 |  109.013679ms |      172.20.0.1 | POST     "/api/oidc/token"

Error #01: Invalid code verifier

[GIN] 2025/01/13 - 19:10:49 | 200 |     366.401µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:10:49 | 200 |     400.152µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     337.691µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:12:19 | 200 |     374.072µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     330.741µs |       127.0.0.1 | GET      "/api/application-configuration"

[GIN] 2025/01/13 - 19:13:50 | 200 |     366.411µs |       127.0.0.1 | GET      "/api/application-configuration"

Here are my settings in Pocket ID and this is what I used in Portainer:

Here are some additional settings I have configured in Portainer:

As well as the Open ID configuration info:

{"authorization_endpoint":"https://id.owltec.ca/authorize","claims_supported":["sub","given_name","family_name","name","email","email_verified","preferred_username"],"id_token_signing_alg_values_supported":["RS256"],"issuer":"https://id.owltec.ca","jwks_uri":"https://id.owltec.ca/.well-known/jwks.json","response_types_supported":["code","id_token"],"scopes_supported":["openid","profile","email"],"subject_types_supported":["public"],"token_endpoint":"https://id.owltec.ca/api/oidc/token","userinfo_endpoint":"https://id.owltec.ca/api/oidc/userinfo"}

Thanks for the help everyone.

aerosteon · 2025-01-20T11:33:32Z

aerosteon
Jan 20, 2025

I have a similar setup but using Traefik and have exactly the same problem

0 replies

Nick-Portainer · 2025-01-22T21:49:34Z

Nick-Portainer
Jan 22, 2025
Maintainer

@Owl-Tec What version of Portainer are you running?

5 replies

Owl-Tec Jan 22, 2025
Author

I am currently running 20.10.23 (API: 1.41):

Nick-Portainer Jan 22, 2025
Maintainer

@Owl-Tec, you can find your Portainer version in the bottom left corner of the Portainer UI

Owl-Tec Jan 22, 2025
Author

In that case, it is Portainer Business Edition 2.21.5.

Nick-Portainer Jan 23, 2025
Maintainer

It seems like the “Invalid code verifier” error might be related to either mismatched Redirect URIs or networking issues with Tailscale. Here are a couple of things to check:

Redirect URIs: Double-check that the Redirect URIs configured in Pocket ID match exactly with those set in Portainer. Ensure that the protocol (http/https), domain, port number, and path are all identical. Even small differences can cause the OAuth flow to fail.
Network Configuration: Since you’re using Tailscale for internal networking, review your setup to ensure it doesn’t interfere with the OAuth flow. Pay particular attention to the handling of redirect and callback URLs within the Tailscale environment, as any inconsistencies here could break the PKCE flow.

schongewusst99 Jan 28, 2025

Hello,
unfortunately I have exactly the same problems when I want to use Portainer BE 2.21.5 with OAuth via PKCE. Pocket-ID enforces PKCE. I first tried it with Zitadel. There you can also use CODE instead of PKCE which works fine.
Jim's Garage already noted this a year ago. Please take note of his tutorial on youtube (https://www.youtube.com/watch?v=1T1uxKW06Vs)
Minute 16 and 14 seconds

It looks like something went wrong with PKCE in Portainer. Since two different OIDC providers can reproduce the problem identically.

cloonix · 2025-04-24T09:48:49Z

cloonix
Apr 24, 2025

I found this on the pocket-id documentation: https://pocket-id.org/docs/client-examples/portainer

See the user identifier and scope fields. No commas there. Once i used the values from the documentation, authenticating worked.

3 replies

BobWs Jun 12, 2025

@Owl-Tec did you find a solution to get portainer work with pocket-id?
I'm having the same problem, funny thing when I use the SSO signin of Synology everywhere I use OPENID it works fine, but not with Pocket-id can't seem to get Pocket-id to play nice on my Synology.

Owl-Tec Jun 12, 2025
Author

Nope, I never managed to get it working and I have since abandoned using Pocket-ID with Portainer.

BobWs Jun 12, 2025

Nope, I never managed to get it working and I have since abandoned using Pocket-ID with Portainer.

I’m in a similar situation—unfortunately, I haven’t been able to get any OpenID clients working with Pocket ID on my Synology either. It’s frustrating because Synology’s built-in SSO works flawlessly with all those same clients and apps, but Pocket ID just won’t cooperate. It’s odd, especially since the DSM SSO implementation seems to be fully compatible with OpenID, while Pocket ID, despite being a lightweight OIDC provider designed for this use case, just doesn’t seem to connect properly in my setup.

Portainer.io

Portainer Authentication with Oauth/OIDC (via Pocket ID) #12485

Uh oh!

Uh oh!

Owl-Tec Jan 13, 2025

Ask a Question!

Replies: 3 comments · 8 replies

Uh oh!

aerosteon Jan 20, 2025

Uh oh!

Nick-Portainer Jan 22, 2025 Maintainer

Uh oh!

Owl-Tec Jan 22, 2025 Author

Uh oh!

Nick-Portainer Jan 22, 2025 Maintainer

Uh oh!

Uh oh!

Owl-Tec Jan 22, 2025 Author

Uh oh!

Uh oh!

Nick-Portainer Jan 23, 2025 Maintainer

Uh oh!

schongewusst99 Jan 28, 2025

Uh oh!

cloonix Apr 24, 2025

Uh oh!

BobWs Jun 12, 2025

Uh oh!

Owl-Tec Jun 12, 2025 Author

Uh oh!

BobWs Jun 12, 2025

Owl-Tec
Jan 13, 2025

Replies: 3 comments 8 replies

aerosteon
Jan 20, 2025

Nick-Portainer
Jan 22, 2025
Maintainer

Owl-Tec Jan 22, 2025
Author

Nick-Portainer Jan 22, 2025
Maintainer

Owl-Tec Jan 22, 2025
Author

Nick-Portainer Jan 23, 2025
Maintainer

cloonix
Apr 24, 2025

Owl-Tec Jun 12, 2025
Author