From d4cea049412327f89e274136a899764bb5ebd334 Mon Sep 17 00:00:00 2001 From: Bjorn Blomberg Date: Sun, 5 Jul 2026 23:03:15 +0200 Subject: [PATCH] fix(oidc): don't strip issuer trailing slash (Authentik discovery match) go-oidc requires the issuer passed to NewProvider to exactly match the issuer in the discovery document. Authentik returns ".../application/o//" with a trailing slash; we were stripping it, causing "issuer did not match". Pass the issuer verbatim and fall back to the alternate slash form. Co-Authored-By: Claude Opus 4.8 (1M context) --- backend/internal/auth/oidc.go | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/backend/internal/auth/oidc.go b/backend/internal/auth/oidc.go index 5b2418e..c3a4ad8 100644 --- a/backend/internal/auth/oidc.go +++ b/backend/internal/auth/oidc.go @@ -64,7 +64,23 @@ func (p *OIDCProvider) Configure(ctx context.Context, cfg config.OIDCConfig, red return nil } - provider, err := oidc.NewProvider(ctx, strings.TrimRight(cfg.Issuer, "/")) + // go-oidc strictly checks that the issuer we pass matches the issuer field + // in the discovery document. Providers differ on the trailing slash + // (Authentik returns ".../application/o//" WITH a slash), so try the + // value verbatim first and then the alternate slash form. + issuer := strings.TrimSpace(cfg.Issuer) + provider, err := oidc.NewProvider(ctx, issuer) + if err != nil { + var alt string + if strings.HasSuffix(issuer, "/") { + alt = strings.TrimRight(issuer, "/") + } else { + alt = issuer + "/" + } + if provider2, err2 := oidc.NewProvider(ctx, alt); err2 == nil { + provider, err = provider2, nil + } + } if err != nil { return err }