Authelia OIDC redirect to c10y does not work with pre-established authelia session #2069

New issue

Open

opened 2026-07-28 20:37:30 +00:00 by davidcb · 1 comment

davidcb commented

2026-07-28 20:37:30 +00:00

Hi, I'm facing a weird issue with authelia OIDC. I set up OIDC in c10y with

CONTINUWUITY_OAUTH__OIDC__DISCOVERY_URL="https://auth.example.at"
CONTINUWUITY_OAUTH__OIDC__CLIENT_ID=c10y
CONTINUWUITY_OAUTH__OIDC__CLIENT_SECRET=supersecret
CONTINUWUITY_OAUTH__OIDC__ADDITIONAL_SCOPES="[profile, email]"

and the following authelia config

      - client_id: 'c10y'
        client_name: 'matrix.example.de'
        client_secret: "supersecret_hash"
        public: false
        authorization_policy: c10y_policy
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'https://matrix.example.de/_continuwuity/oidc/complete'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
        consent_mode: 'auto'
        pre_configured_consent_duration: '1 year'

which works perfectly when starting the sign in flow with a fresh authelia session:
On the log in screen, the Continue button takes me to https://auth.example.at/?flow=openid_connect&flow_id=cedce9f6-4b1d-4fe3-ab7b-1e8e964a541f (my authelia instance), I provide my authelia credentials, consent to OIDC, and get redirected to c10y. After this the (code to token?) exchange happens between c10y and authelia and I am signed into matrix.

However, if I already have an authenticated authelia session established and try to do the sign in flow,
I never get redirected back to c10y, the browser simply stays on the authelia page.

The browser developer tools show a GET request:

https://auth.example.at/api/oidc/authorization?response_type=code&client_id=c10y&state=axqYvGexzhjFOE83rYzVeQ&code_challenge=cNRn96Vc4drLKN0BNq1piK5KA4S_xBYbgdn-X8Yl3Ug&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmatrix.example.de%2F_continuwuity%2Foidc%2Fcomplete&scope=openid+profile+email&nonce=IU2JyAqrf7_cpxpbixLFXQ

and then a redirect to https://auth.example.at/?flow=openid_connect&flow_id=ee703995-ab29-40c1-8ed6-4213a731ec47 where the browser gets stuck.

The authelia logs only show the authentication but no attempt at any redirect back to c10y is being made

time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=debug msg="Authorization Request with id '299e3c36-8603-4924-886e-1a1981f24d13' on client with id 'c10y' is being processed" caller="github.com/authelia/authelia/v4/internal/handlers/handler_oauth2_authorization.go:66 OAuth2AuthorizationGET" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=302)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/ remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=200)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/ remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/static/js/index.CXslS62G.js remote_ip=192.168.10.121
time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/static/js/index.CXslS62G.js remote_ip=192.168.10.121

.
.
.

time="2026-07-28T21:13:31+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/static/js/components.InformationIcon.CuxJHPCu.js remote_ip=192.168.10.121
time="2026-07-28T21:13:31+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/static/js/components.InformationIcon.CuxJHPCu.js remote_ip=192.168.10.121
time="2026-07-28T21:13:31+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/locales remote_ip=192.168.10.121
time="2026-07-28T21:13:31+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/locales remote_ip=192.168.10.121

Everything after the first 302 response is just authelia loading its UI, I believe.

The c10y logs show literally nothing in this second case (which I think is expected since everything before the redirect back to c10y happens between the auth server and the browser, right?)

Can anyone think of a reason for this behaviour? My first instinct would be that i misconfigured authelia, but all my other (numerous) OIDC clients work without issue.

Thanks in advance!

continuwuity 26.7.1 (83cf15b)
authelia version v4.39.20
Tested in Firefox and Chromium

Hi, I'm facing a weird issue with authelia OIDC. I set up OIDC in c10y with ``` CONTINUWUITY_OAUTH__OIDC__DISCOVERY_URL="https://auth.example.at" CONTINUWUITY_OAUTH__OIDC__CLIENT_ID=c10y CONTINUWUITY_OAUTH__OIDC__CLIENT_SECRET=supersecret CONTINUWUITY_OAUTH__OIDC__ADDITIONAL_SCOPES="[profile, email]" ``` and the following authelia config ``` - client_id: 'c10y' client_name: 'matrix.example.de' client_secret: "supersecret_hash" public: false authorization_policy: c10y_policy require_pkce: true pkce_challenge_method: 'S256' redirect_uris: - 'https://matrix.example.de/_continuwuity/oidc/complete' scopes: - 'openid' - 'profile' - 'email' response_types: - 'code' grant_types: - 'authorization_code' access_token_signed_response_alg: 'none' userinfo_signed_response_alg: 'none' token_endpoint_auth_method: 'client_secret_basic' consent_mode: 'auto' pre_configured_consent_duration: '1 year' ``` which works perfectly when starting the sign in flow with a fresh authelia session: On the log in screen, the `Continue` button takes me to `https://auth.example.at/?flow=openid_connect&flow_id=cedce9f6-4b1d-4fe3-ab7b-1e8e964a541f` (my authelia instance), I provide my authelia credentials, consent to OIDC, and get redirected to c10y. After this the (code to token?) exchange happens between c10y and authelia and I am signed into matrix. However, if I already have an authenticated authelia session established and try to do the sign in flow, I never get redirected back to c10y, the browser simply stays on the authelia page. The browser developer tools show a GET request: `https://auth.example.at/api/oidc/authorization?response_type=code&client_id=c10y&state=axqYvGexzhjFOE83rYzVeQ&code_challenge=cNRn96Vc4drLKN0BNq1piK5KA4S_xBYbgdn-X8Yl3Ug&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fmatrix.example.de%2F_continuwuity%2Foidc%2Fcomplete&scope=openid+profile+email&nonce=IU2JyAqrf7_cpxpbixLFXQ` and then a redirect to `https://auth.example.at/?flow=openid_connect&flow_id=ee703995-ab29-40c1-8ed6-4213a731ec47` where the browser gets stuck. The authelia logs only show the authentication but no attempt at any redirect back to c10y is being made ``` time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=debug msg="Authorization Request with id '299e3c36-8603-4924-886e-1a1981f24d13' on client with id 'c10y' is being processed" caller="github.com/authelia/authelia/v4/internal/handlers/handler_oauth2_authorization.go:66 OAuth2AuthorizationGET" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=302)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/api/oidc/authorization remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/ remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=200)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/ remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/static/js/index.CXslS62G.js remote_ip=192.168.10.121 time="2026-07-28T21:13:30+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/static/js/index.CXslS62G.js remote_ip=192.168.10.121 . . . time="2026-07-28T21:13:31+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/static/js/components.InformationIcon.CuxJHPCu.js remote_ip=192.168.10.121 time="2026-07-28T21:13:31+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/static/js/components.InformationIcon.CuxJHPCu.js remote_ip=192.168.10.121 time="2026-07-28T21:13:31+02:00" level=trace msg="Request hit" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:12 handlerMain.LogRequest.func42" method=GET path=/locales remote_ip=192.168.10.121 time="2026-07-28T21:13:31+02:00" level=trace msg="Replied (status=304)" caller="github.com/authelia/authelia/v4/internal/middlewares/log_request.go:16 handlerMain.LogRequest.func42" method=GET path=/locales remote_ip=192.168.10.121 ``` Everything after the first `302` response is just authelia loading its UI, I believe. The c10y logs show literally nothing in this second case (which I think is expected since everything before the redirect back to c10y happens between the auth server and the browser, right?) Can anyone think of a reason for this behaviour? My first instinct would be that i misconfigured authelia, but all my other (numerous) OIDC clients work without issue. Thanks in advance! continuwuity 26.7.1 (83cf15b) authelia version v4.39.20 Tested in Firefox and Chromium

ginger commented

2026-07-28 22:55:11 +00:00

Owner

Thanks for the thorough report. This seems very likely to be an issue with Authelia, not continuwuity, since other OIDC-compatible IDPs are known to work correctly, but if you're able to narrow this down to a behavior of continuwuity specifically please amend this issue with more detail and we'll take another look.

ginger added the

labels

2026-07-28 22:55:25 +00:00