Issue switching OIDC provider for postal installation

[adorakalb]

Hi,

I've been using postal for over a year now with Authelia as OIDC-Provider, and it worked flawlessly.

Now I'm trying to migrate to Authentik, and while trying to switch to Authentik I'm running into following issue:

From Authentiks side all looks good, no errors in logfile, just in Postals log file:

web-1     | D, [2024-09-19T07:40:00.018522 #9] DEBUG -- omniauth: (oidc) Request phase initiated.
web-1     | 91.22.123.123 - - [19/Sep/2024:07:40:00 +0000] "POST /auth/oidc HTTP/1.1" 302 312 0.0025
web-1     | D, [2024-09-19T07:40:00.877262 #9] DEBUG -- omniauth: (oidc) Callback phase initiated.
web-1     | E, [2024-09-19T07:40:00.999721 #9] ERROR -- omniauth: (oidc) Authentication failure! Invalid ID token: Issuer does not match: OpenIDConnect::ResponseObject::IdToken::InvalidIssuer, Invalid ID token: Issuer does not match
web-1     | 2024-09-19 07:40:01 +0000 INFO   GET /auth/oidc/callback?code=4bXXXXXXXXXXXXXXXXXX2787&state=ecfe0752aXXXXXXXXX3d2867026491 (302) event=request transaction=ec544938XXXXXXXXXd9 controller=SessionsController action=oauth_failure format=html method=GET path=/auth/oidc/callback?code=4bbea322XXXXXXXXXXXXXXXXXX9a02787&state=ecfe0752aXXXXXXXXX026491 request_id=XXXXXXXXX-4bf0-43cc-8d5e-XXXXXXXXX ip_address=172.18.10.2 status=302 db_runtime=0
web-1     | 91.22.67.23 - - [19/Sep/2024:07:40:01 +0000] "GET /auth/oidc/callback?code=4bbXXXXXXXXXXXXXXXXXX2787&state=ecfe0XXXXXXXXXXXXXXXXXX867026491 HTTP/1.1" 302 - 0.1281
web-1     | 2024-09-19 07:40:01 +0000 INFO   GET /login (200) event=request transaction=ec544938f7225173c5d9 controller=SessionsController action=new format=html method=GET path=/login request_id=582b653c-4371-485e-9c77-41329032900c ip_address=172.18.10.2 status=200 view_runtime=2.1825279109179974 db_runtime=0
web-1     | 91.22.67.23 - - [19/Sep/2024:07:40:01 +0000] "GET /login HTTP/1.1" 200 - 0.0066
web-1     | 2024-09-19 07:40:07 +0000 INFO   GET /users (200) event=request transaction=9f57b5a4ecc4e4e458aa controller=UsersController action=index format=html method=GET path=/users request_id=ddc35b49-1a44-4a8d-a002-c4e57a7bd97c ip_address=172.18.10.2 status=200 view_runtime=3.0765580628067255 db_runtime=4.379815578460693

OIDC-Config for postal:

oidc:
  # Start by enabling OIDC for your installation.
  enabled: true

  # The name of the OIDC provider as shown in the UI. For example:
  # "Login with My Proivder".
  name: lila.network Login

  # The OIDC issuer URL provided to you by your Identity provider.
  # The provider must support OIDC Discovery by hosting their configuration
  # at https://identity.example.com/.well-known/openid-configuration.
  issuer: https://login.example.com/

  # The client ID for OIDC
  identifier: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  # The client secret for OIDC
  secret: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  # Disable login field
  local_authentication_enabled: true

  # Scopes to request from the OIDC server. You'll need to find these from your
  # provider. You should ensure you request enough scopes to ensure the user's
  # email address is returned from the provider.
  scopes:
    - openid
    - email

  # Enable discovery to determine endpoints from .well-known/openid-configuration from the Issuer
  discovery: false

  # The authorize endpoint on the authorization server (only used when discovery is false)
  authorization_endpoint: https://login.example.com/application/o/authorize/

  # The token endpoint on the authorization server (only used when discovery is false)
  token_endpoint: https://login.example.com/application/o/token/

  # The user info endpoint on the authorization server (only used when discovery is false)
  userinfo_endpoint: https://login.example.com/application/o/userinfo/

  # The JWKS endpoint on the authorization server (only used when discovery is false)
  jwks_uri: https://login.example.com/application/o/postal/jwks/

The previously created users in potal via OIDC partly still exist. The login issue happens regardless of if the user trying to login already exists or was deleted previously.

I'd appreciate it if someone could take a look and maybe point me in some troubleshooting directions, thank you very much!

[willpower232]

Referencing the PR #2873 I expect that the identifiers from your previous provider are stored in the users table in the main Postal database so if you're moving providers, I believe you will have to go and manually clear those couple of fields using a database editor.

[adorakalb]

I removed all previous OIDC users from the users table but I still get the error. Do you have any Idea?

[willpower232]

Oh interesting, so you're trying to log in with someone who isn't in the users table at all?

It might be worth double checking the output of /.well-known/openid-configuration from the new provider, it looks like issuer is a key in that JSON so perhaps it doesn't match the configuration given to Postal?

[adorakalb]

That was it! Thank you! ^-^ it works now.