BrowZer 0.90.0 with External Authentik OIDC - invalid_grant Error During Token Exchange

BrowZer
1

We successfully use Authentik as OIDC provider
Bootstrapper correctly reads and embeds config
But fails with: invalid_grant - does not match redirection URI or was issued to another client
Error occurs in oidcUtil.getAccessToken() during token exchange
The bootstrapper is trying to exchange the auth code server-side

Is BrowZer 0.90.0 designed to work with external OIDC providers?

Should the bootstrapper do server-side token exchange, or should that be browser-side?

What's the correct configuration for using an external provider like Authentik?

2

Hi @vox100, welcome to the community and to OpenZiti!

Unfortunately we had to pause work on BrowZer. It should most work with any OIDC provider. "But fails with: invalid_grant - does not match redirection URI or was issued to another client" makes me think it was misconfigured. Unfortunately, we aren't really in a place to continue supporting it at this time.

You could have a look into zrok to see if that might fit your needs. Cheers

3

I found this line in the Authentik | NetFoundry Documentation:

For tunnelers

Tunnelers require an allowed callback URL of: http://localhost:20314/auth/callback.

For Ziti Admin Console (ZAC)

The URL to configure an IdP for so that ZAC will be able to authenticate will depend on how you deploy your ZAC. The current method recommended to deploy ZAC will deploy it on the same URL as the controller. For example: https://controller.example.com/zac/callback

You might need to adjust your redirectUri config.