[feature] oidc authentication for NPMplus web admin interface #1664

alexsalex · 2025-03-27T20:09:50Z

As we discuss could you implement NginxProxyManager#4010 this in to NPMplus.

This helps a lot in env and a lot of users waiting on this feature.

Please)

alexsalex · 2025-03-27T21:04:36Z

And forget: I have 7 instances of NPM... each time to create manually user is annoying, controls access to instances impossible. But with SSO will bet easy to do that.

Zoey2936 · 2025-03-28T10:37:46Z

It is completely untested by me, but if you want you can try this tag of NPMplus: ghcr.io/zoeyvid/npmplus:pr-1668
I upgraded the odic module to v6 which had breaking changes, so it was more then just a rebase and there could be alot broken and may not work, so please test it

alexsalex · 2025-03-28T18:14:39Z

sure) will test it. Thank you so much

alexsalex · 2025-03-29T01:44:36Z

/app/node_modules/knex/lib/dialects/better-sqlite3/index.js:44

    const response = await statement.run(bindings);

                                    ^

SqliteError: insert into 'setting' ('description', 'id', 'meta', 'name', 'value') values ('What to show when Nginx is hit with an 
unknown Host', 'default-site', '{}', 'Default Site', 'congratulations') - UNIQUE constraint failed: setting.id
    at Client_BetterSQLite3._query (/app/node_modules/knex/lib/dialects/better-sqlite3/index.js:44:38)
    at executeQuery (/app/node_modules/knex/lib/execution/internal/query-executioner.js:37:17)
    at Client_BetterSQLite3.query (/app/node_modules/knex/lib/client.js:154:12)
    at Runner.query (/app/node_modules/knex/lib/execution/runner.js:141:36)
    at ensureConnectionCallback (/app/node_modules/knex/lib/execution/internal/ensure-connection-callback.js:13:17)
    at Runner.ensureConnection (/app/node_modules/knex/lib/execution/runner.js:318:20)
    at async Runner.run (/app/node_modules/knex/lib/execution/runner.js:30:19)
    at async QueryBuilder.execute (/app/node_modules/objection/lib/queryBuilder/QueryBuilder.js:446:22) {

  code: 'SQLITE_CONSTRAINT_PRIMARYKEY'

}

Node.js v22.13.1

Got this error, nginx doesn't work, can't open any site.

Zoey2936 · 2025-03-29T06:45:12Z

you can repull the image and retry in around 5 minutes

alexsalex · 2025-03-29T18:59:58Z

Same issue, the image the same in pr. Nothing was pulled.

Zoey2936 · 2025-03-29T19:07:31Z

ok, please try again with the newest build which should be ready in a few minutes

alexsalex · 2025-03-30T23:01:43Z

Error gone, looks good. Give me couple of days to test it with different SSO. Now looks really good! THANK YOU!

alexsalex · 2025-03-30T23:06:23Z

Set up and configured as my NPM dev with OIDC support. On NPM works without issue, on NPMplus have this error:

Zoey2936 · 2025-03-31T05:48:16Z

Is something ligged in the docker logs?

alexsalex · 2025-03-31T06:28:09Z

2025/03/30 21:59:58 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
2025/03/30 22:59:57 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ✖  error     Callback error: "server" must be an instance of URL

If you tell me how to turn on the debug logs, will send debug info to you

This is how it should be:

[3/31/2025] [6:32:00 AM] [OIDC     ] › ℹ  info      Initializing OAuth flow
[3/31/2025] [6:32:01 AM] [OIDC     ] › ℹ  info      Authorization URL: https://
[3/31/2025] [6:32:03 AM] [OIDC     ] › ℹ  info      Processing callback
[3/31/2025] [6:32:04 AM] [OIDC     ] › ℹ  info      Successful authentication for email [email protected]

alexsalex · 2025-03-31T06:30:20Z

I think missed the string to display right name of the button too

Zoey2936 · 2025-03-31T08:21:16Z

I think missed the string to display right name of the button too

this should be fixed

Zoey2936 · 2025-03-31T08:28:48Z

2025/03/30 21:59:58 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
2025/03/30 22:59:57 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ✖  error     Callback error: "server" must be an instance of URL

If you tell me how to turn on the debug logs, will send debug info to you

This is how it should be:

[3/31/2025] [6:32:00 AM] [OIDC     ] › ℹ  info      Initializing OAuth flow
[3/31/2025] [6:32:01 AM] [OIDC     ] › ℹ  info      Authorization URL: https://
[3/31/2025] [6:32:03 AM] [OIDC     ] › ℹ  info      Processing callback
[3/31/2025] [6:32:04 AM] [OIDC     ] › ℹ  info      Successful authentication for email [email protected]

can you try if it maybe works now?

alexsalex · 2025-03-31T16:28:13Z

Got this:

2025/03/31 09:26:24 [notice] 285#285: parsed a resolver: "[fcff:1203:1::20]" in /usr/local/nginx/conf/nginx.conf:182
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
/app/routes/oidc.js:67
	return await client.discovery(server: settings.meta.issuerURL, clientId: settings.meta.clientID, clientSecret: settings.meta.clientSecret);
	                              ^^^^^^
SyntaxError: missing ) after argument list
    at wrapSafe (node:internal/modules/cjs/loader:1512:18)
    at Module._compile (node:internal/modules/cjs/loader:1534:20)
    at Object..js (node:internal/modules/cjs/loader:1699:10)
    at Module.load (node:internal/modules/cjs/loader:1313:32)
    at Function._load (node:internal/modules/cjs/loader:1123:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1335:12)
    at require (node:internal/modules/helpers:136:16)
    at Object.<anonymous> (/app/routes/main.js:22:21)
Node.js v22.13.1

Zoey2936 · 2025-03-31T20:06:06Z

if you want you can test again

alexsalex · 2025-03-31T21:47:58Z

@Zoey2936 I want) I would like to help. You built the wonderful product)

Let me check

alexsalex · 2025-04-01T03:54:24Z

Nothing changed, same image:

[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
/app/routes/oidc.js:67
	return await client.discovery(server: settings.meta.issuerURL, clientId: settings.meta.clientID, clientSecret: settings.meta.clientSecret);
	                              ^^^^^^
SyntaxError: missing ) after argument list
    at wrapSafe (node:internal/modules/cjs/loader:1512:18)
    at Module._compile (node:internal/modules/cjs/loader:1534:20)
    at Object..js (node:internal/modules/cjs/loader:1699:10)
    at Module.load (node:internal/modules/cjs/loader:1313:32)
    at Function._load (node:internal/modules/cjs/loader:1123:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1335:12)
    at require (node:internal/modules/helpers:136:16)
    at Object.<anonymous> (/app/routes/main.js:22:21)
Node.js v22.13.1

Zoey2936 · 2025-04-01T05:49:31Z

Ohh, the image was not build because of a merge conföict, dhoild be built now

alexsalex · 2025-04-01T07:14:21Z

Super! Looks almost good))))

[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ℹ  info      Authorization URL: https://&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: "currentUrl" must be an instance of URL, or Request

Here something with languge:

Zoey2936 · 2025-04-01T07:38:33Z

Should be fixed, I think

alexsalex · 2025-04-01T07:43:09Z

[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ℹ  info      Authorization URL: https://&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: invalid response encountered

Zoey2936 · 2025-04-01T07:46:14Z

Did you removed the domain or is it missing?

alexsalex · 2025-04-01T07:52:58Z

I removed it

alexsalex · 2025-04-01T07:56:27Z

[OIDC     ] › ℹ  info      Authorization URL: https://piu.piu.net/application/o/authorize/?redirect_uri=https%3A%2F%2Fnpm.pim.pim%3A81%2Fapi%2Foidc%2Fcallback&scope=openid+email+profile&code_challenge=LVplp8eDjo8dimC8TBIgMld2k0JkCL4qSfO3bTHJF_8&code_challenge_method=S256&client_id=clientid&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: invalid response encountered

Zoey2936 · 2025-04-01T08:02:44Z

Ok, I will check this later

Zoey2936 · 2025-04-01T13:23:30Z

do you use openid or oauth?

alexsalex · 2025-04-01T15:56:59Z

OAuth2/OpenID Provider - shows in Authentik

But looks like OAuth 2.0 provider

Zoey2936 · 2025-04-01T16:08:18Z

ok since I in the upgrade to v6 of the client I only mad eit work with openid, not oauth, will try to make it alsow ork with oauth

alexsalex · 2025-04-01T16:53:12Z

NPM with this PR works without any issue with the same settings, even same application in Authentik.

Zoey2936 · 2025-04-01T16:55:24Z

Yes I know, I will adjust it to work with oauth too

alexsalex · 2025-04-03T07:27:32Z

Any luck?)

Zoey2936 · 2025-04-03T13:15:55Z

sorry, I had no time yeet

alexsalex · 2025-04-03T17:07:27Z

No worries) I will wait. Take your time.

Zoey2936 · 2025-04-08T17:54:38Z

ok, you can now test again

alexsalex · 2025-04-08T23:39:49Z

I can't login ether with email or with SSO.

SyntaxError: Invalid regular expression: /^(?!.+\:[0-9]+$).+$/u: Invalid escape
    at new RegExp (<anonymous>)
    at defaultRegExp (/app/node_modules/ajv/dist/core.js:23:39)
    at usePattern (/app/node_modules/ajv/dist/vocabularies/code.js:73:16)
    at Object.code (/app/node_modules/ajv/dist/vocabularies/validation/pattern.js:19:109)
    at keywordCode (/app/node_modules/ajv/dist/compile/validate/index.js:464:13)
    at /app/node_modules/ajv/dist/compile/validate/index.js:222:17
    at CodeGen.code (/app/node_modules/ajv/dist/compile/codegen/index.js:439:13)
    at CodeGen.block (/app/node_modules/ajv/dist/compile/codegen/index.js:568:18)
    at iterateKeywords (/app/node_modules/ajv/dist/compile/validate/index.js:219:9)
    at groupKeywords (/app/node_modules/ajv/dist/compile/validate/index.js:200:13)
[Express  ] › ⚠  warning   Invalid regular expression: /^(?!.+\:[0-9]+$).+$/u: Invalid escape

[Express  ] › ⚠  warning   Invalid regular expression: /^(?!.+\:[0-9]+$).+$/u: Invalid escape
[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ℹ  info      Authorization URL: https://auth/application/o/authorize/?redirect_uri=https%3A%2F%2Fnpm%3A81%2Fapi%2Foidc%2Fcallback&scope=openid+email&code_challenge=&code_challenge_method=S256&client_id=&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: invalid response encountered

Zoey2936 · 2025-04-09T07:45:04Z

ok you can try again please

alexsalex · 2025-04-09T21:46:55Z

There is no new image...

Zoey2936 · 2025-04-09T21:51:29Z

The last build should be 14 hours old: #1668 (comment)

alexsalex · 2025-04-10T01:10:00Z

Able to login with email/password, but OIDC:

[OIDC ] › ℹ info Initializing OAuth flow
[OIDC ] › ℹ info Authorization URL: https://auth/application/o/authorize/?redirect_uri=https%3A%2F%2Fnpm%3A81%2Fapi%2Foidc%2Fcallback&scope=openid+email&code_challenge=l&code_challenge_method=S256&client_id=W&response_type=code
[OIDC ] › ℹ info Processing callback
[OIDC ] › ✖ error Callback error: invalid response encountered

Zoey2936 · 2025-04-10T08:49:28Z

ok you can try again

alexsalex · 2025-04-11T00:38:07Z

Same issue, but now nothing on the page, only in logs:

[OIDC ] › ✖ error Callback error: invalid response encountered

alexsalex · 2025-04-22T04:08:37Z

Sorry for bothering you, but do you have any updates?

Zoey2936 · 2025-04-22T06:40:47Z

I think, I will revert back to v5 and will later try to migrate to v6 to get it faster merged, will work on it as soon as possible

alexsalex · 2025-05-05T21:24:35Z

#1776

This PR works for me.

Could you tell me v5 and v6, what do you mean?

Zoey2936 · 2025-05-06T05:02:40Z

With v5/v6 I mean the version of the nodejs openid-client package

Zoey2936 · 2025-05-07T14:55:56Z

will be included in the next release

alexsalex · 2025-05-08T01:57:35Z

v6 shows me the same error as before. v5 broken.

Add comments to PRs

Zoey2936 mentioned this issue Mar 28, 2025

openid-v6 #1668

Merged

Zoey2936 closed this as completed in #1668 May 7, 2025

[feature] oidc authentication for NPMplus web admin interface #1664

[feature] oidc authentication for NPMplus web admin interface #1664

Comments

alexsalex commented Mar 27, 2025

alexsalex commented Mar 27, 2025

Uh oh!

Zoey2936 commented Mar 28, 2025

Uh oh!

alexsalex commented Mar 28, 2025

Uh oh!

alexsalex commented Mar 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zoey2936 commented Mar 29, 2025

Uh oh!

alexsalex commented Mar 29, 2025

Uh oh!

Zoey2936 commented Mar 29, 2025

Uh oh!

alexsalex commented Mar 30, 2025

Uh oh!

alexsalex commented Mar 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zoey2936 commented Mar 31, 2025

Uh oh!

alexsalex commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexsalex commented Mar 31, 2025

Uh oh!

Zoey2936 commented Mar 31, 2025

Uh oh!

Zoey2936 commented Mar 31, 2025

Uh oh!

alexsalex commented Mar 31, 2025

Uh oh!

Zoey2936 commented Mar 31, 2025

Uh oh!

alexsalex commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

alexsalex commented Apr 1, 2025

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 1, 2025

Uh oh!

Zoey2936 commented Apr 1, 2025

Uh oh!

alexsalex commented Apr 3, 2025

Uh oh!

Zoey2936 commented Apr 3, 2025

Uh oh!

alexsalex commented Apr 3, 2025

Uh oh!

Zoey2936 commented Apr 8, 2025

Uh oh!

alexsalex commented Mar 29, 2025 •

edited

Loading

alexsalex commented Mar 30, 2025 •

edited

Loading

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Apr 1, 2025 •

edited

Loading

alexsalex commented Apr 1, 2025 •

edited

Loading

alexsalex commented Apr 8, 2025 •

edited

Loading