OAuth setup assistance

[brandonbay]

Hi! I'm having trouble setting up OAuth in version 6.1.2, and I'm not really sure what I'm doing wrong. Can anyone assist?

I've created apps in both Google and Github (to confirm it wasn't a Google-specific issue), set the client_id and client_secret for each in the .env, and I can see both available to set up on my user profile.

However, when I go to connect I get an error telling me Registration attempted but not initialized.

The logs aren't any more informative:

[Morksen]

I'm struggling with the same issue with my Authentik instance.

AUTHENTIK_BASE_URL=https://<myauthentichost>/application/o/<authentikapplication>/
AUTHENTIK_CLIENT_ID=111111111111111111111111
AUTHENTIK_CLIENT_SECRET=222222222222222222222222222222222
AUTHENTIK_REDIRECT_URI=/auth/authentik/redirect

I've tried it with two base url values.
https://<myauthentichost>/application/o/<authentikapplication>/ creates the wrong redirect
https://<myauthentichost>/ leads to the issue mentioned by @brandonbay

[trailfog]

I also just tried setting up OAuth with Authentik. Registering new users works perfectly, but trying to link an existing user raises the "Registration Attempted but not initialized" exception.

This happens on the following line:

Lychee/app/Http/Controllers/OauthController.php

Lines 96 to 98 in 6fc3ec6

	if (!Request::hasValidSignature(false)) {
	throw new UnauthorizedException('Registration attempted but not initialized.');
	}

This is not down to an invalid configuration of the OAuth setup, but rather laravel not accepting the signed URL it generated. Thus, no matter what provider is chosen, this error will occur.

I had a look at the full URL (as seen by the server), just before checking the signature's validity:

public function register(string $provider) {
    die(Request::fullUrl());

    [...]
}

This resulted in https://<my-domain>/auth/authentik/register?%2Fauth%2Fauthentik%2Fregister=&expires=1740482807&signature=9a2407... being printed. The /auth/authentik/register parameter was not provided when the signature was created. Otherwise, only expires and signature should be present.

---

I managed to get the signature-check working by changing the following functions in app/Http/Controllers/OauthController.php:

• The signature check needs to ignore the additional URL parameter we found when looking at the request URL:

public function register(string $provider) {
    Auth::user() ?? throw new UnauthenticatedException();
    if (!Request::hasValidSignatureWhileIgnoring(["/auth/$provider/register"])) {
        throw new UnauthorizedException('Registration attempted but not initialized.');
    }
 
    [...]
}

• Setting absolute to true when generating the signed route:

private function withUserData(): array {
    [...]

    $route = URL::signedRoute(
        name: 'oauth-register',
        parameters: ['provider' => $provider->value],
        expiration: now()->addMinutes(5),
        absolute: true)

    [...]
}

This is not a perfect solution, as the URL-parameter that should be ignored is most likely coming from the *_REDIRECT_URI env variable.

I will open a new merge request to hopefully get this fixed.