sticky openid login / Authentik OpenID misconfiguration

[mrpops2ko]

sticky openid login / Authentik OpenID misconfiguration

[kolaente]

what i've observed is this, and i've reproduced it a few times now to check too

start order is important for the 'log in with authentik' button to appear

if i start vikunja without authentik / traefik then the button disappears and never will be visible

if i start authentik / traefik and then start vikunja then the button appears

This is by design. Vikunja will try to reach the auth provider when the first request to the /api/v1/info endpoint is made, usually when you open Vikunja in the browser. I would not host Vikunja and Authentik in the same docker compose stack to make that work.

Where exactly is the slash missing in the docs? The actual url used is inferred from the .well-known response from the provider.

[mrpops2ko]

what i've observed is this, and i've reproduced it a few times now to check too
start order is important for the 'log in with authentik' button to appear
if i start vikunja without authentik / traefik then the button disappears and never will be visible
if i start authentik / traefik and then start vikunja then the button appears

This is by design. Vikunja will try to reach the auth provider when the first request to the /api/v1/info endpoint is made, usually when you open Vikunja in the browser. I would not host Vikunja and Authentik in the same docker compose stack to make that work.

Where exactly is the slash missing in the docs? The actual url used is inferred from the .well-known response from the provider.

what is the logic of the design? for example i have vikunja and authentik in separate docker compose stacks (traefik and authentik are in the same stack) and if i need to take traefik down to add some new network or make a modification, then vikunja will be up and unable to reach the endpoint so it will just never present authentik SSO

https://gyazo.com/52bee35cd51e586e771a3988b422a648.png trailing slash here

[kolaente]

what is the logic of the design? for example i have vikunja and authentik in separate docker compose stacks (traefik and authentik are in the same stack) and if i need to take traefik down to add some new network or make a modification, then vikunja will be up and unable to reach the endpoint so it will just never present authentik SSO

It's mostly to speed things up and do not hit the auth endpoint for discovery all the time. Usually this is not a problem as auth providers are somewhat critical and thus need to be up constantly.

If Vikunja was able to see the auth provider and cached the provider, and you restart Traefik only, Vikunja will still have the entry in cache and not "forget" it.

[mrpops2ko]

what is the logic of the design? for example i have vikunja and authentik in separate docker compose stacks (traefik and authentik are in the same stack) and if i need to take traefik down to add some new network or make a modification, then vikunja will be up and unable to reach the endpoint so it will just never present authentik SSO

It's mostly to speed things up and do not hit the auth endpoint for discovery all the time. Usually this is not a problem as auth providers are somewhat critical and thus need to be up constantly.

If Vikunja was able to see the auth provider and cached the provider, and you restart Traefik only, Vikunja will still have the entry in cache and not "forget" it.

alright thank you, well i can only hope that you will reconsider this design decision because on some levels it makes no sense.

if we were to add up the cumulative cost, across every single vikunja user hitting some endpoint that was down, once every say 30 seconds i'm sure the cumulative cost across the span of a year is less than $5

the amount of wasted cpu cycles, extra 'load' and all the rest is so virtually low that if we were to graph it out it'd be so statistically insignificant that it'd be questionable if it was real

we are literally talking about loading what is likely a traefik 404 page if its a self hosted auth is down and repeating that every 30 seconds or whatever arbitary retry mechanism value, which im sure nobody is losing sleep over or could ever quantify into meaningful monetary loss or wasted performance