From 34672eaedb862d7fe70424d4c14f1f1e66832d93 Mon Sep 17 00:00:00 2001 From: cclohmar Date: Sun, 14 Jun 2026 14:00:55 +0000 Subject: [PATCH] fix(auth): add oidc.issuer_url to use public-facing Authelia URL for browser redirects --- app/config.yaml | 1 + install.sh | 1 + src/core/config/config.go | 1 + src/main.go | 9 ++++++++- 4 files changed, 11 insertions(+), 1 deletion(-) diff --git a/app/config.yaml b/app/config.yaml index d0e67f4..455c6ee 100644 --- a/app/config.yaml +++ b/app/config.yaml @@ -19,6 +19,7 @@ authelia: users_db_path: "/opt/authelia/users_database.yml" oidc: + issuer_url: "https://auth.sechpoint.app" client_id: "nextwks" client_secret: "" redirect_url: "https://wks.lohmar.co.uk/auth/callback" diff --git a/install.sh b/install.sh index 2214a44..1b6a527 100755 --- a/install.sh +++ b/install.sh @@ -240,6 +240,7 @@ authelia: users_db_path: "/opt/authelia/users_database.yml" oidc: + issuer_url: "https://auth.sechpoint.app" client_id: "nextwks" client_secret: "" redirect_url: "https://wks.lohmar.co.uk/auth/callback" diff --git a/src/core/config/config.go b/src/core/config/config.go index c977b8b..4999412 100644 --- a/src/core/config/config.go +++ b/src/core/config/config.go @@ -40,6 +40,7 @@ type AutheliaConfig struct { // OIDCConfig holds the OIDC provider settings (Authelia). type OIDCConfig struct { + IssuerURL string `yaml:"issuer_url"` // Public-facing URL users reach (e.g., https://auth.sechpoint.app) ClientID string `yaml:"client_id"` ClientSecret string `yaml:"client_secret"` RedirectURL string `yaml:"redirect_url"` diff --git a/src/main.go b/src/main.go index 5035209..c361f77 100644 --- a/src/main.go +++ b/src/main.go @@ -65,8 +65,15 @@ func main() { // Initialize session store and OIDC auth sessionStore := auth.NewSessionStore(database.DB) + + // OIDC issuer: public-facing URL (via Zoraxy) for browser redirects + // Falls back to authelia.host if not configured + issuerURL := cfg.OIDC.IssuerURL + if issuerURL == "" { + issuerURL = cfg.Authelia.Host + } oidcCfg := auth.OIDCConfig{ - IssuerURL: cfg.Authelia.Host, + IssuerURL: issuerURL, ClientID: cfg.OIDC.ClientID, ClientSecret: cfg.OIDC.ClientSecret, RedirectURL: cfg.OIDC.RedirectURL,