[feature] oidc authentication for NPMplus web admin interface #1664

alexsalex · 2025-03-27T20:09:50Z

As we discuss could you implement NginxProxyManager#4010 this in to NPMplus.

This helps a lot in env and a lot of users waiting on this feature.

Please)

alexsalex · 2025-03-27T21:04:36Z

And forget: I have 7 instances of NPM... each time to create manually user is annoying, controls access to instances impossible. But with SSO will bet easy to do that.

Zoey2936 · 2025-03-28T10:37:46Z

It is completely untested by me, but if you want you can try this tag of NPMplus: ghcr.io/zoeyvid/npmplus:pr-1668
I upgraded the odic module to v6 which had breaking changes, so it was more then just a rebase and there could be alot broken and may not work, so please test it

alexsalex · 2025-03-28T18:14:39Z

sure) will test it. Thank you so much

alexsalex · 2025-03-29T01:44:36Z

/app/node_modules/knex/lib/dialects/better-sqlite3/index.js:44

    const response = await statement.run(bindings);

                                    ^

SqliteError: insert into 'setting' ('description', 'id', 'meta', 'name', 'value') values ('What to show when Nginx is hit with an 
unknown Host', 'default-site', '{}', 'Default Site', 'congratulations') - UNIQUE constraint failed: setting.id
    at Client_BetterSQLite3._query (/app/node_modules/knex/lib/dialects/better-sqlite3/index.js:44:38)
    at executeQuery (/app/node_modules/knex/lib/execution/internal/query-executioner.js:37:17)
    at Client_BetterSQLite3.query (/app/node_modules/knex/lib/client.js:154:12)
    at Runner.query (/app/node_modules/knex/lib/execution/runner.js:141:36)
    at ensureConnectionCallback (/app/node_modules/knex/lib/execution/internal/ensure-connection-callback.js:13:17)
    at Runner.ensureConnection (/app/node_modules/knex/lib/execution/runner.js:318:20)
    at async Runner.run (/app/node_modules/knex/lib/execution/runner.js:30:19)
    at async QueryBuilder.execute (/app/node_modules/objection/lib/queryBuilder/QueryBuilder.js:446:22) {

  code: 'SQLITE_CONSTRAINT_PRIMARYKEY'

}

Node.js v22.13.1

Got this error, nginx doesn't work, can't open any site.

Zoey2936 · 2025-03-29T06:45:12Z

you can repull the image and retry in around 5 minutes

alexsalex · 2025-03-29T18:59:58Z

Same issue, the image the same in pr. Nothing was pulled.

Zoey2936 · 2025-03-29T19:07:31Z

ok, please try again with the newest build which should be ready in a few minutes

alexsalex · 2025-03-30T23:01:43Z

Error gone, looks good. Give me couple of days to test it with different SSO. Now looks really good! THANK YOU!

alexsalex · 2025-03-30T23:06:23Z

Set up and configured as my NPM dev with OIDC support. On NPM works without issue, on NPMplus have this error:

Zoey2936 · 2025-03-31T05:48:16Z

Is something ligged in the docker logs?

alexsalex · 2025-03-31T06:28:09Z

2025/03/30 21:59:58 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
2025/03/30 22:59:57 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ✖  error     Callback error: "server" must be an instance of URL

If you tell me how to turn on the debug logs, will send debug info to you

This is how it should be:

[3/31/2025] [6:32:00 AM] [OIDC     ] › ℹ  info      Initializing OAuth flow
[3/31/2025] [6:32:01 AM] [OIDC     ] › ℹ  info      Authorization URL: https://
[3/31/2025] [6:32:03 AM] [OIDC     ] › ℹ  info      Processing callback
[3/31/2025] [6:32:04 AM] [OIDC     ] › ℹ  info      Successful authentication for email user@dazab.com

alexsalex · 2025-03-31T06:30:20Z

I think missed the string to display right name of the button too

Zoey2936 · 2025-03-31T08:21:16Z

I think missed the string to display right name of the button too

this should be fixed

Zoey2936 · 2025-03-31T08:28:48Z

2025/03/30 21:59:58 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[IP Ranges] › ℹ  info      Fetching IP Ranges from online services...
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v4
[IP Ranges] › ℹ  info      Fetching https://www.cloudflare.com/ips-v6
[Global   ] › ⬤  debug     CMD: certbot-ocsp-fetcher.sh -c /data/tls/certbot/live -o /data/tls/certbot/live --no-reload-webserver --quiet
[Global   ] › ⬤  debug     CMD: nginx -tq
[Nginx    ] › ℹ  info      Reloading Nginx
[Global   ] › ⬤  debug     CMD: nginx -s reload
2025/03/30 22:59:57 [warn] 283#283: could not build optimal variables_hash, you should increase either variables_hash_max_size: 1024 or variables_hash_bucket_size: 64; ignoring variables_hash_bucket_size
[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ✖  error     Callback error: "server" must be an instance of URL

If you tell me how to turn on the debug logs, will send debug info to you

This is how it should be:

[3/31/2025] [6:32:00 AM] [OIDC     ] › ℹ  info      Initializing OAuth flow
[3/31/2025] [6:32:01 AM] [OIDC     ] › ℹ  info      Authorization URL: https://
[3/31/2025] [6:32:03 AM] [OIDC     ] › ℹ  info      Processing callback
[3/31/2025] [6:32:04 AM] [OIDC     ] › ℹ  info      Successful authentication for email user@dazab.com

can you try if it maybe works now?

alexsalex · 2025-03-31T16:28:13Z

Got this:

2025/03/31 09:26:24 [notice] 285#285: parsed a resolver: "[fcff:1203:1::20]" in /usr/local/nginx/conf/nginx.conf:182
[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
/app/routes/oidc.js:67
	return await client.discovery(server: settings.meta.issuerURL, clientId: settings.meta.clientID, clientSecret: settings.meta.clientSecret);
	                              ^^^^^^
SyntaxError: missing ) after argument list
    at wrapSafe (node:internal/modules/cjs/loader:1512:18)
    at Module._compile (node:internal/modules/cjs/loader:1534:20)
    at Object..js (node:internal/modules/cjs/loader:1699:10)
    at Module.load (node:internal/modules/cjs/loader:1313:32)
    at Function._load (node:internal/modules/cjs/loader:1123:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1335:12)
    at require (node:internal/modules/helpers:136:16)
    at Object.<anonymous> (/app/routes/main.js:22:21)
Node.js v22.13.1

Zoey2936 · 2025-03-31T20:06:06Z

if you want you can test again

alexsalex · 2025-03-31T21:47:58Z

@Zoey2936 I want) I would like to help. You built the wonderful product)

Let me check

alexsalex · 2025-04-01T03:54:24Z

Nothing changed, same image:

[Global   ] › ℹ  info      Using Sqlite: /data/npmplus/database.sqlite
/app/routes/oidc.js:67
	return await client.discovery(server: settings.meta.issuerURL, clientId: settings.meta.clientID, clientSecret: settings.meta.clientSecret);
	                              ^^^^^^
SyntaxError: missing ) after argument list
    at wrapSafe (node:internal/modules/cjs/loader:1512:18)
    at Module._compile (node:internal/modules/cjs/loader:1534:20)
    at Object..js (node:internal/modules/cjs/loader:1699:10)
    at Module.load (node:internal/modules/cjs/loader:1313:32)
    at Function._load (node:internal/modules/cjs/loader:1123:12)
    at TracingChannel.traceSync (node:diagnostics_channel:322:14)
    at wrapModuleLoad (node:internal/modules/cjs/loader:217:24)
    at Module.require (node:internal/modules/cjs/loader:1335:12)
    at require (node:internal/modules/helpers:136:16)
    at Object.<anonymous> (/app/routes/main.js:22:21)
Node.js v22.13.1

Zoey2936 · 2025-04-01T05:49:31Z

Ohh, the image was not build because of a merge conföict, dhoild be built now

alexsalex · 2025-04-01T07:14:21Z

Super! Looks almost good))))

[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ℹ  info      Authorization URL: https://&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: "currentUrl" must be an instance of URL, or Request

Here something with languge:

Zoey2936 · 2025-04-01T07:38:33Z

Should be fixed, I think

alexsalex · 2025-04-01T07:43:09Z

[OIDC     ] › ℹ  info      Initializing OAuth flow
[OIDC     ] › ℹ  info      Authorization URL: https://&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: invalid response encountered

Zoey2936 · 2025-04-01T07:46:14Z

Did you removed the domain or is it missing?

alexsalex · 2025-04-01T07:52:58Z

I removed it

alexsalex · 2025-04-01T07:56:27Z

[OIDC     ] › ℹ  info      Authorization URL: https://piu.piu.net/application/o/authorize/?redirect_uri=https%3A%2F%2Fnpm.pim.pim%3A81%2Fapi%2Foidc%2Fcallback&scope=openid+email+profile&code_challenge=LVplp8eDjo8dimC8TBIgMld2k0JkCL4qSfO3bTHJF_8&code_challenge_method=S256&client_id=clientid&response_type=code
[OIDC     ] › ℹ  info      Processing callback
[OIDC     ] › ✖  error     Callback error: invalid response encountered

Zoey2936 · 2025-04-01T08:02:44Z

Ok, I will check this later

Zoey2936 · 2025-04-01T13:23:30Z

do you use openid or oauth?

alexsalex · 2025-04-01T15:56:59Z

OAuth2/OpenID Provider - shows in Authentik

But looks like OAuth 2.0 provider

Zoey2936 · 2025-04-01T16:08:18Z

ok since I in the upgrade to v6 of the client I only mad eit work with openid, not oauth, will try to make it alsow ork with oauth

alexsalex · 2025-04-01T16:53:12Z

NPM with this PR works without any issue with the same settings, even same application in Authentik.

Zoey2936 · 2025-04-01T16:55:24Z

Yes I know, I will adjust it to work with oauth too

alexsalex · 2025-04-03T07:27:32Z

Any luck?)

Zoey2936 · 2025-04-03T13:15:55Z

sorry, I had no time yeet

alexsalex · 2025-04-03T17:07:27Z

No worries) I will wait. Take your time.

Zoey2936 linked a pull request Mar 28, 2025 that will close this issue

Openid, rebased from https://github.com/NginxProxyManager/nginx-proxy-manager/pull/4010 #1668

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[feature] oidc authentication for NPMplus web admin interface #1664

[feature] oidc authentication for NPMplus web admin interface #1664

alexsalex commented Mar 27, 2025

alexsalex commented Mar 27, 2025

Zoey2936 commented Mar 28, 2025

alexsalex commented Mar 28, 2025

alexsalex commented Mar 29, 2025 •

edited

Loading

Zoey2936 commented Mar 29, 2025

alexsalex commented Mar 29, 2025

Zoey2936 commented Mar 29, 2025

alexsalex commented Mar 30, 2025

alexsalex commented Mar 30, 2025 •

edited

Loading

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025 •

edited

Loading

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025 •

edited

Loading

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 3, 2025

Zoey2936 commented Apr 3, 2025

alexsalex commented Apr 3, 2025

[feature] oidc authentication for NPMplus web admin interface #1664

[feature] oidc authentication for NPMplus web admin interface #1664

Comments

alexsalex commented Mar 27, 2025

alexsalex commented Mar 27, 2025

Zoey2936 commented Mar 28, 2025

alexsalex commented Mar 28, 2025

alexsalex commented Mar 29, 2025 • edited Loading

Zoey2936 commented Mar 29, 2025

alexsalex commented Mar 29, 2025

Zoey2936 commented Mar 29, 2025

alexsalex commented Mar 30, 2025

alexsalex commented Mar 30, 2025 • edited Loading

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025 • edited Loading

alexsalex commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025

Zoey2936 commented Mar 31, 2025

alexsalex commented Mar 31, 2025 • edited Loading

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025 • edited Loading

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025 • edited Loading

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 1, 2025

Zoey2936 commented Apr 1, 2025

alexsalex commented Apr 3, 2025

Zoey2936 commented Apr 3, 2025

alexsalex commented Apr 3, 2025

alexsalex commented Mar 29, 2025 •

edited

Loading

alexsalex commented Mar 30, 2025 •

edited

Loading

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Mar 31, 2025 •

edited

Loading

alexsalex commented Apr 1, 2025 •

edited

Loading

alexsalex commented Apr 1, 2025 •

edited

Loading