Authentik - SSO Settings

[jasonlaguidice]

I'm attempting to set up SSO for my alist instance and I use Authentik for OIDC. Does anyone know to configure alist to interact with an Authentik application?

[CustomIcon]

Alist - SSO Guide

[jasonlaguidice]

I know this exists but it doesn't cover the setup required for Authentik specifically and I can't make sense of how to convert the fields.

In AList I've entered the following:

Login platform: OIDC
Sso client id: [Client ID from Authentik]
Sso client secret: [Secret key from Authentik]
Sso oidc username key: preferred_username
Sso organization name: [blank]
Sso application name: alist
Sso endpoint name: https://auth.[domain]/application/o/authorize
Sso jwt public key: [authentik cert.pem]

In Authentik I have created an application with stub alist

An example JWT payload as would be provided by Authentik is shown below:

{
    "sub": "75a3938de630f1e7153ef57eae14ac82a9e7bc4c3d35cd576e9ca2d18c2a2978",
    "aud": "kL4UODBD5rGV0uFnskVKkaMknP5MgUWM1UKxJep6",
    "exp": 1726510119,
    "iat": 1726508319,
    "auth_time": 1726508319,
    "acr": "goauthentik.io/providers/oauth2/default",
    "email": "redacted",
    "email_verified": true,
    "name": "Jason",
    "given_name": "Jason",
    "preferred_username": "jason",
    "nickname": "jason",
    "groups": [
        "authentik Admins"
    ]
}

And this is provided at an endpoint: https://auth.[domain]/application/o/token

Authentik is configured with the following redirect URIs as I've seen all of these in the documentation but am not sure which is correct:

https://alist.[domain]/api/auth/get_sso_id
https://alist.[domain]/api/auth/sso_get_token
https://alist.[domain]/callback

When I click the SSO button I get the following plaintext error which looks like downloaded text from Authentik with 400 and 404 errors:
{"code":400,"message":"404 Not Found: \n\n\n\n\u003c!DOCTYPE html\u003e\n\n\u003chtml\u003e\n \u003chead\u003e\n \u003cmeta charset=\"UTF-8\"\u003e\n \u003cmeta name=\"viewport\" content=\"width=device-width, initial-scale=1, maximum-scale=1\"\u003e\n \u003ctitle\u003e\nauthentik\n\u003c/title\u003e\n \u003clink rel=\"icon\" href=\"/static/dist/assets/icons/icon.png\"\u003e\n \u003clink rel=\"shortcut icon\" href=\"/static/dist/assets/icons/icon.png\"\u003e\n \n\u003clink rel=\"prefetch\" href=\"/static/dist/assets/images/flow_background.jpg\" /\u003e\n\u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/patternfly.min.css\"\u003e\n\u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/theme-dark.css\" media=\"(prefers-color-scheme: dark)\"\u003e\n\n\n\n\u003cscript\u003e\n window.authentik = {\n locale: \"en-us\",\n config: JSON.parse(''),\n brand: JSON.parse(''),\n versionFamily: \"\",\n versionSubdomain: \"\",\n build: \"\",\n };\n window.addEventListener(\"DOMContentLoaded\", function () {\n \n });\n\u003c/script\u003e\n\n\n \u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/authentik.css\"\u003e\n \u003clink rel=\"stylesheet\" type=\"text/css\" href=\"/static/dist/custom.css\" data-inject\u003e\n \u003cscript src=\"/static/dist/poly-2024.6.4.js\" type=\"module\"\u003e\u003c/script\u003e\n \u003cscript src=\"/static/dist/standalone/loading/index-2024.6.4.js\" type=\"module\"\u003e\u003c/script\u003e\n \n\u003cstyle\u003e\n:root {\n --ak-flow-background: url(\"/static/dist/assets/images/flow_background.jpg\");\n --pf-c-background-image--BackgroundImage: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage-2x: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--sm: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--sm-2x: var(--ak-flow-background);\n --pf-c-background-image--BackgroundImage--lg: var(--ak-flow-background);\n}\n/* Form with user */\n.form-control-static {\n margin-top: var(--pf-global--spacer--sm);\n display: flex;\n align-items: center;\n justify-content: space-between;\n}\n.form-control-static .avatar {\n display: flex;\n align-items: center;\n}\n.form-control-static img {\n margin-right: var(--pf-global--spacer--xs);\n}\n.form-control-static a {\n padding-top: var(--pf-global--spacer--xs);\n padding-bottom: var(--pf-global--spacer--xs);\n line-height: var(--pf-global--spacer--xl);\n}\n\u003c/style\u003e\n\n \u003cmeta name=\"sentry-trace\" content=\"\" /\u003e\n \u003c/head\u003e\n \u003cbody\u003e\n \n\u003cdiv class=\"pf-c-background-image\"\u003e\n\u003c/div\u003e\n\u003cak-message-container\u003e\u003c/ak-message-container\u003e\n\u003cdiv class=\"pf-c-login stacked\"\u003e\n \u003cdiv class=\"ak-login-container\"\u003e\n \u003cmain class=\"pf-c-login__main\"\u003e\n \u003cdiv class=\"pf-c-login__main-header pf-c-brand ak-brand\"\u003e\n \u003cimg src=\"/static/dist/assets/icons/icon_left_brand.svg\" alt=\"authentik Logo\" /\u003e\n \u003c/div\u003e\n \u003cheader class=\"pf-c-login__main-header\"\u003e\n \u003ch1 class=\"pf-c-title pf-m-3xl\"\u003e\n \nNot Found\n\n \u003c/h1\u003e\n \u003c/header\u003e\n \u003cdiv class=\"pf-c-login__main-body\"\u003e\n \n\u003cform method=\"POST\" class=\"pf-c-form\"\u003e\n \u003cp\u003e\u003c/p\u003e\n \u003ca id=\"ak-back-home\" href=\"/\" class=\"pf-c-button pf-m-primary\"\u003e\n Go home\n \u003c/a\u003e\n\u003c/form\u003e\n\n \u003c/div\u003e\n \u003c/main\u003e\n \u003cfooter class=\"pf-c-login__footer\"\u003e\n \u003cul class=\"pf-c-list pf-m-inline\"\u003e\n \n \u003cli\u003e\n \u003cspan\u003e\n Powered by authentik\n \u003c/span\u003e\n \u003c/li\u003e\n \u003c/ul\u003e\n \u003c/footer\u003e\n \u003c/div\u003e\n\u003c/div\u003e\n\n \n \n \u003c/body\u003e\n\u003c/html\u003e\n","data":null}

So what might I have setup incorrectly?

[CustomIcon]

Dear jason. sorry for a late reply. the documentation guide seems to work. here is my authentik + alist config which works:

[CustomIcon]

Demo.mp4

here is demo.

[jasonlaguidice]

Dear jason. sorry for a late reply. the documentation guide seems to work. here is my authentik + alist config which works:

Thank you so much! This got me closer. So I nearly had the correct setup but needed to change the endpoint name to my application stub.

The final settings that work - and for anyone else who may find this hoping to set up Authentik:

Sso login platform: OIDC
Sso client ID: Authentik Client ID
Sso client secret: Authentik Client Secret
Sso oidc username key: preferred_username
Sso organization name: user
Sso application name: user
Sso endpoint name: Path to your your application stub - OpenID Configuration Issuer in Authentik. Do not forget the trailing /
Sso jwt public key: Public certificate selected in Authentik
Compatibility mode should be off

If this project accepts pull requests I can detail this out further and submit a page which shows instructions similar to the other OIDC providers to help others in the future. Thank you so much for the help!

[CustomIcon]

You are most welcome. I agree it was challenging to deal with OIDC by authentik on Alist. took m a while to figure it out as well. the document project is at https://github.com/alist-org/docs. preferrably https://github.com/alist-org/docs/blob/main/docs/guide/advanced/sso.md needs to add Authentik guide to the table :D