Timshel/vaultwarden

Error 502 using Azure AD

SilvaFernando opened this issue · 10 comments

SilvaFernando commented

HI.
I'm testind vaultwarden using this image timshel/vaultwarden:1.30.5-9 and Azure Oauth using this documentation:https://github.com/Timshel/vaultwarden/blob/sso-support/SSO.md#microsoft-entra-id
image

image

SSO_ENABLED=true
SSO_CLIENT_ID={client_id}
SSO_CLIENT_SECRET={client_secret}
SSO_AUTHORITY=https://login.microsoftonline.com/{tenant_id}/v2.0

SilvaFernando commented

Can you help me?

Timshel commented

Do you have the 502 when coming back to Vaultwarden after login on Azure AD ?
Any error in the server logs ?

SilvaFernando commented

After Azure AD logon:
image

Timshel commented

From the logs the redirection from Azure appear to be working but then Vaultwarden need to redirect to itself, and it fails (unless you did not include any follow-up logs).

So I would say:

  • Open the network panel in your browser debugger and check the cause for the redirection failure.
  • Check your DOMAIN config it's used to build the url logged in Redirection to, is it truly valid ? no typo ?
  • Check your proxy settings is it blocking the redirection ?

Remarks on your anonymization of the logs :

  • The domain is probably still legible ;).
  • The code included is the redirection is sensitive information but should have a short life .
SilvaFernando commented

On Azure side I'm using something like that:
image

On Vaultwarden side, I'm using a Nginx Proxy Manager with this options:
image

And my envs:
image
image

If I'm doing something wrong please, let me know

Timshel commented

Hey
Have you checked what I mentioned in my previous comment ?
I would say try to manually redirect to redirection uri mentioned in the log.

SilvaFernando commented

Yes the redirect URI is valid, I've tried copy and access on my browser.

One thing when I tried https://my-dns/identity/connect/oidc-signin I have this error:
image

Timshel commented

Yes, without the query parameters rocket return a 404, il you add a dummy code and state you'll get a 400 failure.

In your server log the 307 redirection was correctly generated so no issue here.

I have no idea why the url would work manually but the browser would fail to redirect.
Maybe check the browser debugger to see if there is more information ?

Timshel commented

Are you by chance running on Synology ?
There is some discussion on reddit eng and fr

SilvaFernando commented

Hi @Timshel.

Solved, I've found a log on NPM: 2024/04/25 09:06:36 [error] 186#186: *94 upstream sent too big header while reading response header from upstream

And I solved using this documentation: https://ambidextrous-dev.medium.com/nginx-error-upstream-sent-too-big-header-2e16c34e08

Thanks for you help

  • 👍1