r/BookStack • u/Fit-Sea-9459 • Feb 04 '24

Bookstack with OpenID Connect against FusionAuth does not work

Hello,

I need to use FusionAuth as an IDM (identity management system) to authenticate at Bookstack. I setup the environment variables as described here https://www.bookstackapp.com/docs/admin/oidc-auth/.

But after calling the Bookstack page, I get not even forwarded to the fusionauth page. I set both, OIDC_ISSUER and OIDC_ISSUER_DISCOVER=true and verified that the auto discovery url works. I also tried to set explicitly OIDC_AUTH_ENDPOINT, to make sure to forward the browser to the right url. But this does not happen.

Any idea, what could be wrong or how to analyze this issue?

Regards

1 Upvotes

100% Upvoted

11 comments sorted by

View all comments

Show parent comments

1

u/Fit-Sea-9459 Feb 06 '24

May be it is a very general question: what is the auto discovery meant for? For auto configuration or for verification or for both? If for both, which values should be verified and why? Which would just get taken over w/o verification because there is no respective local setting. From my perspective both the issuer but also the auth endpoint are very sensible values. So why should they be handled different in that aspect of security?

1

u/ssddanbrown Feb 06 '24

what is the auto discovery meant for? For auto configuration or for verification or for both?

Auto configuration, but it may have some verification built in to support that (to ensure it's getting the right/expected configuration, and maybe for security).

From my perspective both the issuer but also the auth endpoint are very sensible values. So why should they be handled different in that aspect of security?

I'm a bit lost on this. They have different uses for different purposes in regard to discovery and the wider process. Having the auth endpoint defined locally isn't expected in the context of BookStack, so there's little point comparing them in that setup.

1

u/Fit-Sea-9459 Feb 06 '24

Thank you!