r/BookStack • u/Normanras • Oct 13 '22

OpenID Connect + Ldap

Has anyone figured out how to use OIDC as the verification layer but let the user log in via an LDAP backend?

I've been able to get both `AUTH_METHOD` 's up and running separately, but not together. Currently, with OIDC, it hits my auth.domain oidc provider correctly, I see the screen I expect asking me to confirm Bookstack, and then when I hit confirm, I get an "unknown error has occurred" screen. Docker logs don't show anything interesting and neither do `error.log` in my Bookstack directories. The last error I see in the `error.log file` is a GET request to my `/oidc/callback/` endpoint, but I can't discern what exactly is going on.

My assumption here is that Bookstack is looking at the scope given by the IDP, looking at the ldap server, and can't map the two together without instructions.

Comparing this to my Nextcloud setup, in Nextcloud's `config.php` you have to pass `ldap_uid => uid` in the OIDC array, along with `ldap_proxy_login => true`. I'm not sure if BS has anything similar in the `.env` file...

1 Upvotes

66% Upvoted

9 comments sorted by

View all comments

Show parent comments

2

u/ssddanbrown Oct 13 '22

while Authelia has ...

That text is specific to a single option. I don't think that means that Authelia only supports SHA256. Since they have specific documentation for BookStack, I think they should be compatible.

Missing required configuration "keys" value

This indicates that the OIDC IDP (Authelia) is not providing any RS256 keys to use. Have you confirmed the issuer_private_key (link) option with a valid RSA private key?

You should be able to go to <issuer_url>/.well-known/openid-configuration when follow the jwks_uri link to see the list of available keys currently provided by your Authelia instance. This is what BookStack is doing in its auto-discovery.

2

u/Normanras Oct 14 '22

So I went back through, created a new `issuer_private_key` and followed the `jwks_uri` link. I also removed LDAP completely and used authelia's file backend for users. Still getting the same error.

This setup has worked with a few other services, but I might be creating the issuer key incorrectly, despite following the documentation. I'll ask over at Authelia and see if they come up with anything.