OIDC request URI not in the docs

[saschabrockel]

I wanted to use the new OIDC feature but now I don't know what the redirect_uri has to be. It's unfortunately not in the docs.
Is it BASE_URL + /settings ?

[saschabrockel]

So I also needed to remove the DISABLE_REGISTRATION variable. Otherwise, nothing would happen when pressing the login with Authentik button. But it still doesn't work and ends up in a loading circle and error logs of the container:

[0] 0|backend  | [Nest] 348  - 05/09/2025, 10:15:30 PM   ERROR [ExceptionsHandler] Token request failed: 
[0] 0|backend  | Error: Token request failed: 
[0] 0|backend  |     at OauthProvider.getToken (/app/apps/backend/dist/apps/backend/src/services/auth/providers/oauth.provider.js:55:19)
[0] 0|backend  |     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
[0] 0|backend  |     at async AuthService.checkExists (/app/apps/backend/dist/apps/backend/src/services/auth/auth.service.js:137:23)
[0] 0|backend  |     at async AuthController.oauthExists (/app/apps/backend/dist/apps/backend/src/api/routes/auth.controller.js:161:32)
[0] 0|backend  |     at async /app/node_modules/@nestjs/core/router/router-execution-context.js:46:28
[0] 0|backend  |     at async /app/node_modules/@nestjs/core/router/router-proxy.js:9:17
[1] {"level":"error","ts":1746821745.2342105,"logger":"http.handlers.reverse_proxy","msg":"aborting with incomplete response","upstream":"localhost:4200","duration":0.012590794,"request":{"remote_ip":"::1","remote_port":"51862","client_ip":"::1","proto":"HTTP/1.1","method":"GET","host":"localhost:5000","uri":"/auth","headers":{"X-Forwarded-Proto":["http"],"X-Forwarded-Host":["localhost:5000"],"X-Forwarded-For":["::1"],"User-Agent":["Wget"]}},"error":"reading: context canceled"}

The URL in the browser looks like this:
https://positz.my-domain.com/auth?code=526cae67dd0944e189933912c3b13cc2&state=&provider=GENERIC

[DrummyFloyd]

yes the redirect uri is
https://postiz.example.com/settings

[saschabrockel]

Btw another documentation improvement:
You have the warning for trailing slashes, but include trailing slashes yourself in the examples below for every URL. I was lazy and also copied them from there first and trapped into it 😆

I removed unnecessary credentials:

        environment:
            - TZ=Europe/Berlin
            - MAIN_URL=https://postiz.domain.de
            - FRONTEND_URL=https://postiz.domain.de
            - NEXT_PUBLIC_BACKEND_URL=https://postiz.domain.de/api
            - JWT_SECRET=SECRET
            - DATABASE_URL=postgresql://postiz:XYZ@postiz-db:5432/postiz
            - REDIS_URL=redis://redis:6379
            - STORAGE_PROVIDER=local
            - OPENAI_API_KEY=XYZ
            - NOT_SECURED=false
            - UPLOAD_DIRECTORY=/uploads
            - POSTIZ_GENERIC_OAUTH=true
            - NEXT_PUBLIC_POSTIZ_OAUTH_DISPLAY_NAME=Authentik
            - NEXT_PUBLIC_POSTIZ_OAUTH_LOGO_URL=https://raw.githubusercontent.com/walkxcode/dashboard-icons/master/png/authentik.png
            - POSTIZ_OAUTH_URL=https://authentik.domain.de
            - POSTIZ_OAUTH_AUTH_URL=https://authentik.domain.de/application/o/authorize
            - POSTIZ_OAUTH_TOKEN_URL=https://authentik.domain.de/application/o/token
            - POSTIZ_OAUTH_USERINFO_URL=https://authentik.domain.de/application/o/userinfo
            - POSTIZ_OAUTH_CLIENT_ID=clientID
            - POSTIZ_OAUTH_CLIENT_SECRET=clientSecret
            - NEXT_PUBLIC_DISCORD_SUPPORT=
            - NEXT_PUBLIC_POLOTNO=
            - FEE_AMOUNT=0.05
            - STRIPE_PUBLISHABLE_KEY=
            - STRIPE_SECRET_KEY=
            - STRIPE_SIGNING_KEY=
            - STRIPE_SIGNING_KEY_CONNECT=
            - BACKEND_INTERNAL_URL=http://localhost:3000
            - IS_GENERAL=true
            - NEXT_PUBLIC_UPLOAD_DIRECTORY=/uploads

[DrummyFloyd]

actually with latest tag, the warning is no more needed, i forgot to update the doc, will make a pr asap for that

so use url like authentik write them

            - POSTIZ_OAUTH_AUTH_URL=https://authentik.domain.de/application/o/authorize/
            - POSTIZ_OAUTH_TOKEN_URL=https://authentik.domain.de/application/o/token/
            - POSTIZ_OAUTH_USERINFO_URL=https://authentik.domain.de/application/o/userinfo/

EDIT: gitroomhq/postiz-docs#106

[saschabrockel]

Okay, I updated it back again to include the trailing slash, and then I had to register a new company again. I would be nice if the mail would be recognized and connected to the local account but there is a real problem for me.

I cannot use OIDC if I need to have an open registration. And I tried it, I cannot login with OIDC anymore.

When I do not disable registration, everybody in the world can register a company with the default authentication. This is horrible. But I get forced to do not disable it because otherwise nothing works.

[ennogelhaus]

Okay, I updated it back again to include the trailing slash, and then I had to register a new company again. I would be nice if the mail would be recognized and connected to the local account but there is a real problem for me.

I cannot use OIDC if I need to have an open registration. And I tried it, I cannot login with OIDC anymore.

When I do not disable registration, everybody in the world can register a company with the default authentication. This is horrible. But I get forced to do not disable it because otherwise nothing works.

Hello @saschabrockel
You can (if you use Authentik) setup another Provider with the implicit-authentication Flow with the Proxy type pointing towards your Postiz application, which will essentially disable access to the public entirely to your Postiz application. You'll still be required to login using the Authentik Login button, but your problem would be fixed

[saschabrockel]

@egelhaus, hey, thank you for the idea. Sounds a bit cumbersome, though, if you ask me. You don't have such a problem with other apps. This idea should probably also be included in the documentation as a solution.

[DrummyFloyd]

some stuff are still missing to have a real OIDC flow
#737

will try to have to implemnt when i got a bit of time

[DenisBessa]

For me, the error is: the+state+is+missing+or+does+not+have+enough+characters+and+is+therefore+considered+too+weak.+Request+parameter+%27state%27+must+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&state=&provider=GENERIC
And loading forever

[DrummyFloyd]

Which SSO did you set ?

For me it's more related to the SSO setup than postiz feature

[DenisBessa]

My company uses Clerk as a OAuth Provider (https://clerk.com/docs/advanced-usage/clerk-idp)