OIDC: after successful login redirect to login site

[barde]

Description

After setting up an OIDC and connecting it to headplane via "integrated" I cannot login via OIDC on the /admin page.

What I expect:
being able to see the headplane Web UI

What I get:
back on the login page where I can put in an API key or try the OIDC login with the same redirect again

The OIDC in use is PocketId which shows a successful login.

Headplane is running in a docker compose setup and is emitting no debug message.

Logging in with an API key works.

Headplane Version

0.6.0 and also tried next

Headscale Version

0.26

[puyral]

I have the same problem but with authelia. It used to work a few months ago and then it broke I don't really know when. The logs of both authelia and headplane aren't really useful... I'm following the master branch and headscale version reports dev which is unexpected, but I should be on 0.26 (nixos's unstable version).

Here are my logs (a bit redacted)

$ journalctl -f -u headplane.service
Sep 23 20:15:33 headscale systemd[1]: Started Headscale Web UI.
Sep 23 20:15:33 headscale headplane[163]: 2025-09-23T18:15:33.980Z [server] INFO: Running Node.js 22.19.0
Sep 23 20:15:33 headscale headplane[163]: (node:163) ExperimentalWarning: SQLite is an experimental feature and might change at any time
Sep 23 20:15:33 headscale headplane[163]: (Use `node --trace-warnings ...` to show where the warning was created)
Sep 23 20:15:33 headscale headplane[163]: (node:163) [DEP0040] DeprecationWarning: The `punycode` module is deprecated. Please use a userland alternative instead.
Sep 23 20:15:33 headscale headplane[163]: 2025-09-23T18:15:33.990Z [config] INFO: Found a valid configuration file at /etc/headplane/config.yaml
Sep 23 20:15:34 headscale headplane[163]: 2025-09-23T18:15:34.012Z [config] INFO: Using user database file at /var/lib/headplane/users.json
Sep 23 20:15:34 headscale headplane[163]: 2025-09-23T18:15:34.522Z [config] INFO: Using https://authelia.my-domain.com as the OIDC issuer
Sep 23 20:15:34 headscale headplane[163]: 2025-09-23T18:15:34.526Z [server] INFO: Running on 0.0.0.0:3000

$ journalctl -f -u authelia-main.service
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="User Info Request with id 'c7656c0b-1e5b-4f58-9590-cf4dfc69db92' is being processed" method=GET path=/api/oidc/userinfo remote_ip=192.168.100.3
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="User Info Request with id 'c7656c0b-1e5b-4f58-9590-cf4dfc69db92' on client with id '<client_id>' is being returned unsigned as per the registered client configuration" method=GET path=/api/oidc/userinfo remote_ip=192.168.100.3
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="User Info Request with id 'c7656c0b-1e5b-4f58-9590-cf4dfc69db92' on client with id '<client_id>' was successfully processed" method=GET path=/api/oidc/userinfo remote_ip=192.168.100.3
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="Authorization Request with id '710a3211-ab2c-456a-acde-e2121ac52c4b' on client with id '<client_id>' is being processed" method=GET path=/api/oidc/authorization remote_ip="<my_ipv6>"
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="Authorization Request with id '710a3211-ab2c-456a-acde-e2121ac52c4b' on client with id '<client_id>' using consent mode 'explicit' proceeding to generate a new consent session" method=GET path=/api/oidc/authorization remote_ip="<my_ipv6>"
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="Authorization Request with id '710a3211-ab2c-456a-acde-e2121ac52c4b' on client with id '<client_id>' is not being redirected for reauthentication" authenticated_at="2025-09-23 18:04:58 +0000 UTC" method=GET path=/api/oidc/authorization prompt= remote_ip="<my_ipv6>" requested_at="2025-09-23 18:16:19.495036376 +0000 UTC"
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="Authorization Request with id '710a3211-ab2c-456a-acde-e2121ac52c4b' on client with id '<client_id>' using consent mode 'explicit' authentication level 'one_factor' is sufficient for client level 'one_factor'" method=GET path=/api/oidc/authorization remote_ip="<my_ipv6>"
Sep 23 20:16:19 authelia authelia[215]: time="2025-09-23T20:16:19+02:00" level=debug msg="Authorization Request with id '710a3211-ab2c-456a-acde-e2121ac52c4b' on client with id '<client_id>' using consent mode 'explicit' is being redirected to 'https://authelia.my-domain.com/consent/openid/decision?flow=openid_connect&flow_id=5bcbd34b-2e6a-4412-b51d-e5e95202cee4'" method=GET path=/api/oidc/authorization remote_ip="<my_ipv6>"

[tknoch8]

Having the exact same issue with Google OIDC