Pocket ID as IDP help

[Unreeling8562]

Describe the problem

Can't get Pocket ID working as idp.

Are you using NetBird Cloud?

Self-hosted

NetBird version

v0.36.5

Additional context

I've tried using a Authelia guide and the official guides (Keycloak, Zitadel, ...) but it doesn't seem to work.

[Oujiii]

Were you able to make any progress with this?

[R-Nabil]

Hey. Were you able to figure it out ? I've been struggling as well

[mitchplze]

No luck for me getting Pocket ID working either.

[karlo-el-tigre]

I am also struggling to get netbird working with pocket id. Any ideas?

[bigtcze]

Looking for solution for this too. Official support would be excellent!

[mlsmaycon]

Hello Folks, the system supports any OIDC compliment solution that provides PKCE flow. The dashboard and CLI login are all around PKCE flows, so if you share a guide for it with pocket id or a guide for single page applications, we can have a look and try to guide you.

[mitchplze]

Still no luck getting this to work natively unfortunately no matter how hard I try.

However, I was able to easily add Pocket ID as a ZITADEL authentication backend in the gui.

This is not ideal, but is a good alternative to get NetBird + OIDC running in about 5 minutes from the quick start guide.

[karlo-el-tigre]

I got it working by following the Authelia documentation: https://www.authelia.com/integration/openid-connect/netbird/

I'll post my configs when I'm at my computer later tonight

[karlo-el-tigre]

Okay, after hours of troubleshooting, I finally have Caddy + Pocket-ID + Netbird working properly. I hope these configuration files are helpful. I also borrowed a few clues from running the quickstart guide as well as the Authelia/Netbird documentation: https://www.authelia.com/integration/openid-connect/netbird/

docker-compose.yml

services:
  # Caddy reverse proxy
  caddy:
    build:
      context: .
      dockerfile: Dockerfile
    restart: unless-stopped
    networks: 
      netbird:
        aliases:
          - "netbird.example.com"
    env_file: 
      - .env
    environment:
      - CLOUDFLARE_EMAIL=${CF_EMAIL}
      - CLOUDFLARE_API_TOKEN=${CF_API_TOKEN}
      - ACME_AGREE=true
    ports:
      - '443:443'
      - '443:443/udp'
      - '80:80'
      - '8080:8080'
    volumes:
      - /srv/caddy/netbird_caddy_data:/data
      - ./Caddyfile:/etc/caddy/Caddyfile
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
  # UI dashboard
  dashboard:
    image: netbirdio/dashboard:latest
    restart: unless-stopped
    networks: [ netbird ]
    environment:
      # Endpoints
      - NETBIRD_MGMT_API_ENDPOINT=https://netbird.example.com
      - NETBIRD_MGMT_GRPC_API_ENDPOINT=https://netbird.example.com
      # OIDC
      - AUTH_AUDIENCE=pocketid-client-id
      - AUTH_CLIENT_ID=pocketid-client-id
      - AUTH_CLIENT_SECRET=pocketid-client-secret
      - AUTH_AUTHORITY=https://id.example.com
      - USE_AUTH0=false
      - AUTH_SUPPORTED_SCOPES=openid profile email
      - AUTH_REDIRECT_URI=
      - AUTH_SILENT_REDIRECT_URI=
      - NETBIRD_TOKEN_SOURCE=accessToken
      # SSL
      - NGINX_SSL_PORT=443
      # Letsencrypt
      - LETSENCRYPT_DOMAIN=
      - LETSENCRYPT_EMAIL=
    volumes:
      - netbird-letsencrypt:/etc/letsencrypt/
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Signal
  signal:
    image: netbirdio/signal:latest
    restart: unless-stopped
    networks: [ netbird ]
    ports:
      - "10000:10000"
    command: ["--port", "10000", "--log-file", "console"]
    volumes:
      - netbird-signal:/var/lib/netbird
  #      # port and command for Let's Encrypt validation
  #      - 443:443
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Relay
  relay:
    image: netbirdio/relay:latest
    restart: unless-stopped
    networks: [ netbird ]
    environment:
    - NB_LOG_LEVEL=info
    - NB_LISTEN_ADDRESS=:33080
    - NB_EXPOSED_ADDRESS=rels://netbird.example.com:33080/relay
    # todo: change to a secure secret
    - NB_AUTH_SECRET=xxxx
    ports:
      - 33080:33080
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

  # Management
  management:
    image: netbirdio/management:latest
    restart: unless-stopped
    networks: [ netbird ]
    depends_on:
      - dashboard
    volumes:
      - netbird-mgmt:/var/lib/netbird
      - netbird-letsencrypt:/etc/letsencrypt:ro
      - ./management.json:/etc/netbird/management.json
  #    # command for Let's Encrypt validation without dashboard container
  #    command: ["--letsencrypt-domain", "", "--log-file", "console"]
    command: [
      "--port", "80",
      "--log-file", "console",
      "--log-level", "info",
      "--disable-anonymous-metrics=false",
      "--single-account-mode-domain=netbird.example.com",
      "--dns-domain=netbird.selfhosted"
      ]
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"
    environment:
      - NETBIRD_STORE_ENGINE_POSTGRES_DSN=
      - NETBIRD_STORE_ENGINE_MYSQL_DSN=
      
  # Coturn
  coturn:
    image: coturn/coturn:latest
    restart: unless-stopped
    #domainname: netbird.example.com # only needed when TLS is enabled
    volumes:
      - ./turnserver.conf:/etc/turnserver.conf:ro
    #      - ./privkey.pem:/etc/coturn/private/privkey.pem:ro
    #      - ./cert.pem:/etc/coturn/certs/cert.pem:ro
    network_mode: host
    command:
      - -c /etc/turnserver.conf
    logging:
      driver: "json-file"
      options:
        max-size: "500m"
        max-file: "2"

volumes:
  netbird-mgmt:
  netbird-signal:
  netbird-letsencrypt:

networks:
  netbird:

management.json

{
    "Stuns": [
        {
            "Proto": "udp",
            "URI": "stun:netbird.example.com:3478",
            "Username": "",
            "Password": ""
        }
    ],
    "TURNConfig": {
        "TimeBasedCredentials": false,
        "CredentialsTTL": "12h0m0s",
        "Secret": "secret",
        "Turns": [
            {
                "Proto": "udp",
                "URI": "turn:netbird.example.com:3478",
                "Username": "self",
                "Password": "xxxx"
            }
        ]
    },
    "Relay": {
        "Addresses": [
            "rels://netbird.example.com:33080"
        ],
        "CredentialsTTL": "24h0m0s",
        "Secret": "xxxx"
    },
    "Signal": {
        "Proto": "https",
        "URI": "netbird.example.com:443",
        "Username": "",
        "Password": ""
    },
    "Datadir": "/var/lib/netbird/",
    "DataStoreEncryptionKey": "xxxx",
    "HttpConfig": {
        "LetsEncryptDomain": "",
        "CertFile": "",
        "CertKey": "",
        "AuthAudience": "pocketid-client-id",
        "AuthIssuer": "https://id.example.com",
        "AuthUserIDClaim": "sub",
        "AuthKeysLocation": "https://id.example.com/.well-known/jwks.json",
        "OIDCConfigEndpoint": "https://id.example.com/.well-known/openid-configuration",
        "IdpSignKeyRefreshEnabled": false,
        "ExtraAuthAudience": ""
    },
    "IdpManagerConfig": {
        "ManagerType": "",
        "ClientConfig": null,
        "ExtraConfig": null,
        "Auth0ClientCredentials": null,
        "AzureClientCredentials": null,
        "KeycloakClientCredentials": null,
        "ZitadelClientCredentials": null
    },
    "DeviceAuthorizationFlow": {
        "Provider": "",
        "ProviderConfig": {
            "ClientID": "",
            "ClientSecret": "",
            "Domain": "id.example.com",
            "Audience": "",
            "TokenEndpoint": "https://id.example.com/api/oidc/token",
            "DeviceAuthEndpoint": "https://id.example.com/api/oidc/device/authorize",
            "AuthorizationEndpoint": "",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": null,
            "DisablePromptLogin": false,
            "LoginFlag": 0
        }
    },
    "PKCEAuthorizationFlow": {
        "ProviderConfig": {
            "ClientID": "pocketid-client-id",
            "ClientSecret": "pocketid-client-secret",
            "Domain": "",
            "Audience": "pocketid-client-id",
            "TokenEndpoint": "https://id.example.com/api/oidc/token",
            "DeviceAuthEndpoint": "",
            "AuthorizationEndpoint": "https://id.example.com/authorize",
            "Scope": "openid profile email",
            "UseIDToken": true,
            "RedirectURLs": [
                "http://localhost:53000"
            ],
            "DisablePromptLogin": false,
            "LoginFlag": 1
        }
    },
    "StoreConfig": {
        "Engine": "sqlite"
    },
    "ReverseProxy": {
        "TrustedHTTPProxies": [],
        "TrustedHTTPProxiesCount": 0,
        "TrustedPeers": [
            "0.0.0.0/0"
        ]
    }
}

Caddyfile

{
  debug
  #acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
	servers :80,:443 {
    protocols h1 h2c h2 h3
  }
}

(security_headers) {
    header * {
        # enable HSTS
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#strict-transport-security-hsts
        # NOTE: Read carefully how this header works before using it.
        # If the HSTS header is misconfigured or if there is a problem with
        # the SSL/TLS certificate being used, legitimate users might be unable
        # to access the website. For example, if the HSTS header is set to a
        # very long duration and the SSL/TLS certificate expires or is revoked,
        # legitimate users might be unable to access the website until
        # the HSTS header duration has expired.
        # The recommended value for the max-age is 2 year (63072000 seconds).
        # But we are using 1 hour (3600 seconds) for testing purposes
        # and ensure that the website is working properly before setting
        # to two years.

        Strict-Transport-Security "max-age=3600; includeSubDomains; preload"

        # disable clients from sniffing the media type
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-content-type-options
        X-Content-Type-Options "nosniff"

        # clickjacking protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-frame-options
        X-Frame-Options "SAMEORIGIN"

        # xss protection
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#x-xss-protection
        X-XSS-Protection "1; mode=block"

        # Remove -Server header, which is an information leak
        # Remove Caddy from Headers
        -Server

        # keep referrer data off of HTTP connections
        # https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html#referrer-policy
        Referrer-Policy strict-origin-when-cross-origin
    }
}

netbird.example.com {
    tls {
            dns cloudflare {env.CF_API_TOKEN}
            propagation_delay 2m
            resolvers 1.1.1.1
    }    
    import security_headers
    # relay
    reverse_proxy /relay* relay:33080
    # Signal
    reverse_proxy /signalexchange.SignalExchange/* h2c://signal:10000
    # Management
    reverse_proxy /api/* management:80
    reverse_proxy /management.ManagementService/* h2c://management:80
    # Dashboard
    reverse_proxy /* dashboard:80
}

[mlsmaycon]

@karlo-el-tigre can you confirm if client secret is needed for the dashboard configuration? Usually, on PKCE flows, that's not needed.

[karlo-el-tigre]

I can confirm that it was needed on my end