Authentik OIDC Login Issue

[jackedproxy]

Description

Running into a very weird issue.
My current setup is Ideon setup for OIDC with Authentik as an IdP.
Upon accepting an invite and registering the user, I seem to get different login results depending on how I first login.

WHAT I DO

Send new user invite
User accepts invite
User registers (same email, username and password as set on IdP as Ideon doesn't support automatic account provisioning).
At this point the user is registered and ready to login.

a) If SSO is FIRST chosen,
Step 1 - Login Fails (unverified_email error in URL)
Step 2 - Login with form (unverified_email error in URL)
Step 3 - SSO = Success - I made sure to give enough time between registration and SSO attempt, so this doesn't seem to be a case of having to wait for a background task. Instead, the login form seems to trigger the verify for that account?

b) If Login Form is FIRST chosen,
Immediate Success
User then logs out
SSO = Fail (unverified_email URL)
Form = Fail (unverified_email URL)
Unable to get back in seemingly

WHAT I SHOULD SEE

Short of the ideal solution of automatic provisioning, user should be able to login via SSO.

Environment

Standard Ideon docker environment

Screenshots or Logs

These are the only logs I can see of relevance. No errors or warnings for DB.

ideon-app | 2026-03-24T00:37:33.001770589Z {"level":50,"time":1774312653001,"pid":7,"hostname":"13e35f52ed56","error":{"name":"l","type":"CredentialsSignin","kind":"signIn","code":"credentials"},"msg":"NextAuth error"}
ideon-app | 2026-03-24T00:38:38.840697442Z {"level":50,"time":1774312718840,"pid":7,"hostname":"13e35f52ed56","error":{"name":"l","type":"CredentialsSignin","kind":"signIn","code":"credentials"},"msg":"NextAuth error"}
ideon-app | 2026-03-24T00:39:07.009882218Z {"level":50,"time":1774312747009,"pid":7,"hostname":"13e35f52ed56","error":{"name":"l","type":"CredentialsSignin","kind":"signIn","code":"credentials"},"msg":"NextAuth error"}

[3xpyth0n]

Go to Management > Authentication and turn on SSO Auto-Provisioning. It creates the Ideon account automatically on first SSO login, which cuts out the manual registration step entirely and kills the race condition you're hitting.

[jackedproxy]

Go to Management > Authentication and turn on SSO Auto-Provisioning. It creates the Ideon account automatically on first SSO login, which cuts out the manual registration step entirely and kills the race condition you're hitting.

Can confirm it's already enabled.
I'll try to disable and re-enable and test.

Edit:
Tested, still the same issue.
This is my OIDC config:

[3xpyth0n]

okay thanks, i'm working on it

[jackedproxy]

okay thanks, i'm working on it

Understood.
Let me know if there're any other details I can gather, I understand you may not have an Authentik instance setup, happy to do further testing if necessary.
Thanks.

[3xpyth0n]

I just pushed a fix, can you try again by pulling this image and tell me if it's okay on your end ?

docker pull ghcr.io/3xpyth0n/ideon:fix-issue-62

[jackedproxy]

I just pushed a fix, can you try again by pulling this image and tell me if it's okay on your end ?

docker pull ghcr.io/3xpyth0n/ideon:fix-issue-62

Thanks, tested.
Still the same issue, with the following banner now:

I can confirm my account's email on Authentik is verified as well.
Is it a case that Authentik doesn't passthrough a confirmation-status flag to Ideon?
If so, would it be possible to have as a setting, an option to relax this check on Ideon's end? As the OIDC will generally have done it first.

Edit:
Also tried with a brand new account, which confirmed email at sign-up, same issue. So seems Authentik isn't communicating something properly to Ideon. 🤔

[jackedproxy]

Just noticed I get something else in logs:
"error":{"name":"h","type":"CallbackRouteError","kind":"error", "message":"Read more at https://errors.authjs.dev#callbackrouteerror"}, "msg":"NextAuth error"}

The callback URI is as mentioned above, but it was populated automatically by Authentik. I've had a look through Ideon's documentation but can't find any explicit callback URI, which is generally application-specific.

Is this the correct one?

Edit:
Also tried /api/auth/callback based on Issue #4 to same effect, which makes me think the callback URI is not actually the problem, as https://errors.authjs.dev#callbackrouteerror also seems to suggest.

[3xpyth0n]

Thanks for testing again, can you confirm your APP_URL variable is set to the exact public URL you use to access Ideon (same domain + https) ?

[jackedproxy]

Confirmed.
(I've tried both with and without quotes)

Also, I've had this Authentik instance for a good while (couple years now), zero issues, and I'm using OIDC on several other services without issue.

[3xpyth0n]

yea that’s weird, my fix was basically allowing login with unverified email for existing users / pending invites and added audit logs for any sketchy attempts, but looks like I need to dig into the authentik docs lol​​​​​​​​​​​​​​​.

I'll keep you posted either way :)

[jackedproxy]

Sorry, I think I misunderstood.
My testing earlier didn't attempt an invitation - I was relying on SSO provisioning working, but that doesn't seem to work.
I've just re-tested with an invite, and indeed it worked. Once again, my apologies.

It's somewhat unfortunate/annoying/confusing for a new user having to register with password even though they're signing in with OIDC, but at least it does work!

Would it make sense for the OIDC login registration-form to either skip registration, or at the very least not require a password?

[3xpyth0n]

Ohh okay, that clears things up. What you're describing is exactly what SSO auto-provisioning is supposed to handle, and it works fine on my end with Google, Discord and Microsoft. So the issue is Authentik-specific.

I'll dig into the OIDC claims on the Authentik side and push a fix shortly.