Can't make Authentik OAuth2 work with Wiki JS

[EHRETic]

Hello, everything is in the title! I don't know what I'm doing wrong so I ask on the WikiJS side too.

This is a copy paste of the Authentik topic I opened here: goauthentik/authentik#7974

Describe the bug
Despite I was able to configure a working Portainer Oauth, I can't get WikiJS to work with same user

To Reproduce
Steps to reproduce the behavior:

1. Configure WikiJS Oauth2 generic OpenID
2. Try to login
3. Wiki site redirects me to auth
4. Auth works bur access to WikiJS fails

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
Configuration of WikiJS (wich is not a one to one match of the documentation (some extra fields

Error

Logs

Stacktrace from authentik

Traceback (most recent call last):
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/views.py", line 497, in dispatch
    self.initial(request, *args, **kwargs)
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/views.py", line 414, in initial
    self.perform_authentication(request)
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/views.py", line 324, in perform_authentication
    request.user
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/request.py", line 227, in user
    self._authenticate()
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/request.py", line 380, in _authenticate
    user_auth_tuple = authenticator.authenticate(self)
                      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/authentication.py", line 130, in authenticate
    self.enforce_csrf(request)
  File "/ak-root/venv/lib/python3.11/site-packages/rest_framework/authentication.py", line 148, in enforce_csrf
    raise exceptions.PermissionDenied('CSRF Failed: %s' % reason)
rest_framework.exceptions.PermissionDenied: CSRF Failed: Origin checking failed - https://auth-test.mydomain.ext does not match any trusted origins.

Version and Deployment (please complete the following information):

• authentik version: 2023.10.5
• Docker container with macvlan IP adresses

Additional context

• I use LetsEncrypt certificates for both instances (authentik & wikijs), both are behind an NGINX reverse proxy
• A Portainer instance works fine
• I use Incognito mode for testing
• all my users are AD based (but I don't think it matters)

Maybe some of you did already configure this successfully, any clue where I should start looking? Thanks in advance 😉

[andymarden]

I have it working. I use the self-signed cert and it seems to work fine without me having to install anything on the wiki.js side.

Other things I can see that are different to what you have:

• I use the default bridge interface for the wiki.js container
• I have not got "Skip User Profile" on
• DisplayName is just name

That seems to be everything on the wikijs side.

Did you remember to grant the user or group they belong to as having access to the wikijs application within Authentik?

[EHRETic]

Hi,

In fact, the solution was to add the following line in NGINX configuration (both entities, Authentik & Wiki):

proxy_set_header X-Forwarded-Proto $scheme;

I had nothing to change on WikiJS side.