Tailscale with different token_endpoint_auth_method values

[MrGoro]

I'm trying to connect Tailscale to my Authelia instance. Unfortunately I cannot get it working together.

Webfinger ist setup and correctly recognized by Tailscale so that I can configure client id and secret. For prompts I use the default "consent".

My configuration contains this OIDC client:

identity_providers:
  oidc:
    clients:
      - client_id: 'tailscale'
        client_name: 'Tailscale'
        client_secret: 'mysecret'
        public: false
        authorization_policy: 'two_factor'
        redirect_uris:
          - 'https://login.tailscale.com/a/oauth_response'
        scopes:
          - 'openid'
          - 'email'
          - 'profile'

When trying to login I receiver this error after successful login in Authelia:

time="2024-05-08T12:06:34Z" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'tailscale' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'." method=POST path=/api/oidc/token remote_ip=3.121.44.151 stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go:25                   OpenIDConnectTokenPOST\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:114 handleRouter.NewHTTPToAutheliaHandlerAdaptor.func25\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54                            handleRouter.(*BridgeBuilder).Build.func16.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:91                           SecurityHeadersNoStore.func1\ngithub.com/valyala/fasthttp@v1.52.0/userdata.go:57                                           (*userData).Get\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:30                           SecurityHeadersBase.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216                             handleRouter.(*CORSPolicy).Middleware.func26\ngithub.com/fasthttp/router@v1.5.0/router.go:441                                              (*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14                       handleRouter.LogRequest.func40\ngithub.com/authelia/authelia/v4/internal/middlewares/errors.go:38                            RecoverPanic.func1\ngithub.com/valyala/fasthttp@v1.52.0/server.go:2374                                           (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:224                                        (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:196                                        (*workerPool).getCh.func1\nruntime/asm_amd64.s:1695                                                                     goexit"

As the error seems to be very clear to configure the token_endpoint_auth_method for the tail scale client I added this to the config:

        token_endpoint_auth_method: 'client_secret_post'

When trying again I receive the error the other way round:

time="2024-05-08T12:09:58Z" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_basic', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'tailscale' is configured to only support 'token_endpoint_auth_method' method 'client_secret_post'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_basic' or the Relying Party will need to be configured to use 'client_secret_post'." method=POST path=/api/oidc/token remote_ip=3.121.44.151 stack="github.com/authelia/authelia/v4/internal/handlers/handler_oidc_token.go:25                   OpenIDConnectTokenPOST\ngithub.com/authelia/authelia/v4/internal/middlewares/http_to_authelia_handler_adaptor.go:114 handleRouter.NewHTTPToAutheliaHandlerAdaptor.func25\ngithub.com/authelia/authelia/v4/internal/middlewares/bridge.go:54                            handleRouter.(*BridgeBuilder).Build.func16.1\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:91                           SecurityHeadersNoStore.func1\ngithub.com/valyala/fasthttp@v1.52.0/userdata.go:57                                           (*userData).Get\ngithub.com/authelia/authelia/v4/internal/middlewares/headers.go:30                           SecurityHeadersBase.func1\ngithub.com/authelia/authelia/v4/internal/middlewares/cors.go:216                             handleRouter.(*CORSPolicy).Middleware.func26\ngithub.com/fasthttp/router@v1.5.0/router.go:441                                              (*Router).Handler\ngithub.com/authelia/authelia/v4/internal/middlewares/log_request.go:14                       handleRouter.LogRequest.func40\ngithub.com/authelia/authelia/v4/internal/middlewares/errors.go:38                            RecoverPanic.func1\ngithub.com/valyala/fasthttp@v1.52.0/server.go:2374                                           (*Server).serveConn\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:224                                        (*workerPool).workerFunc\ngithub.com/valyala/fasthttp@v1.52.0/workerpool.go:196                                        (*workerPool).getCh.func1\nruntime/asm_amd64.s:1695                                                                     goexit"

For me it seems that quite a lot users are able to successfully connect Tailscale to Authelia so that I'm wondering if maybe I'm missing something.

Does anybody have a good idea? Or is this a bug in Tailscale?

[glime-ai[bot]]

Please note this response was created using generative AI leveraging previously available information from the repository. This information may be helpful however it is our strong recommendation that you carefully consider the information before blindly applying it.

---

It appears that the issue you're encountering with the token_endpoint_auth_method is related to a mismatch between the configuration in Authelia and the expectations of Tailscale. The error messages indicate that there is a conflict between the method expected by Tailscale and the method configured in Authelia.

Here are a few steps to troubleshoot and potentially resolve this issue:

1. Verify the Default Method: Ensure that the default token_endpoint_auth_method in Authelia is set to client_secret_basic, as this is the method that seems to be expected initially by Tailscale. You can set this explicitly in your Authelia configuration to avoid any defaults that might not match:

   token_endpoint_auth_method: 'client_secret_basic'

2. Check Tailscale Configuration: Verify if there are any settings on the Tailscale side that specify or prefer a particular authentication method. It's possible that Tailscale has specific requirements or defaults that are not documented clearly.

3. Consistency in Configuration: Ensure that the token_endpoint_auth_method is consistently configured across all settings. If it's set to client_secret_basic in Authelia, Tailscale should also be expecting the same method.

4. Review Authelia Logs: Look deeper into the Authelia logs to see if there are any additional details about the authentication process that might give clues as to why the mismatch is occurring.

5. Community and Support: Since you mentioned that many users have successfully connected Tailscale to Authelia, it might be helpful to check community forums, GitHub discussions, or support channels for both Authelia and Tailscale. There might be similar cases or configurations that could shed light on the issue.

6. Update and Retry: Ensure both Authelia and Tailscale are running on their latest versions, as updates might contain fixes or improvements related to OpenID Connect and authentication methods.

If after trying these steps the issue persists, it might be beneficial to reach out directly to Authelia or Tailscale support for more tailored assistance, as this could be indicative of a more complex compatibility issue or a bug.

This comment was generated by Glime.

[james-d-elliott]

What version are you using?

[MrGoro]

Sorry that I missed that quite important info. I'm using 4.38.8.

[james-d-elliott]

I think you've removed important logs which reveal the actual issue. Please include the debug logs for a full authorization request with both token_endpoint_auth_method values separately.

[MrGoro]

Thanks for the reply. While searching for the other logs I found the actual error myself: The client ecret was not copy-pasted correctly to the config and therefore the entered secret was invalid.

[james-d-elliott]

Yeah and tailscale was trying both auth methods, that's what I suspected.

[MrGoro]

That‘s what was also my First idea. But did Not find That in the Logs. But the Message indicating a wrong secret was helpful.
Nevertheless, it is working now. Thanks for the help.