# OAUTH2 Authentication with authentik

**URL:** <https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238>\
**Category:** General\
**Tags:** security\
**Created:** [28 November 2023 05:57 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238 "2023-11-28T05:57:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![chrisn-au](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/chrisn-au/32/25504_2.png) [@chrisn-au](https://discourse.nodered.org/u/chrisn-au)\
**Post date:** [28 November 2023 05:57 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/1 "2023-11-28T05:57:36Z")

</div>

Howdy, it has been a while - work has been busy.

Have been having a play with my home set up and for fun looking at using authentik as the SSO for my home lab. I am learning on the fly here so probably have made a silly mistake

Was pleasantly surprised that they support Node Red oauth2

Have followed the instructions found [here](https://goauthentik.io/integrations/services/node-red/)

installed the passport-openidconnect package and updated settings.js

with

```auto
adminAuth: {
type:"strategy",
strategy: {
        name: "openidconnect",
        label: 'Sign in with authentik',
        icon:"fa-cloud",
        strategy: require("passport-openidconnect").Strategy,
        options: {
                issuer: 'https://authentik.xxxx.com/application/o/nodered-slug/',
                authorizationURL: 'https://authentik.xxxx.com/application/o/authorize/',
                tokenURL: 'https://authentik.xxxxx.com/application/o/token/',
                userInfoURL: 'https://authentik.xxxx.com/application/o/userinfo/',
                clientID: 'clientIsRedacted',
                clientSecret: 'clientSecretIsRedacted',
                callbackURL: 'https://nr.xxxx.com/auth/strategy/callback/',
                scope: ['email', 'profile', 'openid'],
                proxy: true,
        verify: function(issuer, profile, done) {
                done(null, profile)
        }
      }
    },
    users: function(user) {
        return Promise.resolve({ username: user, permissions: "*" });
    }
},

```

The authentication appears to work (logs form authentik ) however getting a ENOTFOUD on the return to node red. There is nothing in any logs

A hope that someone may have see something similar

---

<div class="post-metadata">

**Author:** ![dugite-code](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dugite-code/32/3438_2.png) [@dugite-code](https://discourse.nodered.org/u/dugite-code)\
**Post date:** [29 November 2023 01:24 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/2 "2023-11-29T01:24:40Z")

</div>

Hey I wrote that guide, hopefully I can be of help. I've not seen the `ENOTFOUD` error before.

Have you changed the logging level in your `settings.js` yet?

```auto
    // Configure the logging output
    logging: {
        console: {
            level: "trace",
            metrics: true,
            audit: true
        }
    },

```

---

<div class="post-metadata">

**Author:** ![dugite-code](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dugite-code/32/3438_2.png) [@dugite-code](https://discourse.nodered.org/u/dugite-code)\
**Post date:** [29 November 2023 01:33 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/3 "2023-11-29T01:33:22Z")

</div>

Oh also in Authentik go to Admin Interface -\> Providers -\> Node-RED and verify the URL's:

1. OpenID Configuration Issuer -\> `issuer:`
2. Authorize URL -\> `authorizationURL:`
3. Token URL -\> `tokenURL:`
4. Userinfo URL -\> `userInfoURL:`

---

<div class="post-metadata">

**Author:** ![chrisn-au](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/chrisn-au/32/25504_2.png) [@chrisn-au](https://discourse.nodered.org/u/chrisn-au)\
**Post date:** [29 November 2023 10:20 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/4 "2023-11-29T10:20:35Z")

</div>

Heh,

thanks for the quick reply. As I was checking I attempted to ping the authentik host from the nr container, and guess what I can't. It looks like an issue with dns in docker when running a dns host (pi hole) on the same host. Alas it is to late to night to diagnose but for tomorrow

BTW thanks for the doco and support

---

<div class="post-metadata">

**Author:** ![chrisn-au](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/chrisn-au/32/25504_2.png) [@chrisn-au](https://discourse.nodered.org/u/chrisn-au)\
**Post date:** [29 November 2023 10:29 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/5 "2023-11-29T10:29:39Z")

</div>

So hacked the hosts file so it resolves and all good - proper soln tomorrow

---

<div class="post-metadata">

**Author:** ![chrisn-au](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/chrisn-au/32/25504_2.png) [@chrisn-au](https://discourse.nodered.org/u/chrisn-au)\
**Post date:** [29 November 2023 12:05 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/6 "2023-11-29T12:05:18Z")

</div>

For the record - google was not a great help here. The commonly suggested soln (adding the explicit ip to the port definition in pihole) did not work for me, however adding a explicit dns record in the node-red service of the docker compose file worked.

For anyone who has a similar issue

```auto
dns:
    - 192.168.2.50

```

Thx again

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [13 December 2023 12:05 UTC](https://discourse.nodered.org/t/oauth2-authentication-with-authentik/83238/7 "2023-12-13T12:05:26Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.