# Setting up OIDC with Authentik gives SyntaxError: Unexpected token --\> not valid JSON

**URL:** <https://discourse.nodered.org/t/setting-up-oidc-with-authentik-gives-syntaxerror-unexpected-token-not-valid-json/97981>\
**Category:** General\
**Tags:** docker\
**Created:** [5 July 2025 10:22 UTC](https://discourse.nodered.org/t/setting-up-oidc-with-authentik-gives-syntaxerror-unexpected-token-not-valid-json/97981 "2025-07-05T10:22:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gmag11](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gmag11/32/477_2.png) [@gmag11](https://discourse.nodered.org/u/gmag11)\
**Post date:** [5 July 2025 10:22 UTC](https://discourse.nodered.org/t/setting-up-oidc-with-authentik-gives-syntaxerror-unexpected-token-not-valid-json/97981/1 "2025-07-05T10:22:29Z")

</div>

Hi,

I have a node-red 4.0.9 instance running in a docker container. I am trying to setup OIDC login with Authentik, which is working fine with other services.

I follower the guide in Authentik site: [Integrate with Node-RED | authentik](https://integrations.goauthentik.io/integrations/services/node-red/)

openid module is installed:

```bash
:/data$ npm list passport-openidconnect
node-red-project@0.0.1 /data
`-- passport-openidconnect@0.1.2

```

My auth configuration is this:

```javascript
     adminAuth: {
        type: "strategy",
        strategy: {
                name: "openidconnect",
                label: 'Sign in with authentik',
                icon:"fa-cloud",
                strategy: require("passport-openidconnect").Strategy,
                options: {
                        issuer: 'https://auth.domain.com/application/o/nodered-test-domain-com/',
                        authorizationURL: 'https://auth.domain.com/application/o/authorize/',
                        tokenURL: 'https://auth.domain.com/application/o/token/',
                        userInfoURL: 'https://auth.domain.com/application/o/userinfo/',
                        clientID: 'xxx',
                        clientSecret: 'xxxxxxxxxxxxx',
						callbackURL: 'https://nodered.test.domain.com/auth/strategy/callback/',
                        scope: ['email', 'profile', 'openid'],
                        passReqToCallback: true,
                        proxy: true,
                        verify: function(issuer, profile, done) {
                                //console.log(`Issuer: ${issuer}`);
                                console.log(profile);
                                return done(null, profile);
                        },
                },
        },
        //users: function(user) {
        // return Promise.resolve({ username: user, permissions: "*" });
        //},
        users: [
                { username: "user1@domain.com", permissions: ["*"] },
        ],
    },

```

This is Authentik config data:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/f/9/f96e0e0210c7156836206a1713526b8fceed85fc.png)

When logging in I get this error:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/f/d/fd4302b4db10ee75ddf7820439a17ad4abaf3126.png)

What can I do more in order to debug this?

EDIT 1:

I had enabled token encryption in Authentik. I've disabled that and now error is: TypeError: done is not a function

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/0/2/0288e5239b115d2f688e9b90577639bffe02d79c.png)

EDIT 2:  
I've added console logs for `profile` and `done` in `verify` call and got an strange result:

```auto
Profile: https://auth.domain.com/application/o/nodered-test-domain-com/
Done: {
  "id": "user1@domain.com",
  "displayName": "user1",
  "username": "user1",
  "name": {
    "givenName": "user1"
  },
  "emails": [
    {
      "value": "user1@domain.com"
    }
  ]
}

```

`profile` parameter in `verify` contains issuerURL  
`done` parameter contains the user profile.

Is is possible that something has changed in `passport-openidconnect`?

Thanks

---

<div class="post-metadata">

**Author:** ![gmag11](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/gmag11/32/477_2.png) [@gmag11](https://discourse.nodered.org/u/gmag11)\
**Post date:** [5 July 2025 12:22 UTC](https://discourse.nodered.org/t/setting-up-oidc-with-authentik-gives-syntaxerror-unexpected-token-not-valid-json/97981/2 "2025-07-05T12:22:24Z")

</div>

I reply myself. I got it working.

For some reason `verify` signature is `verify (context, issuer, profile, done)`.

@knolleary If you read this please clarify this behabiour.

So, my working configuration is:

```javascript
adminAuth: {
        type: "strategy",
        strategy: {
                name: "openidconnect",
                label: 'Sign in with authentik',
                icon:"fa-cloud",
                strategy: require("passport-openidconnect").Strategy,
                options: {
                        issuer: 'https://auth.domain.com/application/o/nodered-test-domain-com/',
                        authorizationURL: 'https://auth.domain.com/application/o/authorize/',
                        tokenURL: 'https://auth.domain.com/application/o/token/',
                        userInfoURL: 'https://auth.domain.com/application/o/userinfo/',
                        clientID: 'xxx',
                        clientSecret: 'xxxxxxxxxxxxx',
						callbackURL: 'https://nodered.test.domain.com/auth/strategy/callback/',
                        scope: ['email', 'profile', 'openid'],
                        passReqToCallback: true,
                        proxy: true,
                        verify: function(context, issuer, profile, done) {
                                return done(null, profile);
                        },
                },
        },
        users: [
                { username: "user1", permissions: ["*"] },
        ],
    },

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [19 July 2025 12:23 UTC](https://discourse.nodered.org/t/setting-up-oidc-with-authentik-gives-syntaxerror-unexpected-token-not-valid-json/97981/3 "2025-07-19T12:23:18Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.