After updating headplane to 0.6.1, Auth0 OIDC is not working.

[gunu3371]

Description

After updating the headplane, the OIDC login feature is not working.

Server Log

2025-10-21T23:34:00.563Z [auth] ERROR: Unknown error: ClientError: unexpected JWT claim value encountered
    at e (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:116:12)
    at errorHandler (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:141:23)
    at Module.authorizationCodeGrant (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:953:9)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async finishAuthFlow (file:///app/build/server/assets/server-build.js:611:17)
    ... 2 lines matching cause stack trace ...
    at async commonRoute.loader (file:///app/node_modules/.pnpm/react-router@7.8.1_react-dom@19.1.1_react@19.1.1__react@19.1.1/node_modules/react-router/dist/development/chunk-IFMMFE4R.mjs:658:19)
    at async file:///app/node_modules/.pnpm/react-router@7.8.1_react-dom@19.1.1_react@19.1.1__react@19.1.1/node_modules/react-router/dist/development/chunk-UH6JLGW7.mjs:4327:19
    at async callLoaderOrAction (file:///app/node_modules/.pnpm/react-router@7.8.1_react-dom@19.1.1_react@19.1.1__react@19.1.1/node_modules/react-router/dist/development/chunk-UH6JLGW7.mjs:4379:16) {
  code: 'OAUTH_JWT_CLAIM_COMPARISON_FAILED',
  [cause]: [OperationProcessingError]
}

Client Respond

{
  "code": 500,
  "error": {
    "name": "Internal Server Error",
    "description": "An unknown error occurred"
  }
}

config.yaml

oidc:
  issuer: "https://auth.example.app"
  client_id: ""
  client_secret: ""
  disable_api_key_login: true
  token_endpoint_auth_method: "client_secret_post"
  headscale_api_key: ""
  redirect_uri: "https://ts.example.app/admin/oidc/callback"

Headplane Version

0.6.1

Headscale Version

0.26.1

[tale]

Honestly, this entirely boils down to the library that I use for OIDC and I'm not pleased with it either, I'll push this off for 0.7.0 as I want to fix several issues with auth for it and expand automated authentication details.

[BobWs]

Same here after update Pocket-ID OIDC stopped working, I reverted back to 0.6.0 and I could login again!

[kronenpj]

I hate to hijack this problem thread but it is related, mostly ;).
@BobWs I've reverted back to 0.6.0 but my Pocket-ID OIDC connection still doesn't work. If you don't mind, please post a gist or response with your headplane config. Mine is here: https://gist.github.com/kronenpj/f6e2eec9d34898f52f68dbcde3739796

[tale]

I don't get this, I'm using a Pocket ID instance for testing my OIDC work when I develop locally. The only things I can think of is if you are using PKCE or not and if the token endpoint authentication method is set correctly.

[kronenpj]

I'm not using PKCE. The auth method is: "client_secret_post" (was basic)
The callback is https://example.com/admin/oidc/callback right?

With 0.6.0 I get:
{"code":"OAUTH_RESPONSE_BODY_ERROR","error":{"name":"Record not found"}}
0.6.1 and next (pulled 2025-11-27) instead gives this:
{"code":500,"error":{"name":"Internal Server Error","description":"An unknown error occurred"}}

0.6.0 doesn't log anything, and next logs this:
2025-11-27T22:43:13.981Z [auth] ERROR: Unknown error: ClientError: invalid response encountered
at e (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:116:12)
at errorHandler (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:139:23)
at Module.authorizationCodeGrant (file:///app/node_modules/.pnpm/openid-client@6.7.0/node_modules/openid-client/build/index.js:916:21)
at finishAuthFlow (file:///app/build/server/assets/server-build.js:611:30)
... 5 lines matching cause stack trace ...
at async callLoaderOrAction (file:///app/node_modules/.pnpm/react-router@7.8.1_react-dom@19.1.1_react@19.1.1__react@19.1.1/node_modules/react-router/dist/development/chunk-UH6JLGW7.mjs:4379:16) {
code: 'OAUTH_INVALID_RESPONSE',
[cause]: [OperationProcessingError]
}

If it matters, I've tried Firefox and Chromium. Everything is Linux of one flavor or another.

[kronenpj]

Ok, I got it working with 0.6.0 using client_secret_post.

[kronenpj]

@gunu3371 @BobWs
I identified the problem I was having. When headscale's issuer: URL contains a trailing slash the returning POST from Pocket-ID fails.

For the claim comparison problem, I'd suggest triple-checking the client_id and client_secret, and pkce (if you're using it) values correspond to the OIDC issuer's values for your application.

[tale]

Can you check if it works with v0.6.2-beta.2?