I am using zitadel as my OIDC provider. Currently I am trying to integrate mailcow into the setup. I am failing after being redirected back to mailcow:
After configuring the OIDC provider i tried to test the connection but it fails with this error message in the logs of my oidc provider:
time=2025-03-30T13:09:05.354Z level=WARN msg="request error" oidc_error.parent="auth request is missing client_id" oidc_error.description="auth request is missing client_id" oidc_error.type=invalid_request status_code=400
I did ignore this error because I thought it could be an issue with the testing button. But I am also not able to use the login afterwards. Sadly, I could not find any logs in the mailcow containers. These are the logs I got from my OIDC provider:
zitadel-1 | time="2025-03-30T13:03:18Z" level=info msg="log record emitted" caller="/home/runner/work/zitadel/zitadel/internal/logstore/emitters/stdout/stdout.go:19" record="{\"logDate\":\"2025-03-30T13:03:18.485836603Z\",\"protocol\":1,\"requestUrl\":\"/ui/login/userselection\",\"responseStatus\":302,\"requestHeaders\":{\"accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\"],\"accept-encoding\":[\"gzip, deflate, br, zstd\"],\"accept-language\":[\"de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7\"],\"cache-control\":[\"max-age=0\"],\"content-length\":[\"178\"],\"content-type\":[\"application/x-www-form-urlencoded\"],\"cookie\":[\"[REDACTED]\"],\"origin\":[\"https://XXXXX.REDACTED\"],\"priority\":[\"u=0, i\"],\"referer\":[\"https://XXXXX.REDACTED/ui/login/login?authRequestID=313471867123945475\"],\"sec-ch-ua\":[\"\\\"Chromium\\\";v=\\\"134\\\", \\\"Not:A-Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"134\\\"\"],\"sec-ch-ua-mobile\":[\"?0\"],\"sec-ch-ua-platform\":[\"\\\"macOS\\\"\"],\"sec-fetch-dest\":[\"document\"],\"sec-fetch-mode\":[\"navigate\"],\"sec-fetch-site\":[\"same-origin\"],\"sec-fetch-user\":[\"?1\"],\"upgrade-insecure-requests\":[\"1\"],\"user-agent\":[\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"],\"x-forwarded-for\":[\"24.40.179.50\"],\"x-forwarded-host\":[\"XXXXX.REDACTED\"],\"x-forwarded-port\":[\"443\"],\"x-forwarded-proto\":[\"https\"],\"x-forwarded-server\":[\"e104e1ba1d27\"],\"x-real-ip\":[\"24.40.179.50\"]},\"responseHeaders\":{\"cache-control\":[\"no-store\"],\"content-security-policy\":[\"media-src 'none';frame-ancestors 'none';font-src 'self';connect-src 'self';object-src 'self';style-src 'self' 'nonce-KF9rIU0lNvVMsTPOghS7HUF9oUH6KGe/qTKzjeo4h1Q=';img-src 'self';frame-src 'none';mani\"],\"expires\":[\"Sun, 30 Mar 2025 12:03:18 GMT\"],\"feature-policy\":[\"payment 'none'\"],\"location\":[\"https://XXXXX.REDACTED/oauth/v2/authorize/callback?id=313471867123945475\"],\"permissions-policy\":[\"payment=()\"],\"pragma\":[\"no-cache\"],\"referrer-policy\":[\"same-origin\"],\"set-cookie\":[\"[REDACTED]\"],\"strict-transport-security\":[\"max-age=31536000; includeSubDomains\"],\"vary\":[\"Cookie\"],\"x-content-type-options\":[\"nosniff\"],\"x-frame-options\":[\"DENY\"],\"x-robots-tag\":[\"none\"],\"x-xss-protection\":[\"1; mode=block\"]},\"instanceId\":\"273955232357027843\",\"projectId\":\"273955232357158915\",\"requestedDomain\":\"XXXXX.REDACTED\",\"requestedHost\":\"XXXXX.REDACTED\"}"
zitadel-1 | time="2025-03-30T13:03:19Z" level=info msg="log record emitted" caller="/home/runner/work/zitadel/zitadel/internal/logstore/emitters/stdout/stdout.go:19" record="{\"logDate\":\"2025-03-30T13:03:19.126665894Z\",\"protocol\":1,\"requestUrl\":\"/oauth/v2/authorize/callback?id=313471867123945475\",\"responseStatus\":302,\"requestHeaders\":{\"accept\":[\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7\"],\"accept-encoding\":[\"gzip, deflate, br, zstd\"],\"accept-language\":[\"de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7\"],\"cache-control\":[\"max-age=0\"],\"cookie\":[\"[REDACTED]\"],\"priority\":[\"u=0, i\"],\"referer\":[\"https://XXXXX.REDACTED/ui/login/login?authRequestID=313471867123945475\"],\"sec-ch-ua\":[\"\\\"Chromium\\\";v=\\\"134\\\", \\\"Not:A-Brand\\\";v=\\\"24\\\", \\\"Google Chrome\\\";v=\\\"134\\\"\"],\"sec-ch-ua-mobile\":[\"?0\"],\"sec-ch-ua-platform\":[\"\\\"macOS\\\"\"],\"sec-fetch-dest\":[\"document\"],\"sec-fetch-mode\":[\"navigate\"],\"sec-fetch-site\":[\"same-origin\"],\"sec-fetch-user\":[\"?1\"],\"upgrade-insecure-requests\":[\"1\"],\"user-agent\":[\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"],\"x-forwarded-for\":[\"24.40.179.50\"],\"x-forwarded-host\":[\"XXXXX.REDACTED\"],\"x-forwarded-port\":[\"443\"],\"x-forwarded-proto\":[\"https\"],\"x-forwarded-server\":[\"e104e1ba1d27\"],\"x-real-ip\":[\"24.40.179.50\"]},\"responseHeaders\":{\"cache-control\":[\"no-store\"],\"content-type\":[\"text/html; charset=utf-8\"],\"expires\":[\"Sun, 30 Mar 2025 12:03:19 GMT\"],\"location\":[\"https://mail.XXX.REDACTED?code=REDACTED_CODE"],\"pragma\":[\"no-cache\"],\"set-cookie\":[\"[REDACTED]\"],\"vary\":[\"Origin\",\"Cookie\"],\"x-robots-tag\":[\"none\"]},\"instanceId\":\"273955232357027843\",\"projectId\":\"273955232357158915\",\"requestedDomain\":\"XXXXX.REDACTED\",\"requestedHost\":\"XXXXX.REDACTED\"}"
zitadel-1 | time=2025-03-30T13:03:19.220Z level=WARN msg="request error" oidc_error.description="The scope of your request is missing. Please ensure some scopes are requested. If you have any questions, you may contact the administrator of the application." oidc_error.type=invalid_request status_code=400
zitadel-1 | time="2025-03-30T13:03:19Z" level=info msg="log record emitted" caller="/home/runner/work/zitadel/zitadel/internal/logstore/emitters/stdout/stdout.go:19" record="{\"logDate\":\"2025-03-30T13:03:19.221028813Z\",\"protocol\":1,\"requestUrl\":\"/oauth/v2/authorize\",\"responseStatus\":400,\"requestHeaders\":{\"accept-encoding\":[\"gzip\"],\"content-length\":[\"230\"],\"content-type\":[\"application/x-www-form-urlencoded\"],\"user-agent\":[\"GuzzleHttp/7\"],\"x-forwarded-for\":[\"172.19.0.1\"],\"x-forwarded-host\":[\"XXXXX.REDACTED\"],\"x-forwarded-port\":[\"443\"],\"x-forwarded-proto\":[\"https\"],\"x-forwarded-server\":[\"e104e1ba1d27\"],\"x-real-ip\":[\"172.19.0.1\"]},\"responseHeaders\":{\"cache-control\":[\"no-store\"],\"content-type\":[\"application/json\"],\"expires\":[\"Sun, 30 Mar 2025 12:03:19 GMT\"],\"pragma\":[\"no-cache\"],\"set-cookie\":[\"[REDACTED]\"],\"vary\":[\"Origin\",\"Cookie\"],\"x-robots-tag\":[\"none\"]},\"instanceId\":\"273955232357027843\",\"projectId\":\"273955232357158915\",\"requestedDomain\":\"XXXXX.REDACTED\",\"requestedHost\":\"XXXXX.REDACTED\"}"
What is striking is the message The scope of your request is missing. Please ensure some scopes are requested. If you have any questions, you may contact the administrator of the application.. Is there something wrong in the implementation of the generic OIDC-Provider? Where can I take a look to better see what is happening here?