Authentik (OIDC)

SloweDE

Hey, ich glaube ich bin der erste der hier nachfragt allerdings versucht ich aktuell Authentik mit der neuen OIDC Funktion zum laufen zu bringen und ich kriege es nicht hin, obwohl man nicht so viel falsch machen kann… 😃

Hier meine einstellungen:
mailcow:
Authorization endpoint: https://authentik.domain.tld/application/o/authorize/
Token endpoint: https://authentik.domain.tld/application/o/token/
User info endpoint: https://authentik.domain.tld/application/o/userinfo/
Client ID: xxx
Client Secret: xxx
Redirect Url: https://mail.domain.tld
Client Scopes: openid profile email mailcow_template

Authentik:
Redirect URIs: strict: https://mail.domain.tld

übersehe ich etwas? Danke!

EDIT: Ich weiß nicht ob es wichtig ist, aber ich habe mailcow hinter einer reverse proxy laufen (NPM).

esackbauer

SloweDE übersehe ich etwas? Danke!

Ich habe mir nun Authentik erfolgreich installiert. War eigentlich sehr einfach, mit den gleichen Einstellungen die du auch gemacht hast. Die Einstellungen im Authentik analog zum Github Link von mir weiter oben.

Wichtig: Das SSO Login merkt sich der Browser, und wenn du z.b. als Authentik Admin eingeloggt bist, funktioniert der Mailcow SSO nicht. Das funktioniert ja nur mit einem User-Login.
Zum Testen daher immer Private/Inkognito Modus des Browsers verwenden.

esackbauer

Ich habe auch Authentik, komme aber momentan nicht dazu mailcow darauf umzustellen.
Als Vorbereitung habe ich das hier gefunden, vielleicht hilft das:
mailcow/mailcow-dockerized5445

Lipown

Well I have to translate this 🙂… it is not obvious. I spend 3 hours trying to solve this now and it finally working. Your email in Authentik must be on same domain you are using in Mailcow for mailboxes.
This is not what I wanted too, cause I wanted to use my gmail still in Authentik but whatever 🙂

SloweDE

Lipown Does the “Test connection” button work for you?

esackbauer

Lipown wanted to use my gmail still in Authentik

Well, you need to authenticate, and obviously that can only be done with the mailcow username (the mailbox address), because that is the identifier used.

Lipown

Yes it is working.

Lipown

esackbauer hmm 😃 not obvious to me obviously 😛.

I though it will be like in other apps I am using like Immich - that I will be simply able to connect Mailcow any account to OIDC any account.

krahlos

Hi all, I also try to integrate Authentik and Mailcow. In my setup Mailcow lives behind a Traefik reverse-proxy and my Authentik instance is currently not publicly available, only in my LAN/VPN, also via Traefik. Is this somehow similar to what you tried to setup? Or is your Authentik instance publicly available? Because I cannot successfully test the connection during the configuration in Mailcow’s admin UI 🙁

(If that helps: I can however properly use Authentik for my Nextcloud that also only is available inside my LAN/VPN).

SugaComa75

I have managed to set up authentik to work with mailcow and I get the correct redirects back and fourth , but when I return to mailcow I now have a 404 error as mailcow doesn’t recognise the redirect path

Am I missing something

esackbauer

SugaComa75
Please double check your configuration:
https://integrations.goauthentik.io/chat-communication-collaboration/mailcow/

SugaComa75

I have checked and made changes of every step, and it’s always the same … Any misaligned setting fails long before the redirect back to mailcow, if everything is set correctly it will redirect back to mailcow adding /auth/callback or /auth/login both of which are in my settings, but I get 404 error. I suspect this is more to do with npm (nginx proxy manager) than mailcow.

tompa

[“identity_provider”,“Invalid response received from Authorization Server. Expected JSON.”]

This is the message in Mailcow UI logs I get consistently when trying to login with Authentik Oauth2/OpenID to Mailcow and the login fails.

Setup is entirely self-hosted: fresh install of Mailcow 2025-09b, Authentik 2025.8.4 that works well with 15+ other OIDC-capable services and Nginx Proxy Manager in front of both. I have read and followed both the Authentik guide at https://integrations.goauthentik.io/chat-communication-collaboration/mailcow/ , the Mailcow guide at https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-generic-oidc/ and the thorough post at mailcow/mailcow-dockerized5445 - Nothing works and nothing helps–the error persists and it is not possible to login to Mailcow as a user via OIDC.

The mailbox is created in Mailcow beforehand, and has the same login email address as the user in Authentik. The mailbox has Generic-OIDC as identity provider. The Authentik configuration with provider and application is re-created at least 3 times now with the guides above. Re-installed Mailcow two times.

I fail to see that my problem is within the scope of the documented installation manuals. This has got to be something else, like Authentik sending the JWT in some unexpected format or something like that, this is what the error message kind of points at.

Any ideas? How can I troubleshoot this?
Mailcows logging is not very helpful here. A better log of the OIDC would be great.

esackbauer

tompa Any ideas? How can I troubleshoot this?

Have a look at the NPM logs. I doubt that is has to do with either Authentik or mailcow. Make sure that internal/external DNS resolution is working properly, that host header value is given etc.

tompa

esackbauer

Thanks. NPM logs are not helpful at all. But I installed an OpenID Connect debugger (leplusorg/openid-connect-provider-debugger) that seem to indicate that the JWT authentication cookie is not passed on from the browser to mailcow (tested multiple browsers, in private and non-private modes).

2025/10/06 15:01:54 [debug] 7#7: *73 [lua] default.conf:38):11: opening session 2025/10/06 15:01:54 [error] 7#7: *73 [lua] default.conf:38):9: session cookie is missing, client: 192.168.20.93, server: localhost, request: "GET /login?code=c8f32086354a4356ac46d9d204f9df69&state=939a50d09432078e25a718dfabebe738 HTTP/1.1", host: "192.168.30.10:9132"

So umm need to look into this. Weird thing is all other OIDC sites work with this instance of Authentik.

esackbauer

tompa that seem to indicate that the JWT authentication cookie is not passed on from the browser to mailcow

So still could be the reverse proxy.