OIDC with Authelia

[wsw70]

I want to set up IODC with Authelia. It worked in the past, and now that I am completely moving to Blinko from scratch I cannot reproduce the SSO setup 😒 I get an error that does not say much about the underlying cause.

Has anyone documented their setup with Authelia?

Right now with the Authelia setup

- id: blinko
        description: blinko
        secret: $pbkdf2-XXX
        public: false
        authorization_policy: two_factor
        redirect_uris:
          - https://blinko.XXX/api/auth/callback/authelia
        grant_types:
          - authorization_code
        response_types:
          - code
        scopes:
          - openid
          - profile
          - email

I get the error in Blinko after the Authelia consent page:

blinko-1    | Custom OAuth provider authelia authentication route accessed
blinko-1    | authelia callback route accessed
blinko-1    | OAuth authentication error: TypeError: Cannot read properties of undefined (reading 'toString')
blinko-1    |     at d5 (/app/server/index.js:2921:20097)
blinko-1    |     at QJ._verify (/app/server/index.js:2921:25770)
blinko-1    |     at /app/server/index.js:60:77438
blinko-1    |     at QJ.userProfile (/app/server/index.js:60:78978)
blinko-1    |     at a (/app/server/index.js:60:79305)
blinko-1    |     at QJ._loadUserProfile (/app/server/index.js:60:79601)
blinko-1    |     at /app/server/index.js:60:77183
blinko-1    |     at /app/server/index.js:60:69765
blinko-1    |     at n (/app/server/index.js:60:68828)
blinko-1    |     at IncomingMessage.<anonymous> (/app/server/index.js:60:69031)

The Blinko configuration is:

[dosubot[bot]]

There isn't any documentation or prior discussion about setting up OIDC with Authelia for Blinko. The error you're seeing happens because Blinko expects the OIDC userinfo response to include a sub (subject) claim, which is required by the OIDC spec and mapped to profile.id in Blinko's code. If Authelia's /userinfo endpoint doesn't return sub, or it's null/undefined, Blinko will throw this error when it tries to call .toString() on it. Make sure your Authelia configuration and userinfo endpoint return a valid sub claim in the response for Blinko to work correctly with OIDC. You can see this expectation in the Blinko code handling custom OAuth providers and user profile mapping [source].

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[wsw70]

@dosu Authelia does include the sub claim in the /userinfo endpoint response

[dosubot[bot]]

Even if Authelia includes the sub claim in /userinfo, Blinko expects the response to be a flat JSON object with sub at the top level—no nesting or wrappers. If sub is present but nested (like { user: { sub: ... } }), or if the Blinko provider config is missing the wellKnown URL or it doesn't match the actual Authelia discovery endpoint, profile.id will be undefined and you'll get this error. Manual curl tests can be misleading because the actual OAuth flow may use different tokens or headers.

To troubleshoot, please check:

• That your Blinko provider config has the wellKnown URL set and it matches your Authelia .well-known/openid-configuration endpoint.
• The exact JSON payload Blinko receives from Authelia's /userinfo during the OAuth flow (not just from a manual curl). If possible, add a temporary log in Blinko's code where it fetches userinfo to print the full response.
• That sub is a string or number at the top level of the JSON.

If the response is flat and sub is present but the error persists, check for null/undefined or type issues. If sub is nested, you'll need to adjust Authelia or use a proxy to flatten the response. Blinko does not support custom claim mapping or nested structures for OIDC userinfo responses.
Reference

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[wsw70]

The solution was to use the well-known endpoint https://authelia.example.com/.well-known/openid-configuration