OIDC - Third party login failure

[valentin8709]

Describe Your Issue

Hi,

First thank you for this amazing project ! I am using AdventureLog for a while, and I am just trying to set an Identity Provider (Authentik). I already have successful connection with other services, but not with AdventureLog.

I followed the instructions in the documentation. When I click "Continue with Authentik", the redirection works well, I can log in with my Authentik user, which is allowed to access AdventureLog. After successful Authentik connection, AdventureLog says "Third-party login failure".

I checked the logs but there is nothing, even with debug=True, except a 404 on a favicon (I do not know if it is related) .

I have pasted my docker compose configuration and here is the admin page of social account :

I am using Synology reverse proxy, therefore I needed to tweak it like mentionned here : https://mariushosting.com/synology-nginx-reverse-proxy-how-to-fix-502-bad-gateway-error/

I am using a self signed certificate for Authentik (portal.exemple.local in my pasted compose file), therefore I set it up inside AdventureLog with "REQUESTS_CA_BUNDLE" env variable.

Do I made something wrong ?

Thanks for your help =)

Docker Compose (Obfuscated)

services:
  app:
    image: ghcr.io/seanmorley15/adventurelog:latest
    container_name: adventurelog
    restart: unless-stopped
    environment:
      SITE_URL: https://wiki.exemple.local
      POSTGRES_PASSWORD: XXX
      PGHOST: db
      POSTGRES_DB: database
      POSTGRES_USER: adventure
      PORT: "3000"
      DJANGO_ADMIN_USERNAME: admin
      DJANGO_ADMIN_PASSWORD: XXX
      DJANGO_ADMIN_EMAIL: mail@provider.com
      DISABLE_REGISTRATION: True
      DISABLE_REGISTRATION_MESSAGE: La création de  nouveau compte est désactivée, merci de contacter jéjé
      SOCIALACCOUNT_ALLOW_SIGNUP: True
      ACCOUNT_EMAIL_VERIFICATION: none
      REQUESTS_CA_BUNDLE: /etc/ssl/certs/portal.crt
      CSRF_TRUSTED_ORIGINS: https://portal.exemple.local, https://wiki.exemple.local
      DEBUG: True
    ports:
      - "127.0.0.1:8082:80"
    volumes:
      - /volume1/docker/adventurelog/media/:/code/media/
      - /volume1/docker/adventurelog/certificates/:/etc/ssl/certs/
    depends_on:
      db:
        condition: service_healthy
    networks:
      - adventure-log
    mem_limit: 1024m
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "python3 -c \"import urllib.request; urllib.request.urlopen('http://127.0.0.1:80/health')\""
        ]
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 120s

  db:
    image: postgis/postgis:16-3.5
    container_name: adventurelog-db
    restart: unless-stopped
    environment:
      POSTGRES_DB: database
      POSTGRES_USER: adventure
      POSTGRES_PASSWORD: XXX
    volumes:
      - /volume1/docker/adventurelog/db/:/var/lib/postgresql/data/
    networks:
      - adventure-log
    mem_limit: 1024m
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U adventure -d database"]
      interval: 5s
      timeout: 5s
      retries: 5
      start_period: 10s

volumes:
  postgres_data:
  adventurelog_media:

networks:
  adventure-log:
    external: true

Logs / Error Output

adventurelog     | Running migrations:
adventurelog     |   No migrations to apply.
adventurelog     | Creating superuser...
adventurelog     | 45 objects imported automatically (use -v 2 for details).
adventurelog     | 
adventurelog     | 
adventurelog     | Superuser already exists.
adventurelog     | Running download-countries (first boot may take several minutes; ensure ~2GB RAM is available)...
adventurelog     | Latest data already imported.
adventurelog     |  █████╗ ██████╗ ██╗   ██╗███████╗███╗   ██╗████████╗██╗   ██╗██████╗ ███████╗██╗      ██████╗  ██████╗ 
adventurelog     | ██╔══██╗██╔══██╗██║   ██║██╔════╝████╗  ██║╚══██╔══╝██║   ██║██╔══██╗██╔════╝██║     ██╔═══██╗██╔════╝ 
adventurelog     | ███████║██║  ██║██║   ██║█████╗  ██╔██╗ ██║   ██║   ██║   ██║██████╔╝█████╗  ██║     ██║   ██║██║  ███╗
adventurelog     | ██╔══██║██║  ██║╚██╗ ██╔╝██╔══╝  ██║╚██╗██║   ██║   ██║   ██║██╔══██╗██╔══╝  ██║     ██║   ██║██║   ██║
adventurelog     | ██║  ██║██████╔╝ ╚████╔╝ ███████╗██║ ╚████║   ██║   ╚██████╔╝██║  ██║███████╗███████╗╚██████╔╝╚██████╔╝
adventurelog     | ╚═╝  ╚═╝╚═════╝   ╚═══╝  ╚══════╝╚═╝  ╚═══╝   ╚═╝    ╚═════╝ ╚═╝  ╚═╝╚══════╝╚══════╝ ╚═════╝  ╚═════╝ 
adventurelog     | “Go confidently in the direction of your dreams! Live the life you've imagined.” ― Henry David Thoreau
adventurelog     | 2026-08-21 07:38:07,263 CRIT Supervisor is running as root.  Privileges were not dropped because no user is specified in the config file.  If you intend to run as root, you can set user=root in the config file to avoid this message.
adventurelog     | 2026-08-21 07:38:07,266 INFO supervisord started with pid 1
adventurelog     | 2026-08-21 07:38:08,268 INFO spawned: 'cron' with pid 38
adventurelog     | 2026-08-21 07:38:08,269 INFO spawned: 'frontend' with pid 39
adventurelog     | 2026-08-21 07:38:08,270 INFO spawned: 'gunicorn' with pid 40
adventurelog     | 2026-08-21 07:38:08,271 INFO spawned: 'memcached' with pid 41
adventurelog     | 2026-08-21 07:38:08,273 INFO spawned: 'nginx' with pid 42
adventurelog     | [2026-08-21 07:38:08 +0000] [40] [INFO] Starting gunicorn 23.0.0
adventurelog     | [2026-08-21 07:38:08 +0000] [40] [INFO] Listening at: http://127.0.0.1:8000 (40)
adventurelog     | [2026-08-21 07:38:08 +0000] [40] [INFO] Using worker: sync
adventurelog     | [2026-08-21 07:38:09 +0000] [53] [INFO] Booting worker with pid: 53
adventurelog     | [2026-08-21 07:38:09 +0000] [54] [INFO] Booting worker with pid: 54
adventurelog     | 2026-08-21 07:38:09,325 INFO success: cron entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
adventurelog     | 2026-08-21 07:38:09,325 INFO success: frontend entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
adventurelog     | 2026-08-21 07:38:09,325 INFO success: gunicorn entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
adventurelog     | 2026-08-21 07:38:09,326 INFO success: memcached entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
adventurelog     | 2026-08-21 07:38:09,326 INFO success: nginx entered RUNNING state, process has stayed up for > than 1 seconds (startsecs)
adventurelog     | Listening on http://0.0.0.0:3000
adventurelog     | 
adventurelog     | [404] GET /favicon.ico

AdventureLog Version

latest

Reverse Proxy

Synology Reverse Proxy (nginx)

Confirmation

• I removed or obfuscated all sensitive data from this issue.

[valentin8709]

Seems correlated with #777. Maybe a bug and not a deployment problem ?
I may have missed something, but I checked many times and cannot find a problem with my configuration. I also configured many other OIDC services which work like a charm.

[chevy-type]

This fixed the issue for me after it started occurring right after updating authentik to the latest version.

The error happens because authentik includes a large amount of user data (such as a long list of group memberships, heavy custom claims, or user attributes) in the OIDC ID/Access token. As a result, the Authorization HTTP header exceeds the size limit (often 8KB–16KB) set by the web server or reverse proxy handling the request.

Here are the ways to resolve this:

1. Strip unnecessary claims from the token in authentik (Recommended)

By default, authentik often includes all user groups and claims in the profile or openid scope, which is unnecessary for services that only require basic user identification.

• Go to authentik Admin Panel > Customization > Property Mappings.
• Inspect the mappings assigned to your Provider (e.g., authentik default OAuth Mapping: OpenID 'profile').
• Ensure that large arrays (like groups) or heavy attributes (like base64 avatars) are not mapped to the ID/Access token for this specific provider. Alternatively, create a streamlined Property Mapping containing only essential attributes (sub, email, preferred_username).
• Under Applications > Providers > [Your Provider] > Advanced protocol settings, restrict the assigned mappings to only what is strictly needed.

[seanmorley15]

@valentin8709, does the solution above help fix the problem? Let me know, thanks!

[valentin8709]

@valentin8709, does the solution above help fix the problem? Let me know, thanks!

Thanks for the reply ! I cannot test it right now, I can do that tomorrow. I will let you know as soon as I tried it :)

[valentin8709]

Hi again @seanmorley15, I tested the configuration tips you gave me. Unfortunately the behavior remains the same. Here is my property mapping (I created a dedicated scope and mapped only this one to the AdventureLog provider). I did a copy paste from the default profile authentik default OAuth Mapping: OpenID 'profile' to avoid syntax error and removed groups and image.

return delete_none_values({
    "name": request.user.name,
    "given_name": ak_obj_attr(request.user, "given_name", "name"),
    "family_name": ak_obj_attr(request.user, "family_name"),
    "preferred_username": request.user.username,
    "nickname": request.user.username,
})

The logs remain the same (empty) and error message also (Third party login failure).

I upgraded Authentik to the last stable version.

Thank you for your time, I hope we will find something useful.

[valentin8709]

I started again from scratch, without any data or backup. I set up OIDC following the documentation and your advices. I have the same behavior than before but I now have a new log line :

Unauthorized: /auth/current-user/

Is it helpful ?

[valentin8709]

Also, I spot a little error in the documentation, there is a slash that needs to be removed here :

{
  "server_url": "http://<authentik_url>/application/o/[YOUR_SLUG]/"
}

Should be :

{
  "server_url": "http://<authentik_url>/application/o/[YOUR_SLUG]"
}