OIDC through PocketID not working #1976

lugaetsch · 2026-07-10T18:39:20Z

lugaetsch
Jul 10, 2026

What are you trying to do?

I am trying to set PocketID as Identity provider referring to this documentation.

What's happening instead?

Testing connection takes some time and quits with error:

Failed to fetch: I/O error on GET request for "https://<mypocketid-fqdn>/.well-known/openid-configuration": <mypocketid-fqdn>

Your setup

Grimmory 3.2.4 using docker compose and 11.4.12-MariaDB

Anything else that might help?

No response

Before submitting

I've searched existing discussions and I can't find anything that looks like my problem
I've reviewed this report and have completed it as fully as I can

imnotjames · 2026-07-11T15:39:08Z

imnotjames
Jul 11, 2026
Maintainer

Are you sure that the host grimmory is on is able to resolve and connect to that fqdn?

The error is saying there's a connection issue, as if it's just not responding to grimmory. I use pocket ID and don't have any issues.

9 replies

lugaetsch Aug 18, 2026
Author

/ # curl -v https://**identity.mydomain.com**
*   Trying **internal-ipv4**:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=**identity.mydomain.com**
*   start date: Jun 25 14:19:20 2026 GMT
*   expire date: Sep 23 14:19:19 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YE1
*   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   subjectAltName: "**identity.mydomain.com**" matches cert's "**identity.mydomain.com**"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to **identity.mydomain.com** (**internal-ipv4** port 443) from 172.28.2.19 port 45844 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://**identity.mydomain.com**/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: **identity.mydomain.com**]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.20.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: **identity.mydomain.com**
> User-Agent: curl/8.20.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200 
< server: openresty
< date: Wed, 22 Jul 2026 07:33:45 GMT
< content-type: text/html; charset=utf-8
< cache-control: no-store
< content-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'nonce-JATpQx85Eo3H3Uo_G_SwtQ'
< strict-transport-security: max-age=63072000;includeSubDomains; preload
< x-served-by: **identity.mydomain.com**
< 
<!doctype html>
<html lang="en">
	<head>
		<meta charset="utf-8" />
		<link rel="icon" href="/api/application-images/favicon" />
		<meta name="viewport" content="width=device-width, initial-scale=1" />
		<meta name="robots" content="noindex" />
		<link rel="manifest" href="/app.webmanifest" />
		<link rel="apple-touch-icon" href="/img/static-logo-512.png" />
		<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
			try {
				const mode = localStorage.getItem('mode-watcher-mode') || 'system';
				const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
				const isDark = mode === 'dark' || (mode === 'system' && prefersDark);

				document.documentElement.classList.toggle('dark', isDark);
				document.documentElement.style.colorScheme = isDark ? 'dark' : 'light';
			} catch (e) {
				// Ignore errors
				// Failing to set theme is not critical
			}
		</script>
		<link href="/_app/immutable/entry/start.C4dXYu8S.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgjH3msT.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CLqYLFDj.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BoIkBPpp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/QTnfLwEv.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BuFlayix.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CrC2tZJ4.js" rel="modulepreload">
		<link href="/_app/immutable/entry/app.DqhvKVbQ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CMTIK0oR.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
		<link href="/_app/immutable/nodes/0.C012qTZL.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/C9Qs7Rn0.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BYjywXRr.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CnCigMON.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CUNAhPq82.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/O__ttASs2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dh43UnsB2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dsb4PQ_H2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Bin8K3vy2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DanAjbov2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BqqKZegW2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D64VnKXo2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/cRCXm2yY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/OM6VPwy-2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/5fHtOLCe2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DB4ZMZxa2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DsjqUxlH2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BCL1Gbzd.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Brh_3NOZ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/EafYEKaP.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BgVanDkA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D3NmB03j.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtS4dH-t.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B9fo--o7.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CdqyqbDM.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CpCQ7sLp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgriSw0U.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/yN9GdbUi.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BpMsIHft.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BkE_dVEB.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BhCB6Ttv2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dc60Ib_2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/2HIFI3iG2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/GTU3dSbY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B4CoKnmJ2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CC1Cw1zS2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BlK4W5sK2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DQH-lnlD2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BEbLV3Ne.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dfhg6-MA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D2Z0Zq9k2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtOoGSwS2.js" rel="modulepreload">
		
		<link href="/_app/immutable/assets/0.D1SqCj3i.css" rel="stylesheet">
	</head>
	<body data-sveltekit-preload-data="hover">
		<div style="display: contents">
			<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
				{
					__sveltekit_1qbk3qf = {
						base: ""
					};

					const element = document.currentScript.parentElement;

					Promise.all([
						import("/_app/immutable/entry/start.C4dXYu8S.js"),
						import("/_app/immutable/entry/app.DqhvKVbQ.js")
					]).then(([kit, app]) => {
						kit.start(app, element);
					});
				}
			</script>
		</div>
	</body>
</html>
* Connection #0 to host **identity.mydomain.com**:443 left intact
´´´´

lugaetsch Aug 18, 2026
Author

error message in grimmory after "saving":

Discovery Document Failed to fetch: I/O error on GET request for "https://identity.mydomain.com/.well-known/openid-configuration/.well-known/openid-configuration": identity.mydomain.com

imnotjames Aug 19, 2026
Maintainer

That's the full failure stack trace?

imnotjames Aug 19, 2026
Maintainer

/ # curl -v https://**identity.mydomain.com**
*   Trying **internal-ipv4**:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=**identity.mydomain.com**
*   start date: Jun 25 14:19:20 2026 GMT
*   expire date: Sep 23 14:19:19 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YE1
*   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   subjectAltName: "**identity.mydomain.com**" matches cert's "**identity.mydomain.com**"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to **identity.mydomain.com** (**internal-ipv4** port 443) from 172.28.2.19 port 45844 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://**identity.mydomain.com**/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: **identity.mydomain.com**]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.20.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: **identity.mydomain.com**
> User-Agent: curl/8.20.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200 
< server: openresty
< date: Wed, 22 Jul 2026 07:33:45 GMT
< content-type: text/html; charset=utf-8
< cache-control: no-store
< content-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'nonce-JATpQx85Eo3H3Uo_G_SwtQ'
< strict-transport-security: max-age=63072000;includeSubDomains; preload
< x-served-by: **identity.mydomain.com**
< 
<!doctype html>
<html lang="en">
	<head>
		<meta charset="utf-8" />
		<link rel="icon" href="/api/application-images/favicon" />
		<meta name="viewport" content="width=device-width, initial-scale=1" />
		<meta name="robots" content="noindex" />
		<link rel="manifest" href="/app.webmanifest" />
		<link rel="apple-touch-icon" href="/img/static-logo-512.png" />
		<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
			try {
				const mode = localStorage.getItem('mode-watcher-mode') || 'system';
				const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
				const isDark = mode === 'dark' || (mode === 'system' && prefersDark);

				document.documentElement.classList.toggle('dark', isDark);
				document.documentElement.style.colorScheme = isDark ? 'dark' : 'light';
			} catch (e) {
				// Ignore errors
				// Failing to set theme is not critical
			}
		</script>
		<link href="/_app/immutable/entry/start.C4dXYu8S.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgjH3msT.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CLqYLFDj.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BoIkBPpp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/QTnfLwEv.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BuFlayix.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CrC2tZJ4.js" rel="modulepreload">
		<link href="/_app/immutable/entry/app.DqhvKVbQ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CMTIK0oR.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
		<link href="/_app/immutable/nodes/0.C012qTZL.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/C9Qs7Rn0.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BYjywXRr.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CnCigMON.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CUNAhPq82.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/O__ttASs2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dh43UnsB2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dsb4PQ_H2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Bin8K3vy2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DanAjbov2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BqqKZegW2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D64VnKXo2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/cRCXm2yY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/OM6VPwy-2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/5fHtOLCe2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DB4ZMZxa2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DsjqUxlH2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BCL1Gbzd.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Brh_3NOZ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/EafYEKaP.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BgVanDkA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D3NmB03j.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtS4dH-t.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B9fo--o7.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CdqyqbDM.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CpCQ7sLp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgriSw0U.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/yN9GdbUi.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BpMsIHft.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BkE_dVEB.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BhCB6Ttv2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dc60Ib_2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/2HIFI3iG2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/GTU3dSbY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B4CoKnmJ2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CC1Cw1zS2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BlK4W5sK2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DQH-lnlD2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BEbLV3Ne.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dfhg6-MA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D2Z0Zq9k2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtOoGSwS2.js" rel="modulepreload">
		
		<link href="/_app/immutable/assets/0.D1SqCj3i.css" rel="stylesheet">
	</head>
	<body data-sveltekit-preload-data="hover">
		<div style="display: contents">
			<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
				{
					__sveltekit_1qbk3qf = {
						base: ""
					};

					const element = document.currentScript.parentElement;

					Promise.all([
						import("/_app/immutable/entry/start.C4dXYu8S.js"),
						import("/_app/immutable/entry/app.DqhvKVbQ.js")
					]).then(([kit, app]) => {
						kit.start(app, element);
					});
				}
			</script>
		</div>
	</body>
</html>
* Connection #0 to host **identity.mydomain.com**:443 left intact
´´´´

That does not look like the openid configuration. If that's the output of curl -v https://<mypocketid-fqdn>/.well-known/openid-configuration then something is wrong with the configuration of your pocketid instance.

lugaetsch Aug 25, 2026
Author

pardon, here is the right output:

/ # curl -v https://identity.mydomain.com/.well-known/openid-configuration
*   Trying 192.168.30.13:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=identity.mydomain.com
*   start date: Aug 24 11:45:16 2026 GMT
*   expire date: Nov 22 11:45:15 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YE2
*   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   subjectAltName: "identity.mydomain.com" matches cert's "identity.mydomain.com"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to identity.mydomain.com (192.168.30.13 port 443) from 172.28.2.19 port 58898 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://identity.mydomain.com/.well-known/openid-configuration
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: identity.mydomain.com]
* [HTTP/2] [1] [:path: /.well-known/openid-configuration]
* [HTTP/2] [1] [user-agent: curl/8.21.0]
* [HTTP/2] [1] [accept: */*]
> GET /.well-known/openid-configuration HTTP/2
> Host: identity.mydomain.com
> User-Agent: curl/8.21.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200 
< server: openresty
< date: Tue, 25 Aug 2026 17:58:52 GMT
< content-type: application/json; charset=utf-8
< content-length: 1807
< access-control-allow-headers: Authorization
< access-control-allow-methods: GET, POST
< access-control-allow-origin: *
< cache-control: private, no-store
< content-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'nonce-lkvFx_7OIQdPi7p5JGNAEg'
< x-request-id: 43fe41fa-2196-468f-9703-c780db9b707a
< strict-transport-security: max-age=63072000;includeSubDomains; preload
< x-served-by: identity.mydomain.com
< 
{"authorization_endpoint":"https://identity.mydomain.com/authorize","authorization_response_iss_parameter_supported":true,"claims_supported":["sub","given_name","family_name","name","display_name","email","email_verified","preferred_username","picture","groups","auth_time","amr"],"client_id_metadata_document_supported":false,"code_challenge_methods_supported":["plain","S256"],"device_authorization_endpoint":"https://identity.mydomain.com/api/oidc/device/authorize","end_session_endpoint":"https://identity.mydomain.com/api/oidc/end-session","grant_types_supported":["authorization_code","refresh_token","urn:ietf:params:oauth:grant-type:device_code","client_credentials"],"id_token_signing_alg_values_supported":["RS256"],"introspection_endpoint":"https://identity.mydomain.com/api/oidc/introspect","introspection_endpoint_auth_methods_supported":["client_secret_basic","Bearer"],"issuer":"https://identity.mydomain.com","jwks_uri":"https://identity.mydomain.com/.well-known/jwks.json","prompt_values_supported":["none","login","consent","select_account"],"pushed_authorization_request_endpoint":"https://identity.mydomain.com/api/oidc/par","request_object_signing_alg_values_supported":["none"],"request_parameter_supported":true,"request_uri_parameter_supported":false,"require_pushed_authorization_requests":false,"response_modes_supported":["query","fragment","form_post"],"response_types_supported":["code"],"scopes_supported":["openid","profile","email","groups","offline_access"],"service_documentation":"https://pocket-id.org/docs","subject_types_supported":["public"],"token_endpoint":"https://identity.mydomain.com/api/oidc/token","token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"userinfo_endpoint":"https://identity.mydomain.com/api/oidc/userinfo"}* Connection #0 to host identity.mydomain.com:443 left intact

lugaetsch · 2026-07-22T07:39:16Z

lugaetsch
Jul 22, 2026
Author

This is what curl throws, seems to work using curl from inside the container itself...
I masked my Pocket-ID fqdn and corresponding internal ipv4

/ # curl -v https://**identity.mydomain.com**
*   Trying **internal-ipv4**:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
*   CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / X25519MLKEM768 / id-ecPublicKey
* ALPN: server accepted h2
* Server certificate:
*   subject: CN=**identity.mydomain.com**
*   start date: Jun 25 14:19:20 2026 GMT
*   expire date: Sep 23 14:19:19 2026 GMT
*   issuer: C=US; O=Let's Encrypt; CN=YE1
*   Certificate level 0: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 1: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 2: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   Certificate level 3: Public key type EC/secp384r1 (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*   subjectAltName: "**identity.mydomain.com**" matches cert's "**identity.mydomain.com**"
* OpenSSL verify result: 0
* SSL certificate verified via OpenSSL.
* Established connection to **identity.mydomain.com** (**internal-ipv4** port 443) from 172.28.2.19 port 45844 
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://**identity.mydomain.com**/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: **identity.mydomain.com**]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.20.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: **identity.mydomain.com**
> User-Agent: curl/8.20.0
> Accept: */*
> 
* Request completely sent off
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
< HTTP/2 200 
< server: openresty
< date: Wed, 22 Jul 2026 07:33:45 GMT
< content-type: text/html; charset=utf-8
< cache-control: no-store
< content-security-policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src * blob:;font-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'nonce-JATpQx85Eo3H3Uo_G_SwtQ'
< strict-transport-security: max-age=63072000;includeSubDomains; preload
< x-served-by: **identity.mydomain.com**
< 
<!doctype html>
<html lang="en">
	<head>
		<meta charset="utf-8" />
		<link rel="icon" href="/api/application-images/favicon" />
		<meta name="viewport" content="width=device-width, initial-scale=1" />
		<meta name="robots" content="noindex" />
		<link rel="manifest" href="/app.webmanifest" />
		<link rel="apple-touch-icon" href="/img/static-logo-512.png" />
		<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
			try {
				const mode = localStorage.getItem('mode-watcher-mode') || 'system';
				const prefersDark = window.matchMedia('(prefers-color-scheme: dark)').matches;
				const isDark = mode === 'dark' || (mode === 'system' && prefersDark);

				document.documentElement.classList.toggle('dark', isDark);
				document.documentElement.style.colorScheme = isDark ? 'dark' : 'light';
			} catch (e) {
				// Ignore errors
				// Failing to set theme is not critical
			}
		</script>
		<link href="/_app/immutable/entry/start.C4dXYu8S.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgjH3msT.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CLqYLFDj.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BoIkBPpp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/QTnfLwEv.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BuFlayix.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CrC2tZJ4.js" rel="modulepreload">
		<link href="/_app/immutable/entry/app.DqhvKVbQ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CMTIK0oR.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/xihTtKlq.js" rel="modulepreload">
		<link href="/_app/immutable/nodes/0.C012qTZL.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/C9Qs7Rn0.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BYjywXRr.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CnCigMON.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CUNAhPq82.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/O__ttASs2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dh43UnsB2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dsb4PQ_H2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Bin8K3vy2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DanAjbov2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BqqKZegW2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D64VnKXo2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/cRCXm2yY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/OM6VPwy-2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/5fHtOLCe2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DB4ZMZxa2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DsjqUxlH2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BCL1Gbzd.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Brh_3NOZ.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/EafYEKaP.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BgVanDkA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D3NmB03j.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtS4dH-t.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B9fo--o7.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CdqyqbDM.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CpCQ7sLp.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DgriSw0U.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/yN9GdbUi.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BpMsIHft.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BkE_dVEB.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BhCB6Ttv2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dc60Ib_2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/2HIFI3iG2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/GTU3dSbY2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/B4CoKnmJ2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/CC1Cw1zS2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BlK4W5sK2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DQH-lnlD2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/BEbLV3Ne.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/Dfhg6-MA2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/D2Z0Zq9k2.js" rel="modulepreload">
		<link href="/_app/immutable/chunks/DtOoGSwS2.js" rel="modulepreload">
		
		<link href="/_app/immutable/assets/0.D1SqCj3i.css" rel="stylesheet">
	</head>
	<body data-sveltekit-preload-data="hover">
		<div style="display: contents">
			<script nonce="JATpQx85Eo3H3Uo_G_SwtQ">
				{
					__sveltekit_1qbk3qf = {
						base: ""
					};

					const element = document.currentScript.parentElement;

					Promise.all([
						import("/_app/immutable/entry/start.C4dXYu8S.js"),
						import("/_app/immutable/entry/app.DqhvKVbQ.js")
					]).then(([kit, app]) => {
						kit.start(app, element);
					});
				}
			</script>
		</div>
	</body>
</html>
* Connection #0 to host **identity.mydomain.com**:443 left intact

3 replies

lugaetsch Aug 1, 2026
Author

Is there any one who can facecheck this?

f0ff886f Aug 13, 2026

Completely random check, but are you running OpenWRT as your home router? There is a long-standing open bug affecting DNS resolution especially in containers that requires a workaround.

PR: openwrt/openwrt#19190
Workaround: https://forum.openwrt.org/t/bizarre-dns-problems-with-debian-linux-after-upgrade-to-24-10/225860/29

Its a long shot, but it broke many containers' OIDC w/ PocketID for me.

lugaetsch Aug 18, 2026
Author

no OpenWRT here, but thanks for the hint!

Grimmory

OIDC through PocketID not working #1976

Uh oh!

lugaetsch Jul 10, 2026

What are you trying to do?

What's happening instead?

Your setup

Anything else that might help?

Before submitting

Replies: 2 comments · 12 replies

Uh oh!

Uh oh!

imnotjames Jul 11, 2026 Maintainer

Uh oh!

Uh oh!

lugaetsch Aug 18, 2026 Author

Uh oh!

lugaetsch Aug 18, 2026 Author

Uh oh!

imnotjames Aug 19, 2026 Maintainer

Uh oh!

Uh oh!

imnotjames Aug 19, 2026 Maintainer

Uh oh!

lugaetsch Aug 25, 2026 Author

Uh oh!

Uh oh!

lugaetsch Jul 22, 2026 Author

Uh oh!

lugaetsch Aug 1, 2026 Author

Uh oh!

f0ff886f Aug 13, 2026

Uh oh!

lugaetsch Aug 18, 2026 Author

lugaetsch
Jul 10, 2026

Replies: 2 comments 12 replies

imnotjames
Jul 11, 2026
Maintainer

lugaetsch Aug 18, 2026
Author

lugaetsch Aug 18, 2026
Author

imnotjames Aug 19, 2026
Maintainer

imnotjames Aug 19, 2026
Maintainer

lugaetsch Aug 25, 2026
Author

lugaetsch
Jul 22, 2026
Author

lugaetsch Aug 1, 2026
Author

lugaetsch Aug 18, 2026
Author