Authelia OIDC fails

[dakky]

What are you trying to do?

I want to login via OIDC (authelia).

What's happening instead?

• click on login via authelia
• get redirected to authelia
• enter user/pw
• consent to scopes
• get redirected back to grimmory
• get an error:

grimmory   | 2026-07-11T12:30:56.913Z  INFO 1 --- [booklore-api] [cat-handler-197] o.b.controller.OidcAuthController        : OIDC callback received
grimmory   | 2026-07-11T12:30:57.015Z  INFO 1 --- [booklore-api] [cat-handler-197] o.b.c.s.oidc.OidcDiscoveryService        : Fetching OIDC discovery document from https://auth.domain.eu/.well-known/openid-configuration
grimmory   | 2026-07-11T12:30:57.455Z ERROR 1 --- [booklore-api] [cat-handler-197] o.b.c.security.oidc.OidcTokenClient      : OIDC token exchange failed: 401 Unauthorized on POST request for "https://auth.domain.eu/api/oidc/token": "{"error":"invalid_client","error_description":"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method."}"

Grimmory log:

grimmory   | 2026-07-11T12:30:57.455Z ERROR 1 --- [booklore-api] [cat-handler-197] o.b.c.security.oidc.OidcTokenClient      : OIDC token exchange failed: 401 Unauthorized on POST request for "https://auth.dakkar.eu/api/oidc/token": "{"error":"invalid_client","error_description":"Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'none', however the OAuth 2.0 client registration does not allow this method."}"

Your setup

• grimmory version: v3.2.4
• docker-compose setup

Authelia config:

      - client_id: grimmory
        client_name: Grimmory Digital Library
        client_secret: XXXXXXX
        authorization_policy: one_factor
        require_pkce: true
        pkce_challenge_method: S256
        redirect_uris: 
          - https://epub.domain.eu/oauth2-callback
        scopes:
          - openid
          - profile
          - email
          - groups
          - offline_access

Test in grimmory UI OIDC config is green

Anything else that might help?

No response

Before submitting

• I've searched existing discussions and I can't find anything that looks like my problem
• I've reviewed this report and have completed it as fully as I can

[dakky]

In my very limited OIDC knowledge: it seems grimmory tries to use the token endpoint without authentication, which is rejected because the client is not public. Looks a little bit like a bug on the grimmory side? i entered the clients credential in the OIDC config dialog, so it should use this instead of unauthenticated?

EDIT:
I digged in the database just to be sure, wether the oidc settings are stored correctly and everything looks fine:

MariaDB [grimmory]> select * from app_settings where name = 'oidc_provider_details';

| 27 | oidc_provider_details | {"providerName":"Authelia","clientId":"grimmory","issuerUri":"https://auth.domain.eu","scopes":"","claimMapping":{"email":"email","groups":"groups","name":"given_name","username":"preferred_username"},"clientSecret":"XXXXXXXXX"} |

[imnotjames]

What is authelia saying is wrong?

[dakky]

basically the same. The error message is passed through:

authelia  | time="2026-07-11T18:33:52+02:00" level=error msg="Access Request failed with error: Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method). The request was determined to be using 'token_endpoint_auth_method' method 'client_secret_post', however the OAuth 2.0 client registration does not allow this method. The registered client with id 'grimmory' is configured to only support 'token_endpoint_auth_method' method 'client_secret_basic'. Either the Authorization Server client registration will need to have the 'token_endpoint_auth_method' updated to 'client_secret_post' or the Relying Party will need to be configured to use 'client_secret_basic'." method=POST path=/api/oidc/token remote_ip=xx.xx.xx.xx

[imnotjames]

Does it work if you set token_endpoint_auth_method to client_secret_post per the error message?

[dakky]

narghs .. sooo simple ^^ Works

[imnotjames]

I'll add it to the troubleshooting docs