[Bug]: OpenID authentication loop when logged-in as an user without privileges #949

New issue

Open

opened 2025-10-14 18:09:12 -06:00 by navan · 0 comments

navan commented

2025-10-14 18:09:12 -06:00

Owner

Originally created by @jelinj8 on 11/26/2024

What happened?

Hello, I've managed with some hiccups to make authentication work together with Keycloak, including assigning of guest/user/admin privileges and password validation in LDAP (shared with Booksonic and several other LDAP-only apps). Maybe I'll write some guide for that later.

Only major problem I have with the setup right now is that when I log in as a valid user that has no relevant role I get just "Unauthorized" error message on login page (that would be OK), but only with the button to go to authenticator again, which redirects me directly back to Audiobookshelf login page (as I'm already logged in) and there is no way out of this loop (except session timeout or admin session termination in authentication provider).

What did you expect to happen?

Maybe a bit more specific message and a button like "logout and try as another user" would be much more intuitive for non-IT-admin crowd.

Steps to reproduce the issue

create an user in OID system, that has none of supported roles
login as this user - you won't be able (as an ordinary user) to logout (OID redirects you directly back to "unauthorized" login page.

Audiobookshelf version

2.17.2

How are you running audiobookshelf?

Docker

What OS is your Audiobookshelf server hosted from?

Linux

If the issue is being seen in the UI, what browsers are you seeing the problem on?

Firefox

Logs

Logs aren't relevant here.

Additional Notes

To get out I have to kill the session from Keycloak admin or clear session cookies.

*Originally created by @jelinj8 on 11/26/2024* ### What happened? Hello, I've managed with some hiccups to make authentication work together with Keycloak, including assigning of guest/user/admin privileges and password validation in LDAP (shared with Booksonic and several other LDAP-only apps). Maybe I'll write some guide for that later. Only major problem I have with the setup right now is that when I log in as a valid user that has no relevant role I get just "Unauthorized" error message on login page (that would be OK), but only with the button to go to authenticator again, which redirects me directly back to Audiobookshelf login page (as I'm already logged in) and there is no way out of this loop (except session timeout or admin session termination in authentication provider). ![obrazek](https://github.com/user-attachments/assets/1daddf00-eb7e-4d9e-b454-57be2a478bee) ### What did you expect to happen? Maybe a bit more specific message and a button like "logout and try as another user" would be much more intuitive for non-IT-admin crowd. ### Steps to reproduce the issue 1. create an user in OID system, that has none of supported roles 2. login as this user - you won't be able (as an ordinary user) to logout (OID redirects you directly back to "unauthorized" login page. ### Audiobookshelf version 2.17.2 ### How are you running audiobookshelf? Docker ### What OS is your Audiobookshelf server hosted from? Linux ### If the issue is being seen in the UI, what browsers are you seeing the problem on? Firefox ### Logs ```shell Logs aren't relevant here. ``` ### Additional Notes To get out I have to kill the session from Keycloak admin or clear session cookies.