OIDC Keycloak login results in /oauth/openid/undefined 404 not found #10483
-
What happened?After clicking the OIDC login button and login in, I always get redirect to Version InformationI am using kubernetes v1.31.6+rke2r1 (with containerd 2.0) with the latest helm chart+values as of today (librechat v0.8.1-rc1) . I dont have a special librechat config file. Steps to ReproduceHi and thanks for your work! I tried the helm chart (for the values.yaml see below) and got almost everything running but I cant get the keycloak OIDC login to work properly. After clicking the OIDC login button, I always get redirect to {
"timestamp": "2025-11-13T13:40:08.035Z",
"browser": {
"userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
"platform": "Linux",
"platformVersion": "6.17.7",
"language": "en-US",
"windowSize": "842x1309"
},
"error": {
"message": "An unexpected error occurred",
"status": 404,
"statusText": "Not Found",
"data": "Error: No route matches URL \"/oauth/openid/undefined\""
}
}However, if I delete the When looking at the librechat logs, I can see an issue with the I have set the following librechat-credentials-env as a secret and can see the ENV being correctly set within the librechat container: OPENID_SCOPE: openid profile email
JWT_REFRESH_SECRET: -
OPENAI_API_KEY: -
OPENID_SESSION_SECRET: -
CREDS_IV: -
OPENID_CLIENT_ID: oidc-client-id
JWT_SECRET: -
MEILI_MASTER_KEY: -
OPENID_CLIENT_SECRET: -
CREDS_KEY: -
OPENID_CALLBACK_URL: /oauth/openid/callback
OPENID_ISSUER: https://domain.com/auth/realms/realm1I used the following used values.yaml for the helm chart: librechat:
configEnv:
PLUGIN_MODELS: gpt-4o-mini
OPENAI_MODELS: gpt-4o-mini
ALLOW_EMAIL_LOGIN: "false"
ALLOW_REGISTRATION: "false"
ALLOW_SOCIAL_LOGIN: "true"
ALLOW_SOCIAL_REGISTRATION: "false"
DOMAIN_SERVER: "https://domain.com"
CLIENT_SERVER: "https://domain.com"
OPENID_ENABLED: "true"
#OPENID_AUTO_REDIRECT: "true"
OPENID_BUTTON_LABEL: "LOGIN"
#DEBUG_OPENID_REQUESTS: "true"
OPENID_SCOPE: "openid profile email"
existingSecretName: "librechat-credentials-env"
# For adding a custom config yaml-file you can set the contents in this var. See https://www.librechat.ai/docs/configuration/librechat_yaml/example
configYamlContent: |
version: 1.3.1
cache: true
interface:
privacyPolicy:
externalUrl: 'https://librechat.ai/privacy-policy'
openNewTab: true
termsOfService:
externalUrl: 'https://librechat.ai/tos'
openNewTab: true
# name of existing Yaml configmap, key must be librechat.yaml
existingConfigYaml: ""
image:
repository: danny-avila/librechat
registry: ghcr.io
pullPolicy: IfNotPresent
# Overrides the image tag whose default is the chart appVersion.
tag: "v0.8.1-rc1"
ingress:
enabled: true
className: ""
annotations:
# kubernetes.io/ingress.class: nginx
# kubernetes.io/tls-acme: "true"
cert-manager.io/cluster-issuer: prod-acme-cissuer
hosts:
- host: domain.com
paths:
- path: /
pathType: ImplementationSpecific
tls:
- hosts:
- domain.com
secretName: domain.com-ingress-tls (I have ommited imho unrelated info in the values.yaml) I can use the OIDC Login button (which points to domain.com/oauth/openid) as well the Keycloak login flow afterwards when clicking it. After the successful auth (otherwise I couldnt just ignore the 404 undefined message), I get the above error but if I ignore the error and go to the baseURL, I can use librechat normally and as expected. Maybe I am missing something obvious or have something missconfigured? The keycloak I use is also providing OIDC for about 10 other services, which are working fine. I couldnt figure out, where or what exactly triggers the What browsers are you seeing the problem on?Chrome, Firefox Relevant log outputrelevant logs for librechat when starting it up and logging in with a user over OIDC:
> [email protected] backend
> cross-env NODE_ENV=production node api/server/index.js
2025-11-13 13:30:44 info: Mongo Connection options
2025-11-13 13:30:44 info: {
"bufferCommands": false
}
2025-11-13 13:30:44 info: Connected to MongoDB
2025-11-13 13:30:44 info: [getAppConfig] App configuration not initialized. Initializing AppService...
2025-11-13 13:30:44 info: Custom config file loaded:
2025-11-13 13:30:44 info: {
"version": "1.3.1",
"cache": true,
"interface": {
"privacyPolicy": {
"externalUrl": "https://librechat.ai/privacy-policy",
"openNewTab": true
},
"termsOfService": {
"externalUrl": "https://librechat.ai/tos",
"openNewTab": true
}
}
}
2025-11-13 13:30:44 warn: RAG API is either not running or not reachable at undefined, you may experience errors with file uploads.
2025-11-13 13:30:44 info: Configuring social logins...
2025-11-13 13:30:44 info: Configuring OpenID Connect...
2025-11-13 13:30:44 info: [openidStrategy] OpenID authentication configuration
2025-11-13 13:30:44 info: OpenID Connect configured successfully.
2025-11-13 13:30:44 info: Server listening on all interfaces at port 3080. Use http://localhost:3080 to access it
2025-11-13 13:30:44 info: OAuth reconnect manager initialized successfully.
2025-11-13 13:36:04 info: [openidStrategy] login success openidId: b4c9a830-e9b3-4808-8b35-385785594121 | email: [email protected] | username: [email protected]
2025-11-13 13:40:43 warn: [OAuthReconnectionManager] MCPManager not available, skipping OAuth MCP server reconnection
2025-11-13 13:40:43 error: Failed to load service key from file: /app/api/data/auth.json ENOENT: no such file or directory, stat '/app/api/data/auth.json'
2025-11-13 13:43:18 warn: [OAuthReconnectionManager] MCPManager not available, skipping OAuth MCP server reconnection
2025-11-13 13:43:49 info: [openidStrategy] login success openidId: b4c9a830-e9b3-4808-8b35-385785594121 | email: [email protected] | username: [email protected]
When logging in, I can see a (chromium) console error in the browser, but not sure if related:
workbox-4c320e2c.js:1 Uncaught (in promise) non-precached-url: non-precached-url :: [{"url":"index.html"}]
at O.createHandlerBoundToURL (workbox-4c320e2c.js:1:13245)
at Object.createHandlerBoundToURL (workbox-4c320e2c.js:1:14916)
at sw.js:1:2796
at sw.js:1:565
createHandlerBoundToURL @ workbox-4c320e2c.js:1
(anonymous) @ workbox-4c320e2c.js:1
(anonymous) @ sw.js:1
(anonymous) @ sw.js:1More verbose librechat logs while logging in: ScreenshotsNo response Code of Conduct
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
check these environment variables: DOMAIN_CLIENT=
DOMAIN_SERVER= |
Beta Was this translation helpful? Give feedback.
-
|
|
Beta Was this translation helpful? Give feedback.
-
|
Yes, that was it. Thanks for the fast reaction and sorry for bothering you because of a typo^^ |
Beta Was this translation helpful? Give feedback.
CLIENT_SERVERis not a valid variable