If using OIDC as security, API cannot be accesed using Authorization Bearer even after authenticating and getting and access token from OIDC

[aalmenar]

Describe the bug

I tried accesing the API, which works perfectly when using basic authentication but when using oidc as security its not possible.

What do you see?

• Requested a token on the token endpoint of the oidc to get an access token.
• Use this token as "Authentication: Bearer $token"
• Requesting /api/v1/config returns: {"oidc":true,"authenticated":false}
• Requesting /api/v1/enpoints/statuses returns: token is missing or invalid

From the code i can see that this authentication will never happen since this is looked up in sessions.Get which is gocache storage, but was never set the with sessions.SetWithTTL because the token was requested to the OIDC.

So from what i can think (Maybe im wrong) but these tokens should be verified against the OIDC and not try to look them up in local gocache sessions storage since they will never be found there.

What do you expect to see?

To have access to the API

List the steps that must be taken to reproduce this issue

No response

Version

Latest from Git and latest docker image as of this writing

Additional information

I case of API access this can be considered M2M usage so:

• Client Authentication – The machine authenticates using client credentials.
• Token Request – The client requests an access token from the OIDC provider.
• Token Response – The OIDC provider returns an access token (JWT).
• API Request – The client includes the token in API requests.
• API Authorization – The API verifies the token and processes the request.

Access token validation should be done using jwks using information in the jwks_uri found in the issuer-url + "/.well-known/openid-configuration", then that confirmation can be stored in gocache for fast access until expired.

[jasonjinchen]

Same issue

[TwiN]

Good catch, and to your point, API access when the status page is secured with oidc isn't documented AFAIK, so this is definitely a miss.

[alex2702]

Since v5.23.0, I'm seeing a blank page when opening Gatus. It seems like with the new UI, there's an initial request to /api/v1/endpoints/statuses?page=1&pageSize=100. That request results in a 401 and token is missing or invalid. I do have OIDC enabled, so I think the problem may be related to the problem mentioned in this issue? Is there a way to make that initial API call work, even with OIDC enabled? Thanks in advance!

[npenkov]

Just as a workaround, for those that need any kind of programatic access - extracting the session cookie from logged in browser session and providing the cookie works. (header Cookie: gatus_session=...)
I guess this can be automated with playwright.

[GriekseEi]

I was able to find a workaround for this issue by disabling OIDC in the Gatus configuration, and having an external service like Authelia or Authentik handle OIDC authentication for Gatus as middleware in a reverse proxy setup (using f.e. Traefik or Caddy). You may need to add an exception policy in your authentication middleware for the Gatus /api/ endpoints so they can be accessible without authentication tokens.