starred/karakeep

Fork 0

mirror of https://github.com/karakeep-app/karakeep.git synced 2026-04-25 07:56:05 +03:00

[GH-ISSUE #2333] id_token not present in TokenSet with Gitea Oauth2 Provider #1414

New issue

Open

opened 2026-03-02 11:57:09 +03:00 by kerem · 1 comment

kerem commented

2026-03-02 11:57:09 +03:00

Owner

Originally created by @nerdware-timmmi on GitHub (Jan 2, 2026).
Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/2333

Describe the Bug

Hello,

I am attempting to use Gitea as an OAuth2 provider but encountering issues with the following configured environment variables:

OAUTH_WELLKNOWN_URL: https://example.example.de/.well-known/openid-configuration
OAUTH_CLIENT_ID:  <secret>
OAUTH_CLIENT_SECRET:  <secret>
OAUTH_PROVIDER_NAME: gitea
OAUTH_SCOPE: openid email profile groups
OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: true

When attempting to sign in with Gitea, I receive the following error:

[next-auth][error][OAUTH_CALLBACK_ERROR]
https://next-auth.js.org/errors#oauth_callback_error id_token not present in TokenSet {
  error: Error [OAuthCallbackError]: id_token not present in TokenSet
      at X.validateIdToken (.next/server/chunks/2992.js:36:6640)
      at X.callback (.next/server/chunks/2992.js:36:3008)
      at async c (.next/server/chunks/2992.js:80:219233)
      at async Object.l (.next/server/chunks/2992.js:80:264160)
      at async g (.next/server/chunks/2992.js:80:50417)
      at async a (.next/server/chunks/2992.js:80:209061)
      at async e.length.t (.next/server/chunks/2992.js:80:210504) {
    code: undefined
  },
  providerId: 'custom',
  message: 'id_token not present in TokenSet'
}

The OpenID configuration endpoint returns the following response:

{
    "issuer": "https://example.example.de/",
    "authorization_endpoint": "https://example.example.de/login/oauth/authorize",
    "token_endpoint": "https://example.example.de/login/oauth/access_token",
    "jwks_uri": "https://example.example.de/login/oauth/keys",
    "userinfo_endpoint": "https://example.example.de/login/oauth/userinfo",
    "introspection_endpoint": "https://example.example.de/login/oauth/introspect",
    "response_types_supported": [
        "code",
        "id_token"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "subject_types_supported": [
        "public"
    ],
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "groups"
    ],
    "claims_supported": [
        "aud",
        "exp",
        "iat",
        "iss",
        "sub",
        "name",
        "preferred_username",
        "profile",
        "picture",
        "website",
        "locale",
        "updated_at",
        "email",
        "email_verified",
        "groups"
    ],
    "code_challenge_methods_supported": [
        "plain",
        "S256"
    ],
    "grant_types_supported": [
        "authorization_code",
        "refresh_token"
    ]
}

Steps to Reproduce

Use gitea as oauth2 openid provider
configure environment variables
try to login

Expected Behaviour

Screenshots or Additional Context

No response

Device Details

No response

Exact Karakeep Version

0.30.0

Have you checked the troubleshooting guide?

I have checked the troubleshooting guide and I haven't found a solution to my problem

Originally created by @nerdware-timmmi on GitHub (Jan 2, 2026). Original GitHub issue: https://github.com/karakeep-app/karakeep/issues/2333 ### Describe the Bug Hello, I am attempting to use Gitea as an OAuth2 provider but encountering issues with the following configured environment variables: ``` OAUTH_WELLKNOWN_URL: https://example.example.de/.well-known/openid-configuration OAUTH_CLIENT_ID: <secret> OAUTH_CLIENT_SECRET: <secret> OAUTH_PROVIDER_NAME: gitea OAUTH_SCOPE: openid email profile groups OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: true ``` When attempting to sign in with Gitea, I receive the following error: ``` [next-auth][error][OAUTH_CALLBACK_ERROR] https://next-auth.js.org/errors#oauth_callback_error id_token not present in TokenSet { error: Error [OAuthCallbackError]: id_token not present in TokenSet at X.validateIdToken (.next/server/chunks/2992.js:36:6640) at X.callback (.next/server/chunks/2992.js:36:3008) at async c (.next/server/chunks/2992.js:80:219233) at async Object.l (.next/server/chunks/2992.js:80:264160) at async g (.next/server/chunks/2992.js:80:50417) at async a (.next/server/chunks/2992.js:80:209061) at async e.length.t (.next/server/chunks/2992.js:80:210504) { code: undefined }, providerId: 'custom', message: 'id_token not present in TokenSet' } ``` The OpenID configuration endpoint returns the following response: ```json { "issuer": "https://example.example.de/", "authorization_endpoint": "https://example.example.de/login/oauth/authorize", "token_endpoint": "https://example.example.de/login/oauth/access_token", "jwks_uri": "https://example.example.de/login/oauth/keys", "userinfo_endpoint": "https://example.example.de/login/oauth/userinfo", "introspection_endpoint": "https://example.example.de/login/oauth/introspect", "response_types_supported": [ "code", "id_token" ], "id_token_signing_alg_values_supported": [ "RS256" ], "subject_types_supported": [ "public" ], "scopes_supported": [ "openid", "profile", "email", "groups" ], "claims_supported": [ "aud", "exp", "iat", "iss", "sub", "name", "preferred_username", "profile", "picture", "website", "locale", "updated_at", "email", "email_verified", "groups" ], "code_challenge_methods_supported": [ "plain", "S256" ], "grant_types_supported": [ "authorization_code", "refresh_token" ] } ``` ### Steps to Reproduce 1. Use gitea as oauth2 openid provider 2. configure environment variables 3. try to login ### Expected Behaviour Login with gitea is functional ### Screenshots or Additional Context _No response_ ### Device Details _No response_ ### Exact Karakeep Version 0.30.0 ### Have you checked the troubleshooting guide? - [x] I have checked the troubleshooting guide and I haven't found a solution to my problem

kerem added the

bug

status/untriaged

labels

2026-03-02 11:57:09 +03:00

kerem commented

2026-03-02 11:57:10 +03:00

Author

Owner

@nerdware-timmmi commented on GitHub (Jan 2, 2026):

Never mind, I'm now using pocketid and it works perfectly. For comparison, I'll post the output from PocketId well-known.

{
  "authorization_endpoint": "https://example2.example.de/authorize",
  "authorization_response_iss_parameter_supported": true,
  "claims_supported": [
    "sub",
    "given_name",
    "family_name",
    "name",
    "email",
    "email_verified",
    "preferred_username",
    "picture",
    "groups"
  ],
  "code_challenge_methods_supported": ["plain", "S256"],
  "device_authorization_endpoint": "https://example2.example.de/api/oidc/device/authorize",
  "end_session_endpoint": "https://example2.example.de/api/oidc/end-session",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code",
    "client_credentials"
  ],
  "id_token_signing_alg_values_supported": ["RS256"],
  "introspection_endpoint": "https://example2.example.de/api/oidc/introspect",
  "issuer": "https://example2.example.de",
  "jwks_uri": "https://example2.example.de/.well-known/jwks.json",
  "response_types_supported": ["code", "id_token"],
  "scopes_supported": ["openid", "profile", "email", "groups"],
  "subject_types_supported": ["public"],
  "token_endpoint": "https://example2.example.de/api/oidc/token",
  "userinfo_endpoint": "https://example2.example.de/api/oidc/userinfo"
}

@nerdware-timmmi commented on GitHub (Jan 2, 2026): Never mind, I'm now using pocketid and it works perfectly. For comparison, I'll post the output from PocketId well-known. ```json { "authorization_endpoint": "https://example2.example.de/authorize", "authorization_response_iss_parameter_supported": true, "claims_supported": [ "sub", "given_name", "family_name", "name", "email", "email_verified", "preferred_username", "picture", "groups" ], "code_challenge_methods_supported": ["plain", "S256"], "device_authorization_endpoint": "https://example2.example.de/api/oidc/device/authorize", "end_session_endpoint": "https://example2.example.de/api/oidc/end-session", "grant_types_supported": [ "authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code", "client_credentials" ], "id_token_signing_alg_values_supported": ["RS256"], "introspection_endpoint": "https://example2.example.de/api/oidc/introspect", "issuer": "https://example2.example.de", "jwks_uri": "https://example2.example.de/.well-known/jwks.json", "response_types_supported": ["code", "id_token"], "scopes_supported": ["openid", "profile", "email", "groups"], "subject_types_supported": ["public"], "token_endpoint": "https://example2.example.de/api/oidc/token", "userinfo_endpoint": "https://example2.example.de/api/oidc/userinfo" } ```

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/karakeep#1414

No description provided.

Rows
Columns