🐛 OIDC Login Fails at Callback: "failed to fetch user info"

[Xyaren]

LocalAI version:
Docker deployment, latest stable image

Environment, CPU architecture, OS, and Version:
Environment, CPU architecture, OS, and Version:
Linux server (Docker-based deployment behind HTTPS reverse proxy)
Browser: Firefox 152
Auth provider: Authentik (OIDC)

Describe the bug
OIDC login via Authentik succeeds until the callback stage, but fails at:
/api/auth/oidc/callback
with HTTP 500:

{"error":"failed to fetch user info"}

The authorization redirect and code issuance succeed, but LocalAI fails during OAuth callback processing.
IMPORTANT: No detailed error is logged explaining the actual cause.

To Reproduce
To Reproduce:

Given Authentik OIDC is setup.

1. Open:
   https://localai.example.net/api/auth/oidc/login

2. Authenticate via Authentik successfully

3. Redirected to:
   https://localai.example.net/api/auth/oidc/callback?code=...&state=...

4. Response:
   HTTP 500 {"error":"failed to fetch user info"}

Expected behavior
LocalAI should:

• Exchange authorization code for access token
• Retrieve user identity via /userinfo or ID token claims
• Create authenticated session
• Redirect user into application

Logs

INFO  HTTP request method="GET" path="/api/auth/oidc/login" status=307
DEBUG [WatchDog] Watchdog checks for busy connections
INFO  HTTP request method="GET" path="/api/auth/oidc/callback" status=500

Additional context
CRITICAL ISSUE: Missing Observability / Debug Logging

Authentication failures are completely opaque.

Missing:

• token exchange errors
• userinfo HTTP status + response body
• OAuth library error details
• network/TLS failures
• identity provider error responses

Everything collapses into: failed to fetch user info This makes debugging impossible.

Suspected cause:

Likely one of:

• OAuth token exchange failure (invalid_grant, PKCE mismatch, or client auth mismatch)
• userinfo endpoint rejecting token (401/403)
• unnecessary reliance on /userinfo when ID token already contains claims
• insufficient error logging in OAuth callback handler

[localai-bot]

Thanks for the detailed report, and especially for calling out the observability gap - you're exactly right that the error was being swallowed.

The root of the opacity: in the OAuth callback, the error from user-info resolution was discarded before the generic 500 {"error":"failed to fetch user info"} was returned, so the actual cause never reached the logs. #10679 fixes that - it logs the wrapped cause (ID-token verification errors, a missing id_token, claim-parse errors, or a rejecting userinfo response) via xlog.Error, while keeping the generic message on the client side.

Once #10679 is merged (or if you can build the fix/oidc-callback-error-logging branch), could you reproduce the login and share the new log line? It'll look something like:

ERROR  OAuth callback: failed to resolve user info  provider=oidc  error=...

That error=... will tell us which of two things is happening:

1. ID-token verification failing - most commonly an issuer mismatch behind your HTTPS reverse proxy (the iss in the token not matching the discovery URL LocalAI was configured with), or an audience/signature issue. This is usually a proxy/config fix on the Authentik side, no further code change needed. The log will name the exact mismatch.
2. The ID token verifies but carries no email claim - LocalAI currently reads identity only from the ID token, and Authentik often surfaces email/profile claims through the /userinfo endpoint depending on your scope mappings. If that's your case, we have a follow-up ready to enrich from /userinfo when the ID token is missing claims.

To help narrow it down in the meantime: in your Authentik provider, are the email and profile scope mappings configured to include their claims in the ID token, or only in userinfo? And is the OIDC issuer LocalAI is configured with the exact external HTTPS URL your users hit?

[Xyaren]

Thank you, that revealed the issue:

Jul 05 15:02:38 ERROR OAuth callback: failed to resolve user info provider="oidc" error=failed to verify ID token: oidc: malformed jwt: unexpected signature algorithm "HS256"; expected ["RS256"] caller={caller.file="/build/core/http/auth/oauth.go"  caller.L=209 }

[Xyaren]

Switching from EC to an RSA Key in authentik solves the problem.

I think localai should support EC keys though,