[Bug] OIDC SSO fails with Authentik (and any non-Keycloak provider) due to hardcoded endpoint URLs

[Crosus97]

Before opening an issue, please confirm:

• The stream works in VLC/another player
• I've read the Browser Codec Support, Supported Stream Types and Troubleshooting sections in the README
• I've tried enabling "Force Proxy" for CORS issues
• I've tried enabling "Force Audio Transcode" for audio codec issues
• I've tried enabling "Force Remux" for video playback issues

---

Describe the bug

SSO login via OIDC returns a 404 from Authentik when using only the environment variables documented in the README (OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_CALLBACK_URL).

The root cause is in server/auth.js: the fallback URLs for authorizationURL, tokenURL and userInfoURL are hardcoded with Keycloak-specific paths:

authorizationURL: process.env.OIDC_AUTH_URL || `${process.env.OIDC_ISSUER_URL}/protocol/openid-connect/auth`,
tokenURL:         process.env.OIDC_TOKEN_URL || `${process.env.OIDC_ISSUER_URL}/protocol/openid-connect/token`,
userInfoURL:      process.env.OIDC_USERINFO_URL || `${process.env.OIDC_ISSUER_URL}/protocol/openid-connect/userinfo`,

The /protocol/openid-connect/ path is Keycloak-specific. With Authentik, the correct endpoints are completely different (e.g. /application/o/authorize/), so the request hits a URL that doesn't exist and Authentik returns a 404.

The README lists Authentik as a supported provider, but it simply doesn't work out of the box unless you also set the three undocumented env vars OIDC_AUTH_URL, OIDC_TOKEN_URL and OIDC_USERINFO_URL — which most users won't know they need.

Source Type

• Xtream Codes
• M3U Playlist

(Not applicable — this is an authentication issue, not a stream issue)

To Reproduce

1. Deploy nodecast-tv via Docker
2. Configure Authentik as the OIDC provider following the README instructions
3. Set only the four documented env vars: OIDC_ISSUER_URL, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET, OIDC_CALLBACK_URL
4. Try to log in via SSO
5. Authentik logs show a 404 on /application/o/<slug>/protocol/openid-connect/auth

Expected behavior

Nodecast should work with any standard OIDC provider out of the box using only OIDC_ISSUER_URL, since every compliant provider exposes a discovery document at <issuer>/.well-known/openid-configuration with the correct endpoint URLs.

Console/Server Logs

Authentik server log:

{"event": "/application/o/nodecast/protocol/openid-connect/auth?...", "status": 404, "user": "..."}

Nodecast log after applying the fix (see below):

[OIDC] Fetching discovery document from: https://auth.example.com/application/o/nodecast/.well-known/openid-configuration
[OIDC] Discovery successful:
  authorization_endpoint: https://auth.example.com/application/o/authorize/
  token_endpoint:         https://auth.example.com/application/o/token/
  userinfo_endpoint:      https://auth.example.com/application/o/userinfo/

Environment

• Deployment: Docker
• OS: Ubuntu 24.04
• Browser: Chrome

Additional context

I'm not a developer, but I have a solid sysadmin/homelab background and was able to dig into the code/logs to understand what was going wrong. I worked through this issue with Claude.ai, which identified the root cause and proposed a fix.

The fix replaces the hardcoded Keycloak fallback URLs with an async call to the provider's .well-known/openid-configuration discovery document at startup. The manual env var overrides (OIDC_AUTH_URL etc.) are preserved for edge cases. The change is minimal and fully backwards-compatible:

• configureOidcStrategy() becomes async
• A new discoverOidcEndpoints() helper fetches and parses the discovery document
• If OIDC_AUTH_URL, OIDC_TOKEN_URL and OIDC_USERINFO_URL are all set manually, the discovery fetch is skipped entirely

I've tested this on my own instance with Authentik and it works perfectly. I'm happy to open a PR with the patched server/auth.js if that would be helpful.