What happened?
I have a fairly basic self-hosted authentication configuration (single-node at the moment) using oidc for the provider but after successful authentication I’m receiving another 302 back to the IDP provider login with a logged message indicating my session isn’t associated with identity provider:
{"level":"info","ip":"127.0.0.1","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","request-id":"7eed4db2-0fb0-453e-84ba-a428435c9f0c","idp-id":"ejFCB5inZIuwjfgfGPtbEZ2fJfNxCSC19WCamkfUPeII","session-idp-id":"hg_3KcaIXQYzRnpnkK8holyHAfYYuE04cDUibZzkODw","id":"dE4szqsiifmNEwDAECtTMd90R-0oSx1rg-U4nFmYdtk","time":"2025-09-05T18:24:13Z","message":"authenticate: session not associated with identity provider"}
My IDP client is configured with redirect_uri (included base URI without the subpath as well)https://auth.sub.example.com/oauth2/callback. I’ve tried this with my data broker as in-memory and with Postgres, all with the same results. This same config works great if using google as the target provider (using in-memory or Postgres hosted databroker service). This feels like something simple I’m overlooking.
curl -vkI https://ec21cf15.wild.sub.example.com 2>&1 | tr -d '\r' | sed -n 's/^< location: .*pomerium_idp_id=\([^&]*\).*/\1/p'
ejFCB5inZIuwjfgfGPtbEZ2fJfNxCSC19WCamkfUPeII
What did you expect to happen?
Successful redirect to the application managed by my Pomerium route since the authentication succeeds
How’d it happen?
- Ran pomerium version 0.30.5 with self-hosted authentication service and upstream oidc provider configured.
- Accessed route https://ec21cf15.wild.sub.example.com
- Redirected to IDP login (successful 302)
- Authenticated with IDP (no errors)
- Redirected back to IDP login (302)
session not associated with identity providerlogged by Pomerium
What’s your environment like?
- Pomerium version (retrieve with
pomerium --version):
pomerium version pomerium: 0.30.5+7caf5a7d0
envoy: 1.34.1-p1+9ec36081054ab217ff261a4696693013a3e85eb98c72448cd9b49878fb810332 - Server Operating System/Architecture/Cloud:
- Runnining on GCP with:
-
Distributor ID: Ubuntu Description: Ubuntu 22.04.5 LTS Release: 22.04 Codename: jammy
What’s your config.yaml?
address: :443
certificates:
- cert: /etc/certs/fullchain.pem
key: /etc/certs/privkey.pem
cookie_secret: mycookiesecret
cookie_name: _pomerium_example
cookie_secure: true
routes:
- from: https://ec21cf15.wild.sub.example.com
to: http://10.0.0.2:2003
tls_skip_verify: true
allow_websockets: true
preserve_host_header: true
pass_identity_headers: true
timeout: 0s
idle_timeout: 0s
policy:
allow:
or:
- email:
is: me@example.com
log_level: info
log_format: json
metrics_address: :9090
timeout_read: 0s
timeout_write: 0s
timeout_idle: 0s
cors_allow_preflight: true
cors_allowed_origins:
- '*'
cors_allowed_methods:
- GET
- POST
- PUT
- DELETE
- OPTIONS
cors_allowed_headers:
- '*'
pass_identity_headers: true
authenticate_service_url: https://auth.sub.example.com
idp_provider: oidc
idp_provider_url: https://login.example.com
idp_client_id: "myclientid"
idp_client_secret: "myclientsecret"
jwt_claims_headers:
- email
- name
- sub
What did you see in the logs?
{"level":"info","ip":"127.0.0.1","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","request-id":"7eed4db2-0fb0-453e-84ba-a428435c9f0c","idp-id":"ejFCB5inZIuwjfgfGPtbEZ2fJfNxCSC19WCamkfUPeII","session-idp-id":"hg_3KcaIXQYzRnpnkK8holyHAfYYuE04cDUibZzkODw","id":"dE4szqsiifmNEwDAECtTMd90R-0oSx1rg-U4nFmYdtk","time":"2025-09-05T18:24:13Z","message":"authenticate: session not associated with identity provider"}
Additional context
N/A
