Can't integrate with Gitea

[jezekus]

Component

server

Describe the bug

Can't get integration working with Gitea - oauth2 problem

System Info

Debian 12.4 arm64 platform

woodpecker-server - version 2.2.2

gitea version 1.21.4

Additional context

Simplest setup possible - just binaries on 2 servers (no firewall). I generate oauth2 client-id and secret in gitea and provide it into .env woodpecker-server file, then I go to login page and authorize woodpecker using gitea login. But after that I can't access woodpecker gui, always redirected back.

12:33AM ERR cannot authenticate user error="oauth2: \"unauthorized_client\" \"invalid empty client secret\""

getting this error on woodpecker side and bad request on gitea side

2024/01/31 00:45:58 ...eb/routing/logger.go:102:func1() [I] router: completed POST /login/oauth/access_token for 172.17.30.64:38064, 400 Bad Request in 385.6ms @ auth/oauth.go:618(auth.AccessTokenOAuth)

Validations

• Read the docs.
• Check that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• Checked that the bug isn't fixed in the next version already [https://woodpecker-ci.org/faq#which-version-of-woodpecker-should-i-use]

[6543]

Thats a configuration issue. Make sure you have set the right callback url in gitea and the right gitea url in woodpecker

[jezekus]

Hope that's configuration issue but can't figure it.
Here is my .env file:

WOODPECKER_OPEN=true
WOODPECKER_HOST=http://172.17.30.64
WOODPECKER_SERVER_ADDR=:80
WOODPECKER_GITEA=true
WOODPECKER_GITEA_URL=http://172.17.30.124:3000
WOODPECKER_GITEA_CLIENT=6b9afe7b-3762-47ac-9229-215132a632b7
WODDPECKER_GITEA_SECRET=gto_gots4dddwb2o4tukh2dcke5bmu2unn33r6uke7e6cbkybbe5yhqq
WOODPECKER_LOG_LEVEL=info
WOODPECKER_GITEA_SKIP_VERIFY=true

Gitea is pointed to http://172.17.30.64/authorize

But still same issue there

[6543]

PS: I would recommemd our chat group(s) for such questions.

(via Matrix or Discord ... link in the readme/docs)

[jezekus]

Already on the Discord trying to find a solution, thanks

[jezekus]

Still not working - gitea in debug and woodpecker in debug log level.

Gitea log

2024/02/01 19:31:43 ...eb/routing/logger.go:102:func1() [I] router: completed GET /login/oauth/authorize?client_id=6b9afe7b-3762-47ac-9229-215132a632b7&redirect_uri=http%3A%2F%2Frpi4b4g.in.jezekus.net%2Fauthorize&response_type=code&state=woodpecker for 172.17.30.34:54530, 303 See Other in 415.2ms @ auth/oauth.go:362(auth.AuthorizeOAuth)
2024/02/01 19:31:44 ...eb/routing/logger.go:102:func1() [I] router: completed POST /login/oauth/access_token for 172.17.30.64:49490, 400 Bad Request in 380.7ms @ auth/oauth.go:618(auth.AccessTokenOAuth)
2024/02/01 19:31:44 ...eb/routing/logger.go:102:func1() [I] router: completed POST /login/oauth/access_token for 172.17.30.64:49490, 400 Bad Request in 380.7ms @ auth/oauth.go:618(auth.AccessTokenOAuth)

Woodpecker log

7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/api/stream.go:82 > user feed: connection closed
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=7254.769639 method=GET path=/api/stream/events status=200 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=0.231201 method=GET path=/login status=303 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=0.223664 method=GET path=/authorize status=303 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM ERR ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/api/login.go:53 > cannot authenticate user error="oauth2: \"unauthorized_client\" \"invalid empty client secret\""
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=793.668911 method=GET path=/authorize status=303 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=0.076295 method=GET path=/login status=303 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=0.215627 method=GET path=/login/error status=200 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=1.342648 method=GET path=/web-config.js status=200 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=22.136044 method=GET path=/assets/custom.css status=200 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/router/middleware/logger.go:59 > ip=172.17.30.34 latency=22.000878 method=GET path=/assets/custom.js status=200 user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:122.0) Gecko/20100101 Firefox/122.0"
7:31PM DBG ../../../woodpecker/src/github.com/woodpecker-ci/woodpecker/server/api/stream.go:63 > user feed: connection opened

[zc-devs]

GET /login/oauth/authorize?client_id=6b9afe7b-3762-47ac-9229-215132a632b7&redirect_uri=http%3A%2F%2Frpi4b4g.in.jezekus.net%2Fauthorize&response_type=code&state=woodpecker
WOODPECKER_HOST=http://172.17.30.64

http://rpi4b4g.in.jezekus.net
http://172.17.30.64

Shouldn't be the same?

And maybe this also:

; Gitea
[server]
DOMAIN = example.com
ROOT_URL = https://example.com/

WOODPECKER_GITEA_URL=

[jezekus]

Logs are from 2 different testing runs.

http://rpi4b4g.in.jezekus.net/ and http://172.17.30.64/ are the same machine, I was testing if there is problem with not having FQDN in config.

Config was in line accross gitea and woodpecker so all FQDNs or all IPs

172.17.30.64 = Woodpecker host
172.17.30.124 = Gitea host

[6543]

Is woodpecker behind a reverse proxy?
If so, is caching enabled there?

[jezekus]

No proxy, just a direct Layer 2 connectivity without any restrictions (like firewall)

[jezekus]

Bump, kindly asking for any ideas as I don't see any misconfiguration in the integration.
Any thoughts how to debug more?

[zc-devs]

1. tcpdump/httpry/tshark/wireshark traffic. Make sure client secret sends to Gitea.
2. Try to deploy in Docker exactly how documentation tells.

[zc-devs]

The same question here.

[qwerty287]

closing as no response from opener within a month, please comment if you still have issues