OIDC auth in 0.16.2 fails with "Failed to decode id token claims"

[kyhwana]

Bug description
After upgrading from 0.16.0 to 0.16.2 users are unable to authenticate using azure oidc, they get the error Failed to decode id token claims
In the logs is the following error:

Aug 16 14:16:32 <machinefqd>  headscale[1125980]: 2022-08-16T02:16:32Z ERR home/runner/work/headscale/headscale/oidc.go:324 > Failed to decode id token claims error="json: Unmarshal(non-pointer headscale.IDTokenClaims)"

Is this related to the changed line in oidc.go? if err := idToken.Claims(claims); err != nil {
To Reproduce

Have a user log out of the tailscale client then reauthenticate, using Azure AD OIDC. When the browser window opens it will attempt to auth via AAD and fail with the above error.

Context info
Headscale version 0.16.2.
tailscale client version 1.28.0

[mannp]

Just had the same issue here with a previously working keycloak instance.

2022-08-16T14:03:08Z ERR go/src/headscale/oidc.go:324 > Failed to decode id token claims error="json: Unmarshal(non-pointer headscale.IDTokenClaims)"

[victorhooi]

Yup, I have the same issue as well on 0.16.2, and am getting the same error message.

I'm using OIDC with Google OAuth.

Is there some workaround we can use for now, or is this relatively easy to patch?

[mannp]

I went back to 0.16.1 and did have the same error, so went back to 0.16.0 and was able to login correctly.

[juanfont]

Hey people, we have merged a fix in main already.

Can you give a try before we release 0.16.3?

[victorhooi]

I'm willing to try - is there a place we can download latest built binaries? (AMD64 in my case).

[mannp]

Still using docker and some Kubernetes for all of my infra, so not so easy to try without a pre-release docker img (which I appreciate is a hassle to create each time).

[kyhwana]

I built the main repo and updated.
When logging a user out (windows client) and then logging back in via oidc azure AD, I get the error
Aug 18 09:49:46 <headscalehost> headscale[1601506]: 2022-08-17T21:49:46Z DBG Machine registration has expired. Sending a authurl to register machine=<machine name>
Deleting the machine (which headscale nodes list says is expired?) and then reauthenticating works OK.

[juanfont]

@kyhwana thanks for checking out. I will close this issue and open a new one on the registration.