"Page not found" after authentication (no redirect to requested page)

[DockMagnus]

Hi there,

I want to use Tinyauth together with Kanidm as an OIDC Provider and Caddy as Reverse Proxy.

Everything seems to work fine but after authentication with Kanidm, Tinyauth gives a "Page not found" error.

I am clueless...

This is the Tinyauth logs from starting to the "Page not found" error:

2026-01-17T14:09:17+01:00 INF home/runner/work/tinyauth/tinyauth/cmd/root.go:118 > Starting Tinyauth version=v4.1.0
2026-01-17T14:09:17+01:00 WRN home/runner/work/tinyauth/tinyauth/cmd/root.go:121 > Log level set to trace, this will log sensitive information!
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:82 > Config dump config={"Address":"0.0.0.0","AppURL":"https://tinyauth.<redacted>","BackgroundImage":"https://images.<redacted>/myimage.webp","DatabasePath":"/data/tinyauth.db/tinyauth.db","DisableAnalytics":true,"DisableResources":false,"DisableUIWarnings":false,"ForgotPasswordMessage":"Manage your account (Password, Apps, E-Mail) under https://myidservice.<redacted>.","LdapAddress":"","LdapBaseDN":"","LdapBindDN":"","LdapBindPassword":"","LdapInsecure":false,"LdapSearchFilter":"(uid=%s)","LogLevel":"trace","LoginMaxRetries":5,"LoginTimeout":300,"OAuthAutoRedirect":"none","OAuthWhitelist":"","Port":9092,"ResourcesDir":"/data/tinyauth.lib","SecureCookie":true,"SessionExpiry":7200,"SocketPath":"","Title":"<redacted> | My ID Service","TrustedProxies":"10.0.0.0/8","Users":"","UsersFile":""}
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:83 > Users dump users=[]
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:84 > OAuth providers dump oauthProviders={"myidservice":{"AuthURL":"https://myidservice.<redacted>/ui/oauth2","ClientID":"tinyauth","ClientSecret":"<redacted>","ClientSecretFile":"","InsecureSkipVerify":false,"Name":"My ID Service","RedirectURL":"https://tinyauth.<redacted>/oauth/callback/myidservice","Scopes":["openid email profile"],"TokenURL":"https://myidservice.<redacted>/oauth2/token","UserinfoURL":"https://myidservice.<redacted>/oauth2/openid/tinyauth/userinfo"}}
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:85 > Cookie domain cookieDomain=<redacted>
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:86 > Session cookie name sessionCookieName=tinyauth-session-<redacted>
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:87 > CSRF cookie name csrfCookieName=tinyauth-csrf-<redacted>
2026-01-17T14:09:17+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:88 > Redirect cookie name redirectCookieName=tinyauth-redirect-<redacted>
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:130 > Initializing service service=*service.DatabaseService
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:156 > Initializing service service=*service.DockerService
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/docker_service.go:39 > Docker not connected error="Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?"
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:156 > Initializing service service=*service.AccessControlsService
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:156 > Initializing service service=*service.AuthService
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:156 > Initializing service service=*service.OAuthBrokerService
2026-01-17T14:09:17+01:00 INF home/runner/work/tinyauth/tinyauth/internal/service/oauth_broker_service.go:54 > Initialized OAuth service service=myidservice
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:187 > Authentication providers providers=[{"id":"myidservice","name":"My ID Service","oauth":true}]
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:218 > Initializing middleware middleware=*middleware.ContextMiddleware
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:218 > Initializing middleware middleware=*middleware.UIMiddleware
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:218 > Initializing middleware middleware=*middleware.ZerologMiddleware
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.ContextController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.OAuthController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.ProxyController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.UserController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.HealthController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:276 > Setting up *controller.ResourcesController controller
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:287 > Starting database cleanup routine
2026-01-17T14:09:17+01:00 INF home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:312 > Starting server on 0.0.0.0:3000
2026-01-17T14:09:17+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/bootstrap/app_bootstrap.go:378 > Cleaning up old database sessions
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/controller/proxy_controller.go:70 > Request identified as (most likely) coming from a browser
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/docker_service.go:70 > Docker not connected, returning empty labels
2026-01-17T14:09:23+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/controller/proxy_controller.go:88 > ACLs for resource acls={"Config":{"Domain":""},"IP":{"Allow":null,"Block":null,"Bypass":null},"OAuth":{"Groups":"","Whitelist":""},"Path":{"Allow":"","Block":""},"Response":{"BasicAuth":{"Password":"","PasswordFile":"","Username":""},"Headers":null},"Users":{"Allow":"","Block":""}}
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:421 > IP not in bypass list, continuing with authentication ip=<redacted>
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:404 > IP not in allow or block list, allowing by default ip=<redacted>
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/controller/proxy_controller.go:148 > No user context found in request, treating as not logged in
2026-01-17T14:09:23+01:00 TRC home/runner/work/tinyauth/tinyauth/internal/controller/proxy_controller.go:156 > User context from request context={"Email":"","IsLoggedIn":false,"Name":"","OAuth":false,"OAuthGroups":"","OAuthName":"","Provider":"","TotpEnabled":false,"TotpPending":false,"Username":""}
2026-01-17T14:09:23+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49864 client_ip=<redacted> latency="447.844µs" method=GET path=/api/auth/caddy status=307
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:23+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49868 client_ip=<redacted> latency="105.929µs" method=GET path=/api/context/app status=200
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:23+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/controller/context_controller.go:94 > No user context found in request error="no user context in request"
2026-01-17T14:09:23+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49868 client_ip=<redacted> latency="116.526µs" method=GET path=/api/context/user status=200
2026-01-17T14:09:25+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:25+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:25+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:25+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/controller/oauth_controller.go:89 > Setting redirect URI cookie
2026-01-17T14:09:25+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49868 client_ip=<redacted> latency="100.451µs" method=GET path=/api/oauth/url/myidservice status=200
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:34+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49868 client_ip=<redacted> latency="22.664µs" method=GET path=/api/context/app status=200
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:41 > No valid session cookie found error="http: named cookie not present"
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/service/auth_service.go:365 > No basic auth provided
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/middleware/context_middleware.go:110 > No basic auth provided
2026-01-17T14:09:34+01:00 DBG home/runner/work/tinyauth/tinyauth/internal/controller/context_controller.go:94 > No user context found in request error="no user context in request"
2026-01-17T14:09:34+01:00 INF home/runner/work/tinyauth/tinyauth/internal/middleware/zerolog_middleware.go:66 > Request address=<redacted>:49868 client_ip=<redacted> latency="43.986µs" method=GET path=/api/context/user status=200

And this is my Tinyauth Configuration:

## Base Configuration
######################

# Name of the App
APP_TITLE="Tinyauth | My ID Service"
# The base URL where fauth-dockmde is accessible
APP_URL="https://tinyauth.<redacted>"
# Directory for static resources
RESOURCES_DIR="/data/tinyauth.lib"
# Path to SQLite database file
DATABASE_PATH="/data/tinyauth.db/tinyauth.db"
# Disable version heartbeat
DISABLE_ANALYTICS="true"
# Disable static resource serving
DISABLE_RESOURCES="false"
# Disable UI warning messages
DISABLE_UI_WARNINGS="false"
# Message shown on forgot password page
FORGOT_PASSWORD_MESSAGE="Manage your account (Password, Apps, E-Mail) under https://myidservice.<redacted>."
# Background image URL for login page
BACKGROUND_IMAGE=""
# Running mode (release or debug)
GIN_MODE="release"
# Enable secure cookies (requires HTTPS)
SECURE_COOKIE="true"
# Session expiry in seconds (7200 = 2 hours)
SESSION_EXPIRY="7200"
# Login timeout in seconds (300 = 5 minutes)
LOGIN_TIMEOUT="300"
# Maximum login retries before lockout
LOGIN_MAX_RETRIES="5"

## Server Configuration
########################

# Port to listen on
PORT="3000"
# Interface to bind to (0.0.0.0 for all interfaces)
ADDRESS="0.0.0.0"
# Unix socket path (optional, overrides port/address if set)
#SOCKET_PATH=""
# Comma-separated list of trusted proxy IPs/CIDRs
TRUSTED_PROXIES="<redacted>"

## Logging Configuration
#########################

# Log level: trace, debug, info, warn, error
LOG_LEVEL="trace"
# Enable JSON formatted logs
LOG_JSON="false"
# Specific Log stream configurations
# APP and HTTP log streams are enabled by default, and use the global log level unless overridden
LOG_STREAMS_APP_ENABLED="true"
LOG_STREAMS_APP_LEVEL="info"
LOG_STREAMS_HTTP_ENABLED="true"
LOG_STREAMS_HTTP_LEVEL="info"
LOG_STREAMS_AUDIT_ENABLED="false"
LOG_STREAMS_AUDIT_LEVEL="info"

## Local Users Configuration
#############################

# Format: username:bcrypt_hash (use bcrypt to generate hash)
#AUTH_USERS="admin:$2a$10$example_bcrypt_hash_here"
# Path to external users file (optional)
#AUTH_USERSFILE="/data/tinyauth.users/users.conf"

## OAuth Configuration
#######################

# OAuth Provider Configuration 
PROVIDERS_MYIDSERVICE_AUTH_URL="https://myidservice.<redacted>/ui/oauth2"
PROVIDERS_MYIDSERVICE_CLIENT_ID="tinyauth"
PROVIDERS_MYIDSERVICE_CLIENT_SECRET="<redacted>"
PROVIDERS_MYIDSERVICE_INSECURE_SKIP_VERIFY="false"
PROVIDERS_MYIDSERVICE_NAME="My ID Service"
PROVIDERS_MYIDSERVICE_REDIRECT_URL="https://tinyauth.<redacted>/oauth/callback/myidservice"
PROVIDERS_MYIDSERVICE_SCOPES="openid email profile"
PROVIDERS_MYIDSERVICE_TOKEN_URL="https://myidservice.<redacted>/oauth2/token"
PROVIDERS_MYIDSERVICE_USER_INFO_URL="https://myidservice.<redacted>/oauth2/openid/tinyauth/userinfo"
# Regex pattern for allowed email addresses (e.g., /@example\.com$/)
#OAUTH_WHITELIST=""
# Provider ID to auto-redirect to (skips login page)
#OAUTH_AUTO_REDIRECT="MYIDSERVICE"

What is going wrong? Do I have to set special scopes?

After authentication the browser shows two cookies: the tinyauth-csrf-xxx and the tinyauth-redirect-xxx cookies. Kanidm logs show successful authentication...

P.S. I am using Podman with Quadlets (systemd container units) without labels. All configurations are stored in files.

Thanks for your support,

Magnus.

[steveiliop56]

Hello, I believe that this is a proxy issue. Can you please share your setup?

[steveiliop56]

Is the 404 from Tinyauth itself (do you see the Tinyauth UI) or is it just plain text?

[DockMagnus]

It's from Tinyauth. I see my custom background image and Tinyauths own error message. No blank. 🤷🏽‍♂️

[steveiliop56]

You redirect URL is wrong, it should be:

https://tinyauth.<redacted>/api/oauth/callback/myidservice

Note the added /api path.

[DockMagnus]

Thanks.

Issue solved.

I got the redirect URL example from the example .env file under "Using the binary" (https://raw.githubusercontent.com/steveiliop56/tinyauth/refs/heads/main/.env.example) so I thought is was all correct. Maybe it should be updated or marked as experimental/nightly. It also uses the variables with the TINYAUTH_ - prefix which is also not valid at the moment at least for the stable branch.

But thanks for your assistance and go on with your work 👍🏽

[steveiliop56]

You should always consult the documentation for the configuration options. The main branch is the development one so whatever you see is experimental/in active development.