# SSO login does not work with Authentik

**URL:** <https://forums.percona.com/t/sso-login-does-not-work-with-authentik/40326>\
**Category:** Percona Everest\
**Created:** [March 3, 2026, 11:08am UTC](https://forums.percona.com/t/sso-login-does-not-work-with-authentik/40326 "2026-03-03T11:08:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Stephen\_Hoogendijk](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/stephen_hoogendijk/32/21140_2.png) [@Stephen\_Hoogendijk](https://forums.percona.com/u/Stephen_Hoogendijk)\
**Post date:** [March 3, 2026, 11:08am UTC](https://forums.percona.com/t/sso-login-does-not-work-with-authentik/40326/1 "2026-03-03T11:08:36Z")

</div>

Hi all,

OIDC integration with Authentik fails after successful login. Authentication completes and the redirect works, but the session cannot be established. The Everest API server logs the following error repeatedly:

```auto
{"level":"error","T":"2026-03-03T10:55:42Z","logger":"everest","caller":"session/manager.go:215","msg":"failed to shorten token: could not extract jti"}

```

**IdP Configuration**

- Authentik (latest)

- OAuth2/OIDC provider configured with PKCE

- Signing key assigned (RSA)

- Scopes: openid, email, profile

- Redirect URI set correctly (`<EVEREST_URL>/login-callback`)

Login itself succeeds — the user authenticates against Authentik and is redirected back to Everest — so client ID, issuer URL, and redirect URIs are all correct.

**Root Cause**

Everest’s session manager (`session/manager.go:215`) attempts to parse the access token as a JWT and extract the `jti` claim. Authentik issues opaque (random string) access tokens for the authorization code flow, not JWTs. Only the `id_token` is a signed JWT. This is compliant with the OIDC spec — the spec does not require access tokens to be JWTs.

Authentik has no setting to switch access tokens to JWT format for authorization code grants. This means Everest’s OIDC integration is currently incompatible with Authentik (and likely any other IdP that issues opaque access tokens).

**Expected Behaviour**

Everest should either:

1. Use the `id_token` (which is always a JWT per the OIDC spec) for session identity and `jti` extraction, or

2. Support opaque access tokens via the IdP’s token introspection endpoint (`/application/o/introspect/`), or

3. Document that the IdP must issue JWT access tokens as a requirement for OIDC integration.

**Steps to Reproduce**

1. Install OpenEverest 1.13.0

2. Configure an Authentik OAuth2/OIDC provider per the SSO docs

3. Run `everestctl settings oidc configure --issuer-url=<url> --client-id=<id>`

4. Attempt to log in via SSO

5. Observe successful redirect but failed session creation in logs

---

<div class="post-metadata">

**Author:** ![spronin](https://sea1.discourse-cdn.com/flex019/user_avatar/forums.percona.com/spronin/32/22828_2.png) [@spronin](https://forums.percona.com/u/spronin)\
**Post date:** [March 3, 2026, 11:58am UTC](https://forums.percona.com/t/sso-login-does-not-work-with-authentik/40326/2 "2026-03-03T11:58:45Z")

</div>

Hey @Stephen_Hoogendijk

I moved this to this github issue: [SSO login does not work with Authentik · Issue #1904 · openeverest/openeverest · GitHub](https://github.com/openeverest/openeverest/issues/1904)

We are going to look into it and respond there.