Configuring Authentik/Baserow for SSO

Are you using our SaaS platform (Baserow.io) or self-hosting Baserow?

Self-hosted

If you are self-hosting, what version of Baserow are you running?

Currently on 1.35.1

If you are self-hosting, which installation method do you use to run Baserow?

Elestio: Fully Managed Open source Install

What are the exact steps to reproduce this issue?

I am trying to login using Authentik (SSO) and I am getting forwarded to this URL with the following message:

Something went wrong: please use the provider that you originally signed up with.

Please contact your administrator for help.

I have solved this problem. I will update this thread within 24 hours with lessons learned and the fix that was applied.

Thank you for the follow-up @pyrebird. I’ll notify the tech team that you’ve resolved the issue.

Any insights are very welcomed for future readers. :raised_hands:

I am currently upgrading the security of the network/platform that I am building. While adding SSO to Baserow at io.phoenixharbor.net, I encountered the error shown in the attached screenshot.

From what I observed, Authentik and Baserow did not appear to link an existing account based on the email address mapped and provided by Authentik during the SSO authentication process. I am unsure whether this behavior is a bug or working as designed.

It is my understanding that, with the configuration I applied in Authentik (at sso.phoenixharbor.net), existing accounts should map correctly to the email/username provided during SSO login. At the same time, I am also experiencing this issue with another subdomain where I am setting up SSO.

Any confirmation or correction of my understanding — and advice on whether this behavior is expected or if further configuration is required — would be greatly appreciated.

It would appear I neglected to augment my previous post with the actual fix I applied to resolve this problem. In the future I will ensure my community posts are at the beginning of a ten hour stretch of information systems work as opposed to at the end of it :slight_smile: . I resolved this issue by modifying the email for my legacy account so that I was able to create a new Baserow account with my primary email address through Authentik. This process allowed me to create an account with my primary email address. To ensure full functionality of Baserow authentication in the event Authentik was unavailable in the future I ensured I was also able to login through the standard Baserow login screen. This process was finalized by sharing all workspaces from my old account with the new Authentik created account and designating my new Authentik generated account as the Admin.

1 Like