A headless OIDC authentication client for authentik that replaces the browser in OAuth2 authorization code flows. It programmatically completes login (username, password, TOTP) and consent stages, then delivers the authorization code to the local callback.
Designed to be used as a BROWSER replacement for CLI tools like NetBird that open a browser for OIDC login.
- Receives the OAuth2 authorization URL as an argument (the URL a CLI tool would normally open in a browser).
- Follows the HTTP redirect chain through the relay/proxy to authentik's
/application/o/authorize/endpoint. - Discovers the authentication flow and its query parameters from authentik's redirect to
/if/flow/:slug/. - Executes the flow via authentik's API (
/api/v3/flows/executor/:slug/), solving each stage:- Identification -- submits the username/email
- Password -- submits the password
- TOTP -- generates and submits a time-based one-time password
- Consent -- accepts the consent challenge
- After authentication, follows the redirect back to the authorize endpoint which triggers the authorization flow (consent/code issuance).
- Follows the final redirect chain (relay callback -> localhost callback) to deliver the authorization code, just as a browser would.
go build -o oidc-inline main.goCreate a config.yaml in the working directory or next to the binary:
base_url: https://authentik.example.com/
username: [email protected]
password: your-password
totp_secret: YOUR_TOTP_SECRET_BASE32
socks5: socks5://user:pass@proxy:1080 # optional
log_file: /var/log/oidc-inline.log # optional| Field | Required | Description |
|---|---|---|
base_url |
Yes | Base URL of your authentik instance |
username |
Yes | Username or email for authentication |
password |
Yes | Account password |
totp_secret |
Yes | Base32-encoded TOTP secret for 2FA |
socks5 |
No | SOCKS5 proxy URL (localhost traffic bypasses proxy) |
log_file |
No | Path to log file (defaults to stderr if not set) |
# Direct invocation
./oidc-inline 'https://relay.example.com/oauth2/auth?client_id=my-app&...'
# As a BROWSER env for NetBird
export BROWSER=/path/to/oidc-inline
netbird up
# With custom config path
./oidc-inline --config /etc/oidc-inline/config.yaml 'https://...'The published Docker image is based on https://github.com/11notes/docker-netbird-client with oidc-inline pre-installed at /etc/oidc-inline and BROWSER env set accordingly.
docker pull ghcr.io/stck/oidc-inline:latestMount your config.yaml into the container:
docker run -v ./config.yaml:/etc/oidc-inline/config.yaml ghcr.io/stck/oidc-inline:latest