502 problem occurs when using SAML authentication in version 2024.12

[tseking555]

GitLab integrates authentik SAML authentication into the machine, and all access to the intranet is normal. Accessing through VPN or the Internet will result in the error https://www.authentik.com/application/saml/gitlab/sso/binding/redirect/?SAMLRequest=xxxxx 502. This error occurred after upgrading to 2024.12 and does not exist in the 2024.10 version.

[rissson]

Do you have any logs from that error?

[SpyFax]

I have the same error. It seems like before 2024.12, /application/saml/gitlab/sso/binding/init/ is before authorize_application, and after 2024.12, it reverses.

logs from server

authentik 2024.10.5

{
    "auth_via": "session",
    "domain_url": "auth.example.com",
    "event": "/application/saml/gitlab/sso/binding/init/",
    "host": "auth.example.com",
    "level": "info",
    "logger": "authentik.asgi",
    "method": "GET",
    "pid": 67,
    "remote": "x.x.x.x",
    "request_id": "04d828da01944eac867e56265e2cd1eb",
    "runtime": 38,
    "schema_name": "public",
    "scheme": "https",
    "status": 302,
    "timestamp": "2025-02-09T02:45:02.017203",
    "user": "johndoe",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0"
}
{
    "action": "authorize_application",
    "auth_via": "session",
    "client_ip": "x.x.x.x",
    "context": {
        "asn": {
            "as_org": "...",
            "network": "x.x.x.x/x"
        },
        "authorized_application": {
            "app": "authentik_core",
            "model_name": "application",
            "name": "gitlab",
            "pk": "1a2135fea48043519028c5e55e42eb6c"
        },
        "flow": "cc758f9a911641b2a42ca8d36aeb54df",
        "http_request": {
            "args": {},
            "method": "GET",
            "path": "/api/v3/flows/executor/default-provider-authorization-implicit-consent/",
            "request_id": "6122e987d91046a7b06b7696d31c1cc4",
            "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0"
        }
    },
    "domain_url": "auth.example.com",
    "event": "Created Event",
    "host": "auth.example.com",
    "level": "info",
    "logger": "authentik.events.models",
    "pid": 67,
    "request_id": "6122e987d91046a7b06b7696d31c1cc4",
    "schema_name": "public",
    "timestamp": "2025-02-09T02:45:02.930594",
    "user": {
        "email": "johndoe@example.com",
        "pk": 1149,
        "username": "johndoe"
    }
}

authentik 2024.12.3

{
    "action": "authorize_application",
    "auth_via": "session",
    "client_ip": "x.x.x.x",
    "context": {
        "asn": {
            "as_org": "...",
            "network": "x.x.x.x/x"
        },
        "authorized_application": {
            "app": "authentik_core",
            "model_name": "application",
            "name": "gitlab",
            "pk": "1a2135fea48043519028c5e55e42eb6c"
        },
        "flow": "cc758f9a911641b2a42ca8d36aeb54df",
        "http_request": {
            "args": {},
            "method": "GET",
            "path": "/application/saml/gitlab/sso/binding/init/",
            "request_id": "e992f1b5a4f54ee3a57596d77008d19a",
            "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0"
        }
    },
    "domain_url": "auth.example.com",
    "event": "Created Event",
    "host": "auth.example.com",
    "level": "info",
    "logger": "authentik.events.models",
    "pid": 66,
    "request_id": "e992f1b5a4f54ee3a57596d77008d19a",
    "schema_name": "public",
    "timestamp": "2025-02-09T02:26:53.282633",
    "user": {
        "email": "johndoe@example.com",
        "pk": 1149,
        "username": "johndoe"
    }
}
{
    "auth_via": "session",
    "domain_url": "auth.example.com",
    "event": "/application/saml/gitlab/sso/binding/init/",
    "host": "auth.example.com",
    "level": "info",
    "logger": "authentik.asgi",
    "method": "GET",
    "pid": 66,
    "remote": "x.x.x.x",
    "request_id": "e992f1b5a4f54ee3a57596d77008d19a",
    "runtime": 201,
    "schema_name": "public",
    "scheme": "https",
    "status": 302,
    "timestamp": "2025-02-09T02:26:53.318886",
    "user": "johndoe",
    "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:134.0) Gecko/20100101 Firefox/134.0"
}