Description

When attempting to configure Bulwark with Authentik, the OIDC auto-discovery in Bulwark attempts to get information from .well-known/oauth-authorization-server which returns a 404 (fine) but with no CORS headers. The request is blocked by CORS and doesn't fall through to the correct (for Authentik) .well-known/openid-configuration endpoint.

A workaround exists for Cloudflare users: https://gist.github.com/shor0814/3569f42ff4fee1becf67d24e14990356#33-cloudflare-cors-fix

Steps to Reproduce

I was following this guide: https://gist.github.com/shor0814/3569f42ff4fee1becf67d24e14990356

Short version:

1. Configure an Application and a Provider for Bulwark in Authentik
2. Configure Bulwark to use Authentik for OIDC.
3. Attempt to log in with web interface, check console for CORS errors.

Expected Behavior

Ideally, this would fall through to the working URL. Otherwise, maybe allowing configuration of the endpoint directly?

Actual Behavior

The discovery hangs, and you cannot login.

Bulwark Version

1.7.2

Stalwart Mail Server Version

0.16.7

Browser

Chrome / Chromium

Operating System

Linux

Screenshots / Screen Recording

No response

Relevant Logs or Error Output

Access to fetch at 'https://auth.example.com/application/o/bulwark/.well-known/oauth-authorization-server' from origin 'https://webmail.example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Additional Context

No response