# NodeRed Agent Error: ID token not issued by expected OpenID provider

**URL:** <https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343>\
**Category:** OpenCore\
**Created:** [May 20, 2024, 2:07pm UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343 "2024-05-20T14:07:34Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![renierduvenhage](https://discourse.openiap.io/letter_avatar_proxy/v4/letter/r/5f8ce5/32.png) [@renierduvenhage](https://discourse.openiap.io/u/renierduvenhage)\
**Post date:** [May 20, 2024, 2:07pm UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/1 "2024-05-20T14:07:35Z")

</div>

Good day

I created a brand new custom OpenFlow environment running in Azure on Ubuntu 22.04LTS.

The OpenFlow portal is working, but as soon as I try to access a NodeRed agent I get the following error:

 ![image](https://discourse.openiap.io/uploads/default/original/2X/b/b55a381bcf9553c258a3473f8c79f20edc9b3140.png)

What is the possible fix for this? The SSL certificate is working for the OpenFlow portal and the DNS records added are as follows:

 ![image](https://discourse.openiap.io/uploads/default/original/2X/3/348185e808f20ff8336fe92c9b2e1f16b7746f5f.png)

I also added the yaml file that I used, not sure if the error comes from this file:

```auto
version: "3.3"
services:
  mongodb:
    image: mongo
    restart: always
    command: "--bind_ip_all --replSet rs0"
    environment:
      - MONGO_REPLICA_SET_NAME=rs0
    volumes:
      - mongodb_data:/data/db
  mongosetup:
    image: mongo
    depends_on:
      - mongodb
    restart: "no"
    command: >
      mongosh --host mongodb:27017 --eval 
      '
      db = (new Mongo("mongodb:27017")).getDB("openflow");
      config = {
      "_id" : "rs0",
      "members" : [
        {
          "_id" : 0,
          "host" : "mongodb:27017"
        }
      ]
      };
      rs.initiate(config);
      '
  traefik:
    image: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.address=:80"
      # - "--log.level=DEBUG"

      # - --certificatesresolvers.myresolver.acme.dnschallenge.provider=gcloud
      # - --certificatesresolvers.myresolver.acme.email=my@domain.com
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=azure
      - --certificatesresolvers.myresolver.acme.email=
      - --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      # # middleware redirect
      # - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # # global redirect to https
      # - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
      # - "traefik.http.routers.redirs.entrypoints=web"
      # - "traefik.http.routers.redirs.middlewares=redirect-to-https"
    environment:
      - AZURE_CLIENT_ID=
      - AZURE_CLIENT_SECRET=
      - AZURE_SUBSCRIPTION_ID=
      - AZURE_TENANT_ID=
      - AZURE_RESOURCE_GROUP=
      - AZURE_POLLING_INTERVAL=5
      - AZURE_PROPAGATION_TIMEOUT=120
      - AZURE_TTL=30
      # - CLOUDFLARE_EMAIL_FILE=/letsencrypt/CF_EMAIL.txt
      # - CLOUDFLARE_API_KEY_FILE=/letsencrypt/CF_KEY.txt
      # - GCE_PROJECT=apiproject-237214
      # - GCE_SERVICE_ACCOUNT_FILE=/letsencrypt/account.json
      # - DO_POLLING_INTERVAL=5
      # - DO_PROPAGATION_TIMEOUT=120
      # - DO_TTL=30
    ports:
      - "80:80"
      - "443:443"
    restart: always
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "//var/run/docker.sock:/var/run/docker.sock:ro"
  rabbitmq:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`mq.integrations.mdrdigitals.com`)"
      - "traefik.http.routers.rabbitmq.entrypoints=websecure"
      - "traefik.http.routers.rabbitmq.tls.certresolver=myresolver"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"
    image: rabbitmq:3-management
    restart: always
  api:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`integrations.mdrdigitals.com`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=myresolver"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
      - "traefik.frontend.passHostHeader=true"
      # - "traefik.http.routers.api.tls.domains[0].main=integrations.mdrdigitals.com"
      # - "traefik.http.routers.api.tls.domains[0].sans=*.integrations.mdrdigitals.com"
    image: openiap/openflow
    deploy:
      replicas: 1
    pull_policy: always
    restart: always
    depends_on:
      - rabbitmq
      - mongodb
    volumes:
      - "//var/run/docker.sock:/var/run/docker.sock"
    environment:
      - auto_create_users=false
      - auto_create_domains=
      - domain=integrations.mdrdigitals.com
      - protocol=https

      - agent_oidc_userinfo_endpoint=http://api:3000/oidc/me
      - agent_oidc_issuer=https://integrations.mdrdigitals.com/oidc
      - agent_oidc_authorization_endpoint=https://integrations.mdrdigitals.com/oidc/auth
      - agent_oidc_token_endpoint=http://api:3000/oidc/token
      - agent_docker_entrypoints=web,websecure
      - agent_docker_certresolver=myresolver

      # uncomment below 2 lines, if you have set replicas above 1
      # - enable_openflow_amqp=true
      # - amqp_prefetch=25
      # uncomment to add agents to the same docker compose project ( will breake running docker compose up -d if any agents running )
      # - agent_docker_use_project=true  

      - amqp_url=amqp://guest:guest@rabbitmq
      - mongodb_url=mongodb://mongodb:27017
      - mongodb_db=openrpa

      - aes_secret=O1itlrmA47WzxPj95YHD2sZs7IchYaQI25mQ
volumes:
  mongodb_data:
    driver: local

```

In the agent logs, I see the following error, not sure if it is related:

 ![image](https://discourse.openiap.io/uploads/default/original/2X/7/7728c4c414f6bc856ee38e6f53ac9fc28a68dc32.png)

Environment running OpenFlow v1.5.9

---

<div class="post-metadata">

**Author:** ![Allan\_Zimmermann](https://discourse.openiap.io/user_avatar/discourse.openiap.io/allan_zimmermann/32/12_2.png) [@Allan\_Zimmermann](https://discourse.openiap.io/u/Allan_Zimmermann)\
**Post date:** [May 21, 2024, 6:42am UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/2 "2024-05-21T06:42:24Z")

</div>

I’ve just seen that error a few days ago.  
and i cannot for the life of me remember what was the reason

The error happens in saveSettings, and the error seems to come from NodeRED calling saveSettings with an empty object, but i am pretty sure when i saw this error, we fixed it by changing something in openflow. Embarrassing

maybe the first error is a hint. So it’s complaining issuer does not match, but it matches what you have in the environment variables ( and it matches the real value from [https://integrations.mdrdigitals.com/oidc/.well-known/openid-configuration](https://integrations.mdrdigitals.com/oidc/.well-known/openid-configuration) )

I will just quickly try and do a fresh install my self and see if I can reproduce this.

---

<div class="post-metadata">

**Author:** ![Allan\_Zimmermann](https://discourse.openiap.io/user_avatar/discourse.openiap.io/allan_zimmermann/32/12_2.png) [@Allan\_Zimmermann](https://discourse.openiap.io/u/Allan_Zimmermann)\
**Post date:** [May 21, 2024, 7:54am UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/3 "2024-05-21T07:54:36Z")

</div>

i purged my local system ( releasing \>300 gb disk space, so that was nice )  
and tried a fresh install. No issues

I then started a small debian vm in google cloud, added dns for the ephemeral IP and updated docker-compose-letsencrypt.yml to match  
And then i get the same error as you.

I will investigate and write again, when i found a solution to this.

---

<div class="post-metadata">

**Author:** ![Allan\_Zimmermann](https://discourse.openiap.io/user_avatar/discourse.openiap.io/allan_zimmermann/32/12_2.png) [@Allan\_Zimmermann](https://discourse.openiap.io/u/Allan_Zimmermann)\
**Post date:** [May 21, 2024, 9:15am UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/4 "2024-05-21T09:15:52Z")

</div>

ok, i see the error comes both in my local and cloud deployment, and it’s not important, nodered is still working without any issues. The error is due to the fact there are no nodes/modules installed when it initially starts up, and I forgot to check for settings.nodes being null ( it used to always be an array ) i will get that fixed

could you go to the package monitoring package  
 ![image](https://discourse.openiap.io/uploads/default/original/2X/e/ea5dd28429e79d5e6efb3017aef5ffb62c1fe920.png)  
and check if you see any errors while you are trying to login. anything that could give a hint on what is going on with the issuer check

---

<div class="post-metadata">

**Author:** ![renierduvenhage](https://discourse.openiap.io/letter_avatar_proxy/v4/letter/r/5f8ce5/32.png) [@renierduvenhage](https://discourse.openiap.io/u/renierduvenhage)\
**Post date:** [May 21, 2024, 2:05pm UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/5 "2024-05-21T14:05:34Z")

</div>

Hi @Allan_Zimmermann

Thanks for the responses.

Here is the output of the above:

 ![image](https://discourse.openiap.io/uploads/default/original/2X/0/01db45ed6479441ddcf6e324736d8c272ac68a21.png)

I saw I made a mistake yesterday - there is the correct yaml file that I am using (it is exactly the same as the one above - it is just a different URL):

```auto
version: "3.3"
services:
  mongodb:
    image: mongo
    restart: always
    command: "--bind_ip_all --replSet rs0"
    environment:
      - MONGO_REPLICA_SET_NAME=rs0
    volumes:
      - mongodb_data:/data/db
  mongosetup:
    image: mongo
    depends_on:
      - mongodb
    restart: "no"
    command: >
      mongosh --host mongodb:27017 --eval 
      '
      db = (new Mongo("mongodb:27017")).getDB("openflow");
      config = {
      "_id" : "rs0",
      "members" : [
        {
          "_id" : 0,
          "host" : "mongodb:27017"
        }
      ]
      };
      rs.initiate(config);
      '
  traefik:
    image: traefik
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.web.address=:80"
      # - "--log.level=DEBUG"

      # - --certificatesresolvers.myresolver.acme.dnschallenge.provider=gcloud
      # - --certificatesresolvers.myresolver.acme.email=my@domain.com
      - --certificatesresolvers.myresolver.acme.dnschallenge.provider=azure
      - --certificatesresolvers.myresolver.acme.email=
      - --certificatesresolvers.myresolver.acme.dnschallenge.resolvers=1.1.1.1
      - --certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json
      # # middleware redirect
      # - "traefik.http.middlewares.redirect-to-https.redirectscheme.scheme=https"
      # # global redirect to https
      # - "traefik.http.routers.redirs.rule=hostregexp(`{host:.+}`)"
      # - "traefik.http.routers.redirs.entrypoints=web"
      # - "traefik.http.routers.redirs.middlewares=redirect-to-https"
    environment:
      - AZURE_CLIENT_ID=
      - AZURE_CLIENT_SECRET=
      - AZURE_SUBSCRIPTION_ID=
      - AZURE_TENANT_ID=
      - AZURE_RESOURCE_GROUP=
      - AZURE_POLLING_INTERVAL=5
      - AZURE_PROPAGATION_TIMEOUT=120
      - AZURE_TTL=30
      # - CLOUDFLARE_EMAIL_FILE=/letsencrypt/CF_EMAIL.txt
      # - CLOUDFLARE_API_KEY_FILE=/letsencrypt/CF_KEY.txt
      # - GCE_PROJECT=apiproject-237214
      # - GCE_SERVICE_ACCOUNT_FILE=/letsencrypt/account.json
      # - DO_POLLING_INTERVAL=5
      # - DO_PROPAGATION_TIMEOUT=120
      # - DO_TTL=30
    ports:
      - "80:80"
      - "443:443"
    restart: always
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "//var/run/docker.sock:/var/run/docker.sock:ro"
  rabbitmq:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.rabbitmq.rule=Host(`mq.integrator.mdrdigitals.com`)"
      - "traefik.http.routers.rabbitmq.entrypoints=websecure"
      - "traefik.http.routers.rabbitmq.tls.certresolver=myresolver"
      - "traefik.http.services.rabbitmq.loadbalancer.server.port=15672"
    image: rabbitmq:3-management
    restart: always
  api:
    labels:   
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`integrator.mdrdigitals.com`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=myresolver"
      - "traefik.http.services.api.loadbalancer.server.port=3000"
      - "traefik.frontend.passHostHeader=true"
      # - "traefik.http.routers.api.tls.domains[0].main=integrator.mdrdigitals.com"
      # - "traefik.http.routers.api.tls.domains[0].sans=*.integrator.mdrdigitals.com"
    image: openiap/openflow
    deploy:
      replicas: 1
    pull_policy: always
    restart: always
    depends_on:
      - rabbitmq
      - mongodb
    volumes:
      - "//var/run/docker.sock:/var/run/docker.sock"
    environment:
      - auto_create_users=false
      - auto_create_domains=
      - domain=integrator.mdrdigitals.com
      - protocol=https

      - agent_oidc_userinfo_endpoint=http://api:3000/oidc/me
      - agent_oidc_issuer=https://integrator.mdrdigitals.com/oidc
      - agent_oidc_authorization_endpoint=https://integrator.mdrdigitals.com/oidc/auth
      - agent_oidc_token_endpoint=http://api:3000/oidc/token
      - agent_docker_entrypoints=web,websecure
      - agent_docker_certresolver=myresolver

      # uncomment below 2 lines, if you have set replicas above 1
      # - enable_openflow_amqp=true
      # - amqp_prefetch=25
      # uncomment to add agents to the same docker compose project ( will breake running docker compose up -d if any agents running )
      # - agent_docker_use_project=true  

      - amqp_url=amqp://guest:guest@rabbitmq
      - mongodb_url=mongodb://mongodb:27017
      - mongodb_db=openrpa

      - aes_secret=O1itlrmA47WzxPj95YHD2sZs7IchYaQI25mQ
volumes:
  mongodb_data:
    driver: local

```

---

<div class="post-metadata">

**Author:** ![Allan\_Zimmermann](https://discourse.openiap.io/user_avatar/discourse.openiap.io/allan_zimmermann/32/12_2.png) [@Allan\_Zimmermann](https://discourse.openiap.io/u/Allan_Zimmermann)\
**Post date:** [May 21, 2024, 2:25pm UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/6 "2024-05-21T14:25:54Z")

</div>

There are no errors in that output.

I need an error in order to troubleshoot it. or a way to reproduce it ( or acess to the envoriment )

---

<div class="post-metadata">

**Author:** ![renierduvenhage](https://discourse.openiap.io/letter_avatar_proxy/v4/letter/r/5f8ce5/32.png) [@renierduvenhage](https://discourse.openiap.io/u/renierduvenhage)\
**Post date:** [May 21, 2024, 2:59pm UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/7 "2024-05-21T14:59:34Z")

</div>

Hi @Allan_Zimmermann

I sent you a personal message.

---

<div class="post-metadata">

**Author:** ![Allan\_Zimmermann](https://discourse.openiap.io/user_avatar/discourse.openiap.io/allan_zimmermann/32/12_2.png) [@Allan\_Zimmermann](https://discourse.openiap.io/u/Allan_Zimmermann)\
**Post date:** [May 22, 2024, 8:38am UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/8 "2024-05-22T08:38:20Z")

</div>

should be solved now.  
Was a bad “:latest” image …  
see here [ID token not issued by expected OpenID provider - #7 by Allan\_Zimmermann](https://discourse.openiap.io/t/id-token-not-issued-by-expected-openid-provider/1348/7)

---

<div class="post-metadata">

**Author:** ![system](https://discourse.openiap.io/uploads/default/original/2X/a/a1ca7b164ac9a826839704d9ac82c7b5e6bcf557.png) [@system](https://discourse.openiap.io/u/system)\
**Post date:** [May 29, 2024, 8:38am UTC](https://discourse.openiap.io/t/nodered-agent-error-id-token-not-issued-by-expected-openid-provider/1343/9 "2024-05-29T08:38:52Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.