Bug: OIDC SSO login fails — JWKS fetch "resource registered but not ready" timeout (v2.10.2)

Author: e-duMaurierCreated Sep 5, 2026Updated Sep 10, 2026

Labelstriage

Bug Description

I have just started using Arcane and attempted to set up OIDC with Authentik.

The failure seems to occur inside Arcane when it fetches the idP's JWKS endpoint. I have verified the JWKS URL is reachable from within the Arcane container network (curl returns HTTP 200 with valid JSON key in milliseconds), so it doesn't appear to be a network, DNS, or TLS issue. It also reproduces identically behind a Traefik reverse proxy and direct access to the published port with no proxy in the path.

Steps To Reproduce

Run Arcane manager v2.10.2 via Docker Compose, OIDC SSO enabled against an Authentik provider (issuer …/application/o/arcane, client ID/secret, scopes openid email profile).
Open Arcane, click the SSO (Authentik) button.
Complete authentication at the IdP; browser is redirected back to Arcane's callback.
After ~30 s, Arcane shows a login error page: http://<arcane-host>/login?error=oidc_callback_error&message=OIDC+callback+failed%3A…context+deadline+exceeded
Repeat via both (a) the reverse-proxy ingress URL and (b) direct http://<arcane-host>:3552 — identical result.

Expected Behavior

OIDC callback completes; Arcane fetches the IdP JWKS, verifies the ID token signature, and the user is logged in.

Actual Behavior

The callback fails server-side with the JWKS "resource registered but not ready: context deadline exceeded" error after ~30 s; login is rejected.

Screenshots

Arcane Version

v2.10.2

Installation Method

Docker Compose (Recommended)

Environment Type

Local Docker (Single instance)

Database Type

SQLite (Default)

Operating System

Linux

Docker Version

29.7.2

Browser & Version

Librewolf 153.0.1-1, Brave 1.94.1119, Version 152.0.7977.82

Relevant Logs or Error Messages

bash

- Callback error (browser): full `?error=oidc_callback_error&message=OIDC+callback+failed%3A+failed+to+configure+provider+JWK+set%3A+failed+to+register+JWKS+URL%3A+failed+to+add+resource%3A+resource+registered+but+not+ready%3A+context+deadline+exceeded`
- Container log (via `docker logs arcane --since 3m`): `OIDC callback failed: failed to configure provider JWK set: failed to register JWKS URL: failed to add resource: resource registered but not ready: context deadline exceeded` 
labemma@mgmt:~/arcane$ docker logs arcane --since 3m
Sep 05 19:20:19.652 INF Incoming request method=GET path=/service-worker.js duration=70.039µs status=200
Sep 05 19:20:30.003 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:20:30.004 INF Job finished name=docker-client-refresh
Sep 05 19:20:49.854 WRN OIDC callback failed error="failed to configure provider JWK set: failed to register JWKS URL: failed to add resource: resource registered but not ready: context deadline exceeded" origin=https://arcane.infra.dumalabs.uk state_present=true code_present=true
Sep 05 19:20:49.854 WRN Bad Request method=POST path=/api/oidc/callback duration=31.726675672s status=400
Sep 05 19:20:52.872 WRN Unauthorized method=GET path=/api/auth/me duration=109.946µs status=401
Sep 05 19:20:52.872 WRN Not Found method=GET path=/api/auth/auto-login-config duration=86.891µs status=404
Sep 05 19:20:52.882 INF Incoming request method=GET path=/api/environments/0/settings/public duration=248.714µs status=200
Sep 05 19:20:52.961 INF Incoming request method=GET path=/api/app-version duration=89.057831ms status=200
Sep 05 19:20:52.968 INF Incoming request method=GET path=/api/auth/passkey/login/availability duration=121.988µs status=200
Sep 05 19:21:00.001 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:21:00.002 INF Job finished name=docker-client-refresh
Sep 05 19:21:30.003 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:21:30.005 INF Job finished name=docker-client-refresh
Sep 05 19:22:00.004 INF Job starting name=environment-health:0 schedule="0 */2 * * * *"
Sep 05 19:22:00.004 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:22:00.005 INF Job finished name=docker-client-refresh
Sep 05 19:22:00.034 INF Job finished name=environment-health:0
Sep 05 19:22:30.003 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:22:30.004 INF Job finished name=docker-client-refresh
Sep 05 19:23:00.005 INF Job starting name=docker-client-refresh schedule="*/30 * * * * *"
Sep 05 19:23:00.006 INF Job finished name=docker-client-refresh


- In-container connectivity proof:
  `docker run --rm --network <arcane-network> curlimages/curl -sv -m 25 https://<authentik>/application/o/arcane/jwks/` → `HTTP 200`, TLS 1.3, h2, valid `{"keys":[...]}` — completes in ms

Docker Compose Configuration

yaml

services:
  arcane:
    image: ghcr.io/getarcaneapp/manager:v2.10.2
    container_name: arcane
    ports:
      - '3552:3552'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./data:/app/data
    environment:
      - APP_URL=https://arcane.example.com
      - PUID=1000
      - PGID=1000
      - ENCRYPTION_KEY=<REDACTED>
      - JWT_SECRET=<REDACTED>
      - TRUSTED_PROXIES=<trusted-cidr>
      - OIDC_ENABLED=true
      - OIDC_CLIENT_ID=<REDACTED>
      - OIDC_CLIENT_SECRET=<REDACTED>
      - OIDC_ISSUER_URL=https://auth.example.com/application/o/arcane
      - OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/arcane/jwks/
      - OIDC_SCOPES=openid email profile
      - OIDC_PROVIDER_NAME=Authentik
      - OIDC_MERGE_ACCOUNTS=false
    cgroup: host
    restart: unless-stopped

Environment Configuration (.env file)

bash

ENCRYPTION_KEY=<REDACTED>
JWT_SECRET=<REDACTED>
APP_URL=https://arcane.example.com
TRUSTED_PROXIES=<trusted-cidr>
OIDC_CLIENT_ID=<REDACTED>
OIDC_CLIENT_SECRET=<REDACTED>
OIDC_ISSUER_URL=https://auth.example.com/application/o/arcane
OIDC_JWKS_ENDPOINT=https://auth.example.com/application/o/arcane/jwks/
OIDC_SCOPES=openid email profile
OIDC_PROVIDER_NAME=Authentik

Additional Context

IdP: Authentik 2026.5.5 (at time of reproduction) — provider slug arcane; discovery doc's issuer and jwks_uri both carry a trailing slash (…/application/o/arcane/ and …/application/o/arcane/jwks/). Note: this was reproduced before upgrading Authentik, and the IdP is currently being updated to 2026.8.1.
The OIDC_JWKS_ENDPOINT is set to the exact slashed jwks_uri and is used in manual-endpoints mode; the timeout persists regardless of that setting.
Exclusion of #3793: that issue is the browser-facing failure where oversized ML-DSA session cookies overflow nginx-family proxy buffers; here the error is raised server-side before any response is sent, and it reproduces with no proxy in the path, so proxy_buffer_size changes are inapplicable.
While testing versions, the app logged: database schema version 80 is newer than this Arcane binary supports (target 74 for sqlite) — confirms SQLite and schema 80.

Source: getarcaneapp/arcane

View original on GitHub View discussion on GitHub