Unable to integrate Thales and getting Oauth error

[baladevopsconsultant]

#kubectl logs -f -l app=librechat \
  -n secure-ai -c librechat 2>/dev/null |
  grep -iE
  "THALES DEBUG|openid|error|unknown|message|description|OPError|RPError|response"
2026-04-27 06:49:37 info: Configuring OpenID Connect...
2026-04-27 06:49:37 info: OpenID Connect configured.
[THALES DEBUG] Raw error caught: {
  message: 'unknown_error',
  name: 'OPError',
  error: 'unknown_error',
  error_description: undefined,
  isOPError: true,
  isRPError: false
[THALES DEBUG] error.response.body: {"error":"unknown_error"}
2026-04-27 06:50:23 error: Error in OAuth authentication: unknown_error
^C
#kubectl logs -l app.kubernetes.io/name=ingress-nginx
  -n ingress-nginx --tail=20 |
  grep -iE "openid|callback|oauth"

Look at the timestamps:

GET /oauth/openid (user clicks) timestamp

GET /oauth/openid/callback timestamp

How many seconds between them?

If > 60 seconds → code expired

10.1.x.z - [27/Apr/2026:06:50:01 +0000] "GET /oauth/openid HTTP/2.0" 302 0 "https://quercxx.xxxx.com/login" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 35 0.013 [secure-ai-librechat-service-80] [] 10.1.x.z:3080 0 0.013 302 6c384e2b6534af653854157ca7362a0c
10.1.x.z- - [27/Apr/2026:06:50:22 +0000] "GET /oauth/openid/callback?state=TwbtRIgw9yQgZHaDR69HpOYZtALBL6tEaA2vErDtVqk&session_state=d796b1a9-de26-487b-9a5f-e90693e32470&code=ca57f7c9-3e95-4a3c-a719-d33217348dd3.d796b1a9-de26-487b-9a5f-e90693e32470.111ff470-d59c-4009-8a7a-1a61c142eeb3 HTTP/2.0" 302 70 "https://idp.safenetid.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 211 0.331 [secure-ai-librechat-service-80] [] 10.1.x.z:3080 70 0.332 302 97f827982fcfbe05a55f00bdfd4e7b05
10.1.x.z - - [27/Apr/2026:06:50:23 +0000] "GET /oauth/error HTTP/2.0" 302 79 "https://idp.safenetid.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" 36 0.008 [secure-ai-librechat-service-80] [] 10.1.x.z:3080 79 0.008 302

#kubectl logs -l app.kubernetes.io/name=ingress-nginx
  -n ingress-nginx --tail=50 |
  grep "openid/callback" |
  awk '{print $1, $2, $7}' | tail -10

10.1.xx.xx- /oauth/openid/callback?state=o5culbPuyL1qfmbp9rIQsosgzp1kX678imm3QrPL_0c&session_state=d796b1a26-487b-9a5f-e90693e3&code=0cea314f-ba20-48f0-85e3-e96eef2eb148.a9-de26-487b-9a5f-e90693e32470.111ff470-d59c-4009-8a7a-1a61
10.1.xx.xx - /oauth/openid/callback?state=TwbtRIgw9yQgZHaDROYZtALBL6tEaA2vErDtVqk&session_state=d796b1a9-de26-487b-9a5f-e90693e32470&code=ca57f7c9-3e95-4a3c-a719-d3321734b1a9-de26-487b-9a5f-e90693e32470.111ff470-d59c-4009-8a7a-1a6

Haven't shared the exact session id and IP details but the above is the log which we are obtaining.

Please help and one more thing for azure entra id we were able to integrate.

[baladevopsconsultant]

Hi @danny-avila ,

Could you please share your solution for it ASAP

[danny-avila]

Sounds like Thales is not fully OIDC compliant or you have a misconfiguration issue. I cannot propose a fix as I cannot easily reproduce your setup for this IDP, and nothing is apparent from your logs what the issue might be.

Note, there are no observed issues with major IDP providers with OIDC, i.e. Auth0, Entra, including OSS solutions such as Keycloak, Authentik.