portainer: Unauthorized with SSO Custom OAuth

Bug description Hello! I am having an issue getting my custom OAuth provider to successfully authenticate with Portainer. Currently when I attempt to click the Login button, it does forward me to my OAuth provider. But when I enter my credentials (which are valid), it sends me back to Portainer and then gives an unauthorized error (see logs below).

Expected behavior I can login with SSO using my custom OAuth provider.

Portainer Logs There are no relevant logs when I check docker logs.

Here is the error from Chrome:

{
    "data": {
        "message": "Unable to authenticate through OAuth",
        "details": "Unauthorized"
    },
    "status": 500,
    "config": {
        "method": "POST",
        "transformRequest": [
            null
        ],
        "transformResponse": [
            null
        ],
        "jsonpCallbackParam": "callback",
        "ignoreLoadingBar": true,
        "data": {
            "code": "de6d660187cc43c5ae6260d1f9b9821a"
        },
        "url": "api/auth/oauth/validate",
        "headers": {
            "Accept": "application/json, text/plain, */*",
            "Content-Type": "application/json"
        }
    },
    "statusText": "",
    "xhrStatus": "complete",
    "resource": {
        "code": "de6d660187cc43c5ae6260d1f9b9821a"
    }
}

Steps to reproduce the issue:

1. Setup a custom OAuth provider
2. Attempt to login.

Technical details:

• Portainer version: Portainer CE 2.16.2
• Docker version (managed by Portainer): Docker version 20.10.22, build 3a2c30
• Platform (windows/linux): Linux
• Command used to start Portainer (docker run -p 9443:9443 portainer/portainer): Compose File:

portainer:
    image: portainer/portainer-ce:2.16.2-alpine
    environment:
      - PGID=1000
      - PUID=1000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /docker/portainer:/data
      - /etc/ssl/certs:/etc/ssl/certs # Used to pass in custom CA
    deploy:
      restart_policy:
        condition: any
    networks:
      - default

• Browser: Chrome 108.0.5359.124 (Official Build) (x86_64)
• Have you reviewed our technical documentation and knowledge base? Yes

Additional context

Here is my OAuth configuration in Portainer:

• Client ID: redacted
• Client secret: redacted
• Authorization URL: https://my-oauth-url.my-domain.tld/openid/authorize
• Access token URL: https://my-oauth-url.my-domain.tld/openid/token
• Resource URL: https://my-oauth-url.my-domain.tld/openid/userinfo
• Redirect URL: https://my-portainer-url.my-domain.tld
• Logout URL: https://my-oauth-url.my-domain.tld/openid/logout
• User identifier: username
• Scopes: openid profile email groups

I do have one more question, what should my callback url be in my OAuth provider? Currently I just used the url of my Portainer instance (e.g. https://my-portainer-url.my-domain.tld reference above in the Redirect URL). Is this correct?

Hopefully someone can provide some help, as I am stumped. I have used this OAuth provider with other applications and not run into this problem, so it seems to either be a configuration with Portainer that I have wrong, or something wrong on the OAuth side like the callback URL.