Authelia - Attempt to decode JSON with unexpected mimetype: application/jwt

[snyssen]

Hello,

I am trying to setup the integration with my Authelia instance, following the configuration at https://github.com/christiaangoossens/hass-oidc-auth/blob/v0.6.2-alpha/docs/provider-configurations/authelia.md. I have tried both public and confidential client configurations, but both result in the same error:

025-07-23 12:49:10.278 ERROR (MainThread) [aiohttp.server] Error handling request from 172.30.33.1
Traceback (most recent call last):
  File "/usr/local/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 510, in _handle_request
    resp = await request_handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/aiohttp/web_app.py", line 569, in _handle
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/aiohttp/web_middlewares.py", line 117, in impl
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/security_filter.py", line 92, in security_filter_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/forwarded.py", line 210, in forwarded_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/request_context.py", line 26, in request_context_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/ban.py", line 86, in ban_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/auth.py", line 242, in auth_middleware
    return await handler(request)
           ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/components/http/headers.py", line 41, in headers_middleware
    response = await handler(request)
               ^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/src/homeassistant/homeassistant/helpers/http.py", line 73, in handle
    result = await handler(request, **request.match_info)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/config/custom_components/auth_oidc/endpoints/callback.py", line 42, in get
    user_details = await self.oidc_client.async_complete_token_flow(
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
        redirect_uri, code, state
        ^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/config/custom_components/auth_oidc/oidc_client.py", line 522, in async_complete_token_flow
    data = await self.parse_user_details(id_token, access_token)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/config/custom_components/auth_oidc/oidc_client.py", line 422, in parse_user_details
    userinfo = await self._get_userinfo(userinfo_endpoint, access_token)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/config/custom_components/auth_oidc/oidc_client.py", line 235, in _get_userinfo
    return await response.json()
           ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/aiohttp/client_reqrep.py", line 749, in json
    raise ContentTypeError(
    ...<7 lines>...
    )
aiohttp.client_exceptions.ContentTypeError: 200, message='Attempt to decode JSON with unexpected mimetype: application/jwt; charset=utf-8', url='https://auth.[REDACTED]/api/oidc/userinfo'

On Authelia, I see the request processed successfully:

{"level":"debug","method":"GET","msg":"User Info Request with id '7eb103a1-88a3-4b7b-8bbc-3c87c236688d' is being processed","path":"/api/oidc/userinfo","remote_ip":"[REDACTED]","time":"2025-07-23T12:22:56+02:00"}
{"level":"debug","method":"GET","msg":"User Info Request with id '7eb103a1-88a3-4b7b-8bbc-3c87c236688d' on client with id '[REDACTED]' is being returned signed as per the registered client configuration with key id '3170d1-rs256' using the 'RS256' algorithm","path":"/api/oidc/userinfo","remote_ip":"[REDACTED]","time":"2025-07-23T12:22:56+02:00"}
{"level":"debug","method":"GET","msg":"User Info Request with id '7eb103a1-88a3-4b7b-8bbc-3c87c236688d' on client with id '[REDACTED]' was successfully processed","path":"/api/oidc/userinfo","remote_ip":"[REDACTED]","time":"2025-07-23T12:22:56+02:00"}

[christiaangoossens]

The guide is wrong, we don't support signed userinfo. You can follow the config over at https://www.authelia.com/integration/openid-connect/home-assistant/ instead.

Seems like I forgot about fixing this one, so we'll keep this issue open.

[christiaangoossens]

Ah, you are linking to the specific version of the doc for the last release. It has already been corrected on the master/main branch as well: https://github.com/christiaangoossens/hass-oidc-auth/blob/main/docs%2Fprovider-configurations%2Fauthelia.md

[snyssen]

Oh indeed, I did not notice sorry. I think I was brought to that version by the link on the documentation in HACS. I will try with the updated link, thank you.

[snyssen]

Documentation from https://www.authelia.com/integration/openid-connect/home-assistant/ is correct, thank you!

However it seems the documentation at https://github.com/christiaangoossens/hass-oidc-auth/blob/main/docs%2Fprovider-configurations%2Fauthelia.md is out of date as it does not set the following fields:

identity_providers:
  oidc:
    ## The other portions of the mandatory OpenID Connect 1.0 configuration go here.
    ## See: https://www.authelia.com/c/oidc
    clients:
      - client_id: 'home-assistant'
        [...]
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'

Though I think only the last two are really needed, but I am unsure to be honest.

[christiaangoossens]

Those are optional (these are the defaults) indeed, so both would work.