Failed to save client

[James-Brittain]

getting an error "Failed to save client" in the browser when trying to create a new OIDC client on a Debian 12 LXC in proxmox.

logs from 'docker compose logs -f'

tsidp | 2025/11/02 13:09:42 tsnet running state path /home/app/.config/tsnet-tsidp-server/tailscaled.state
tsidp | 2025/11/02 13:09:42 tsnet starting with hostname "idp", varRoot "/home/app/.config/tsnet-tsidp-server"
tsidp | 2025/11/02 13:09:42 LocalBackend state is NeedsLogin; running StartLoginInteractive...
tsidp | 2025/11/02 13:09:42 INFO tsidp server started server_url=https://idp.xxxxxxxx.ts.net
tsidp | 2025/11/02 13:09:47 AuthLoop: state is Running; done
tsidp | 2025/11/02 13:10:45 ERROR client create: could not write funnel clients db error="open oidc-funnel-clients.json: permission denied"

compose file used:

services:
tsidp:
container_name: tsidp
image: ghcr.io/tailscale/tsidp:latest
volumes:
- tsidp-data:/data
environment:
- TAILSCALE_USE_WIP_CODE=1 # tsidp is experimental - needed while version <1.0.0
- TSIDP_STATE_DIR=/data # store persistent tsnet and tsidp state
- TSIDP_HOSTNAME=idp # Hostname on tailnet (becomes idp.your-tailnet.ts.net)
- TSIDP_ENABLE_STS=1 # Enable OAuth token exchange
# Optional: Tailscale auth key for automatic node registration
- TS_AUTHKEY=tskey-auth-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
volumes:
tsidp-data:

[stevetrease]

Maybe permissions on the persist file or folder on the host?
The unix userid that tsidp runs under changed recently, so make sure that userid can access the folder and file.

[James-Brittain]

Not super familiar with docker, is that a file/folder within the docker mount point or somewhere else on the host?

[stevetrease]

This: tsidp-data:/data
However, since you’ve set it as a docker volume I’m not sure how you would go about changing the ownership of the files in it.

I just use a host os folder with ./data:/data. That creates a folder in the current directory called data and mounts is as /data inside the Tsidp container.

[James-Brittain]

ok thanks, il take another look over it tomorrow

As far as I can remember everything was like for like based on the recommended pre-built image

[mnejmantowicz]

I added these two lines to my docker compose to get it to work:

privileged: true
user: root:root

[mostlygeek]

Hi @James-Brittain

As part of a security update we changed the default user and group to app:app. Try these commands to fix the container permissions:

> docker-compose down 
> docker run --rm -v tsidp_tsidp-data:/data alpine:latest chown -R 1001:1001 /data
> docker-compose up