Horde 5.8.0 – Google OIDC Desktop client configuration

anonymous-edc · September 8, 2026, 3:02pm

Hello

I am trying to configure Unreal Horde 5.8.0 with Google as the OIDC provider, including authentication for Unreal Build Accelerator (UBA).

I created a “Desktop App” OAuth client in Google Cloud. According to Google’s OAuth documentation, Desktop applications are public clients. The client has both a Client ID and a Client Secret available in the Google UI.

With the following Horde configuration, browser authentication works correctly:

"AuthMethod": "OpenIdConnect",
"OidcAuthority": "https://accounts.google.com",
"OidcClientId": "my-client-id",
"OidcAudience": "my-client-id",
"OidcClientSecret": "my-client-secret",

"AdminClaimType": "http://epicgames.com/ue/horde/user",
"AdminClaimValue": "my-email"

The AdminClaimType / AdminClaimValue configuration is only temporary and is not related to the authentication problem. It is only used to give my test account administrator permissions.

After logging into Horde through the browser, I can access the Horde web interface and see agents and other Horde functionality.

However, when attempting to use distributed compilation with UBA, i see this error in the cmd with horde server running:

[13:58:26 wrn] OIDC config mismatch: Command-line auth requires a public OAuth/OIDC client, but a confidential client is configured (OidcClientSecret is set). This will prevent Horde's C# client from signing in and block usage of Unreal Build Accelerator. To fix: Configure your OAuth/OIDC client as public (SPA/mobile/desktop) and remove the client secret

Following this warning, I removed OidcClientSecret from server.json.

After doing so, browser authentication no longer works. Google returns:

invalid_request
error_description: client_secret is missing

Horde logs:

Unhandled exception for POST /signin-oidc: An error was encountered while handling the remote login.

Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectProtocolException:
Message contains error: 'invalid_request', error_description: 'client_secret is missing.', error_uri: 'error_uri is null'.

   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.RedeemAuthorizationCodeAsync(OpenIdConnectMessage tokenEndpointRequest)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

Therefore, I currently have two mutually exclusive states:

With OidcClientSecret:

Horde browser authentication works.
UBA client authentication is rejected because Horde considers the OIDC client confidential.

Without OidcClientSecret:

Horde browser authentication fails because Google’s token endpoint returns “client_secret is missing”.
UBA also does not work.

I also found the following discussions on Google’s developer forums that appear to describe similar behavior with Desktop App clients and authorization-code flow without a client secret:

https://discuss.google.dev/t/authorization-code-flow-without-client-secret/168113/7

https://discuss.google.dev/t/google-auth-platform-question-about-desktop-app-client-and-secret/178938/3

So generally i have few questions:

Is there a tested and supported way to configure Google OIDC with Horde so that both browser authentication and UBA client authentication work?

If yes, what is the correct Horde/Google configuration for this setup, particularly regarding the OAuth client type and OidcClientSecret?

Also, should OidcAudience be set to the Google OAuth Client ID in this configuration?

Please let me know if any additional details are required.

Thank you in advance,

Uladzislau

[Attachment Removed]

anonymous-edc · September 8, 2026, 3:02pm

Steps to Reproduce

Create an OAuth client for Desktop application
Obtain the Client ID and Client Secret.
Using server.json configure Horde with the following:

"AuthMethod": "OpenIdConnect",
"OidcAuthority": "https://accounts.google.com",
"OidcClientId": "my-client-id",
"OidcAudience": "my-client-id",
"OidcClientSecret": "my-client-secret"

Start Horde.
Log into Horde using Google authentication.
Verify that browser authentication works.
Attempt to use UBA/distributed compilation.
Horde reports the “Command-line auth requires a public OAuth/OIDC client” warning shown above.
Remove OidcClientSecret from Server.json.
Restart Horde.
Attempt to log into Horde again.
Browser authentication fails with “invalid_request / client_secret is missing”.

[Attachment Removed]

itho · September 9, 2026, 11:49am

Hello, this warning can be a bit misleading, because Horde reuses the same OIDC client credentials set in the config for multiple purposes.

Horde uses the OidcClientSecret so that it can do the things a web server does when acting as a private client, and our tooling then uses the same OIDC client as a public client, without the secret.

Beyond the warning in the logs, are you experiencing any subsequent issues when operating with the client secret set?

Separately, you may run into issues when using Google for auth, as outlined in this readme:

https://github.com/EpicGames/UnrealEngine/blob/5\.8\.2\-release/Engine/Source/Programs/OidcToken/readme.md\#google

We have reports that some licensees have used Dex to work around the lack of groups in the id tokens, but this hasn’t been tested internally.

Please see this related post for more details: [Content removed]

[Attachment Removed]

anonymous-edc · September 10, 2026, 11:21am

Thanks for the clarification. Yes, I am experiencing issues with the client secret set.

With the client secret configured, Horde browser authentication works correctly. However, authentication from the applications does not work.

For example, when running UBA with Horde over HTTPS on localhost:

Using Unreal Build Accelerator executor to run 488 action(s)

Horde URL: https://localhost:13341/, Pool: Win-UE5, Cluster: (none), Condition: (none), Connection: (none), Encryption: (none), MaxCores: 576, MaxWorkers: 64, MaxIdle: 15s

Storage capacity 40Gb

---- Starting trace: 260910_125802 ----

UbaServer - Listening on 0.0.0.0:1345

GET https://localhost:13341/api/v1/server/auth failed ((null)). Delaying for 1000ms (attempt #1).

GET https://localhost:13341/api/v1/server/auth failed ((null)). Delaying for 5000ms (attempt #2).

GET https://localhost:13341/api/v1/server/auth failed ((null)). Delaying for 10000ms (attempt #3).

GET https://localhost:13341/api/v1/server/auth failed ((null)). Delaying for 30000ms (attempt #4).

GET https://localhost:13341/api/v1/server/auth failed ((null)). Delaying for 30000ms (attempt #5).

Unable to create Horde session: The SSL connection could not be established, see inner exception.

I get essentially the same error in Unreal Toolbox.

In both UBA and Unreal Toolbox, the browser window for authentication is never opened. So it appears that the tooling fails while trying to establish the HTTPS connection to Horde, before it gets to the point where it can initiate the browser-based authentication flow.

Interestingly, if I open the https://localhost:13341/api/v1/server/auth directly in my browser, i do get a response:

{“method”:“OpenIdConnect”,“serverUrl”:“https://accounts.google.com”,“clientId”:“{my_client_id}”,“localRedirectUrls”:[“http://localhost:8749/ugs.client"],“scopes”:\[“offline\_access”,"openid”]}

So the endpoint itself appears to be working, although the client fails when trying to access it.

I tried to find additional info in logs. I checked:

C:\Users\myuser\AppData\Local\Epic Games\Unreal Toolbox\Log.txt

and the AutomationTool logs under:

Engine\Programs\AutomationTool\Saved\Logs\

but I couldn’t find any additional useful information about the authentication/SSL failure.

Is there a more detailed log for the Horde client authentication / OidcToken flow, UBA, or Unreal Toolbox that I should enable or collect? Or maybe you have any other idea how to investigate this exception?

One more question regarding the Google-specific issues mentioned in the links you provided.

Can Google be used directly with Horde, with the only limitation being that Google groups cannot be used for permissions?

Or is an additional identity provider such as Dex required even for basic Google authentication?

My plan is simply to give all authenticated users the same default permissions, with only a few users having admin permissions, so the first path is acceptable for me.

[Attachment Removed]

itho · September 11, 2026, 11:42am

This doesn’t look related to the client secret, since the auth configuration is read from the “/api/v1/server/auth” endpoint, which is the failing request.

It seems more likely that there is a certificate issue causing the SSL connection error, perhaps because it’s on localhost.

Unfortunately, I don’t think the UBA logs will have any additional info on this.

Could you run “curl.exe -v https://localhost:13341/api/v1/server/auth” from the agent under the same user account that runs builds?

On Google auth, we don’t use this internally, but that OidcToken document calls out that they do not provide JWTs, which will be a blocker for API authorization, regardless of the permission structure.

The route with Dex is one we’ve recommended before, and I also found this PR with additional setup instructions related to it.

https://github.com/EpicGames/UnrealEngine/pull/12353/changes

[Attachment Removed]