Re-enabling Local Login in Audiobookshelf After Locking Yourself Out with OIDC
Getting back into Audiobookshelf after disabling local auth and breaking OIDC: finding the config in a TrueNAS ixVolume, editing the SQLite settings with a newer SQLite in a throwaway container, and turning local login back on.
Audiobookshelf lets you disable local authentication once OIDC is working. That’s a sensible thing to do right up until the OIDC login stops working. Change the redirect URI, swap identity providers, or get a claim wrong, and you’re left with a login page that sends you to the IdP and nothing to fall back on.
The setting that controls this lives in the Audiobookshelf SQLite database, so the fix is to edit it directly. Here’s how to do it on TrueNAS, where the app runs as an ix app and the config sits inside an ixVolume.
1. Stop the App
Don’t edit the database while Audiobookshelf has it open. In the TrueNAS UI go to Apps, then Installed Applications, and stop the audiobookshelf app.
Open System, then Shell (or SSH in as root) for the rest of this.
2. Find the Config
With an ixVolume there’s no host path in the app config to copy. TrueNAS manages the dataset itself, and on 24.10 (Electric Eel) and later it lives here:
1
2
cd /mnt/.ix-apps/app_mounts/audiobookshelf/config
ls
You should see absdatabase.sqlite in there. On 24.04 (Dragonfish) and earlier the same data is under /mnt/<pool>/ix-applications/releases/audiobookshelf/volumes/ix_volumes/config.
Take a backup before touching anything:
1
cp absdatabase.sqlite absdatabase.sqlite.bak
3. Why the Host sqlite3 Won’t Work
The obvious next step is to open the database with sqlite3. On TrueNAS that fails:
1
2
sqlite3 absdatabase.sqlite "select value from settings where key='server-settings';"
# Error: in prepare, malformed database schema (update_library_items_author_names_on_book_authors_insert) - near "ORDER": syntax error (11)
The database isn’t corrupt. Audiobookshelf creates triggers that use group_concat(... ORDER BY ...), which needs SQLite 3.44 or newer. The version on the TrueNAS host is older, so it can’t parse the schema and gives up before running your query.
You can’t install a newer one on the host, since the root filesystem is managed by TrueNAS. Docker is already there though, so use a throwaway container.
4. Check the Current Auth Methods
Write the SQL to a file with a quoted heredoc. This keeps the shell away from the quotes, which matters because the JSON path contains a $ and the values contain double quotes:
1
2
3
cat > fix.sql <<'EOF'
select json_extract(value,'$.authActiveAuthMethods') from settings where key='server-settings';
EOF
Then run it with a current SQLite in Alpine, mounting the config directory into the container:
1
docker run --rm -v "$PWD":/db alpine:3.20 sh -c 'apk add --no-cache sqlite >/dev/null && sqlite3 /db/absdatabase.sqlite < /db/fix.sql'
If local auth is disabled you’ll see:
1
["openid"]
That’s the problem. Audiobookshelf only accepts OIDC logins.
5. Turn Local Login Back On
Add local back to the list. Keep openid in there so you don’t have to reconfigure the provider later:
1
2
3
4
5
6
cat > fix.sql <<'EOF'
update settings set value=json_set(value,'$.authActiveAuthMethods',json('["local","openid"]')) where key='server-settings';
select json_extract(value,'$.authActiveAuthMethods') from settings where key='server-settings';
EOF
docker run --rm -v "$PWD":/db alpine:3.20 sh -c 'apk add --no-cache sqlite >/dev/null && sqlite3 /db/absdatabase.sqlite < /db/fix.sql'
The select at the end confirms the write:
1
["local","openid"]
Clean up and make sure the file is still owned by the app user. TrueNAS apps normally run as uid and gid 568:
1
2
rm fix.sql
chown 568:568 absdatabase.sqlite
6. Start the App and Log In
Start the app again from the TrueNAS UI. The login page now shows the username and password form alongside the Login with OpenID button.
If Auto Launch is enabled you’ll be redirected to the IdP before you see the form. Skip that with:
1
https://your-audiobookshelf-host/login?autoLaunch=0
Log in with your local admin account, then go to Settings, then Authentication and fix whatever broke OIDC. If you serve Audiobookshelf from a subpath, remember to set Subfolder for redirect URLs to match. The redirect URIs to check in your IdP are:
https://your-audiobookshelf-host/auth/openid/callbackhttps://your-audiobookshelf-host/auth/openid/mobile-redirect
Once OIDC works again you can disable local auth if you want to, but leave yourself a way back in. Keeping a single local admin account is cheap insurance.
Done
The whole thing comes down to one JSON value in one table:
1
stop app → find config → newer SQLite in a container → set authActiveAuthMethods → start app
A quick check:
1
ls -l /mnt/.ix-apps/app_mounts/audiobookshelf/config/absdatabase.sqlite
It should be owned by 568. If anything goes wrong, copy absdatabase.sqlite.bak back over the original and start again.