Hi team, I would like to ask what went wrong in our SSO setup running on K8s. For a long time it’s running perfectly but this week suddently the SSO broke. error from frontend

2023-05-09 00:21:10,599 [application-akka.actor.default-dispatcher-9] ERROR auth.sso.oidc.OidcCallbackLogic - Failed to perform post authentication steps. Redirecting to error page.

errror from GMS

2023-05-09 00:21:10,595 [qtp1645547422-24] WARN  c.d.a.a.AuthenticatorChain:80 - Authentication chain failed to resolve a valid authentication. Errors: [(com.datahub.authentication.authenticator.DataHubSystemAuthenticator,Failed to authenticate inbound request: Provided credentials do not match known system client id & client secret. Check your configuration values...), (com.datahub.authentication.authenticator.DataHubTokenAuthenticator,Failed to authenticate inbound request: Authorization header missing 'Bearer' prefix.)]

Our configs are based here: https://datahubproject.io/docs/authentication/guides/sso/configure-oidc-react-google and I can confirm that the values wasn’t updated or changed. Feedback would be highly appreciated. Thank you!

Hey there 👋 I'm The DataHub Community Support bot. I'm here to help make sure the community can best support you with your request. Let's double check a few things first: ✅ There's a lot of good information on our docs site: www.datahubproject.io/docs, Have you searched there for a solution? ✅ button 2️⃣ It's not uncommon that someone has run into your exact problem before in the community. Have you searched Slack for similar issues? Yes button Did you find a solution to your issue?

Hi Adrian, This seems to be a same error with this thread. could you follow the steps in the thread (clear cache / disabling and enabling login & browsing ) and share how it goes? 🙂 : https://datahubspace.slack.com/archives/CV2UVAPPG/p1683209839095289

hi @delightful-ram-75848 thanks for the reply 🙏 disabling metadata work like a charm. Thank you

global:
  datahub:
    metadata_service_authentication:
      enabled: false

Glad that it worked! 🙂

This is not the recommended approach for the long term... Enabling this authentication flag should actually work...