Hi Team We are trying to get datahub up and running with OIDC SSO on a kubernetes cluster. We followed the documentation regarding Azure AuthN configuration for datahub-frontend. Additional changes we made: • We configured datahub-frontend to use an Ingress controller (avi-lb) with cert-manager annotation to get a TLS certificate issued from our private ACME/PKI instance. • We changed the datahub-frontend.service.type value to ClusterIP as we are using an Ingress controller. • We added some extraEnvs to datahub-frontend to use a proxy where we use a TLS interception mechanism. • We added all the AUTH_OIDC_ settings to the extraEnvs of the datahub-frontend section in the helm chart. Our problem is that SSO is not working and the datahub-frontend pod throws following errors:

2024-02-26 15:27:50,722 [application-akka.actor.default-dispatcher-7] ERROR controllers.SsoCallbackController - Caught exception while attempting to handle SSO callback! It's likely that SSO integration is mis-configured.
java.util.concurrent.CompletionException: org.pac4j.core.exception.TechnicalException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Do we have to provide our private CA/PKI certificates to the JVM or datahub-frontend certificate trust store? Any advice or help is very much appreciated.

Likely yes, if the SSO callback URL is resolved with a non-standard CA the frontend will need to be able to resolve that certificate chain. Not sure exactly what you mean by: "We added some extraEnvs to datahub-frontend to use a proxy where we use a TLS interception mechanism." though, this makes it seem like you're proxying into a different service through the callback url to resolve the certificate chain manually and it's possible that is not working, but maybe I'm misunderstanding.