Hi everyone, Trying to set up OIDC using the below configuration

extraEnvs:
  - name: AUTH_OIDC_ENABLED
    value: "true"
  - name: AUTH_OIDC_CLIENT_ID
    value: MMSOauthClient
  - name: AUTH_OIDC_CLIENT_SECRET
    value: "<value>"
  - name: AUTH_OIDC_DISCOVERY_URI
    value: https://<saml-host>/.well-known/openid-configuration
  - name: AUTH_OIDC_BASE_URL
    value: https://<host>/

It is redirecting to this <https://<hostname>/#error_description=The+global+default+access+token+manager+is+not+available+for+the+selected+client+and+authentication+context&error=invalid_request|https://<hostname>/#error_description=The+global+default+[…]ication+context&error=invalid_request>

Hi, are you sure about the AUTH_OIDC_CLIENT_ID? The value you entered seems more a module than an ID (MMSOauthClient)

@stale-jewelry-2440 Yes the client _id value is correct. Getting this

Internal server error. The OIDC service responded with an error: 'unauthorized_client'.
Error description: 'authorization_code grant not allowed for this client'

I have a similar configuration, with all those fields set, and it works. The quotes are ok, since the call to the saml-hostname works

@stale-jewelry-2440 play.api.UnexpectedException: Unexpected exception[CompletionException: org.pac4j.core.exception.TechnicalException: Missing state parameter] at play.api.http.HttpErrorHandlerExceptions$.throwableToUsefulException(HttpErrorHandler.scala:247) at play.api.http.DefaultHttpErrorHandler.onServerError(HttpErrorHandler.scala:176) at play.core.server.AkkaHttpServer$$anonfun$2.applyOrElse(AkkaHttpServer.scala:363) at play.core.server.AkkaHttpServer$$anonfun$2.applyOrElse(AkkaHttpServer.scala:361) at scala.concurrent.Future$$anonfun$recoverWith$1.apply(Future.scala:346)

It seems that your client id has not been configured in your Identity Provider to be able to use the authorization code flow, which is what we use. You may need to configure your IdP to return an Id token and an access token! Which identity provider are you using?

@big-carpet-38439 - The CLient id has been configured in the Identity provider. We are using Ping Federate as the IDP...OAuth ClientID has been configured ..and it generates an access token...see below

And you're still seeing this on DataHub side?

Internal server error. The OIDC service responded with an error: 'unauthorized_client'.
Error description: 'authorization_code grant not allowed for this client'

@big-carpet-38439 From Datahub frontend pod (have Datahub deployed on EKS cluster), I am only getting - play.api.UnexpectedException: Unexpected exception[CompletionException: org.pac4j.core.exception.TechnicalException: Missing state parameter] at play.api.http.HttpErrorHandlerExceptions$.throwableToUsefulException(HttpErrorHandler.scala:247) at play.api.http.DefaultHttpErrorHandler.onServerError(HttpErrorHandler.scala:176) at play.core.server.AkkaHttpServer$$anonfun$2.applyOrElse(AkkaHttpServer.scala:363) at play.core.server.AkkaHttpServer$$anonfun$2.applyOrElse(AkkaHttpServer.scala:361) at scala.concurrent.Future$$anonfun$recoverWith$1.apply(Future.scala:346) at scala.concurrent.Future$$anonfun$recoverWith$1.apply(Future.scala:345)

@handsome-football-66174 i cannot debug easily with this log alone. Do you mind packaging up your GMS and datahub front end logs and sending them over? I can take a deeper look if you can!

@big-carpet-38439 -Sure John, Let me share those. ( though they display the same information as we get from the pod logs)

Thanks!

@big-carpet-38439 - Any idea if OIDC has been integrated with Ping by anyone else in the group? Will post a separate thread on this.

I have unfortunately not heard of anyone using ping:(

@big-carpet-38439 - Anything you could make out of the logs ? Also let me know if we could connect over a call. Will coordinate with the Ping folks.

No kidding! What changed? 🙂

mail atttribute was missing

Let me check the specific set. It seems we cannot get the user's name

@big-carpet-38439

- name: AUTH_OIDC_USER_NAME_CLAIM
  value: "email"
- name: AUTH_OIDC_USER_NAME_CLAIM_REGEX
  value: "([^@]+)"

Tried this and getting the below error Caused by: java.net.URISyntaxException: Illegal character in path at index 8: Saradhi, Keerthi at java.net.URI$Parser.fail(URI.java:2847) at java.net.URI$Parser.checkChars(URI.java:3020) at java.net.URI$Parser.parseHierarchical(URI.java:3104) at java.net.URI$Parser.parse(URI.java:3062) at java.net.URI.<init>(URI.java:588)

It looks like... you are creating the username from a field that contains a string:

@big-carpet-38439 When I configure , does it not pull the username from email ?

- name: AUTH_OIDC_USER_NAME_CLAIM
  value: "email"
- name: AUTH_OIDC_USER_NAME_CLAIM_REGEX
  value: "([^@]+)"

I don't have that on hand.. We need these claims to be returned when we ask for the user info:

first_name, family_name, display_name, email

Hmm, let me try to add these fields . We currently have preferred_username as a field, but somehow it is not pulling the field correctly. Removed the configurations

- name: AUTH_OIDC_USER_NAME_CLAIM
  value: "email"
- name: AUTH_OIDC_USER_NAME_CLAIM_REGEX
  value: "([^@]+)"

oh perfect

@big-carpet-38439 - Still getting this Currently sending the following fields from Ping preferred_username, email, display_name, full_name, first_name, & family_name

yeah your title is missing

Thank you for information!