https://datahubproject.io logo
Join Slack
Powered by
```2021-09-22T20:07:53-04:00 00:07:53 [application...
# troubleshoot
c
Copy code
2021-09-22T20:07:53-04:00 00:07:53 [application-akka.actor.default-dispatcher-197] WARN  auth.sso.oidc.OidcCallbackLogic - Failed to extract groups: No OIDC claim with name groups found
What would cause this error?
i am using oidc / ibm appid and have the scope set to 
scopes    = ["email", "profile"]
b
please use the following scopes:
Copy code
openid profile email
That warning is just saying that there were no groups fields found in the response from IBM
So we cannot provision any (we attempt to provision the groups the user is in by default)
c
openid is added by default ( i think )
do i need to add groups?
i switched over to okta for test and that went thru okay except for logout
b
what occurred during logout?
and you dont need to add groups, no
if you don't nothing will break or anything
i've seen a case (iirc) where login was not working because the openid scope was missing
if there is something wrong with our ability to integrate with IBM, though, it'd definitely be good to know
c
on okta logout (https://{base}/logout) - i get
b
Okay thanks - it appears you need to configure the logout redirect URL with Okta
c
that i did
@big-carpet-38439, back to ibmcloud-appid , here is my user detail.
Copy code
{
  "id": "e826ddff-a3d1-45a6-90a8-7779580caf2d",
  "email": "<mailto:amit.varangaonkar@employer.com|amit.varangaonkar@employer.com>",
  "given_name": "Amit",
  "family_name": "Varangaonkar",
  "identities": [
    {
      "provider": "saml",
      "id": "<mailto:amit.varangaonkar@employer.com|amit.varangaonkar@employer.com>",
      "idpUserInfo": {
        "name_id": "<mailto:amit.varangaonkar@employer.com|amit.varangaonkar@employer.com>",
        "attributes": {
          "cn": "Amit A Varangaonkar",
          "emailAddress": "<mailto:amit.varangaonkar@employer.com|amit.varangaonkar@employer.com>",
          "uid": "####",
          "firstName": "Amit",
          "lastName": "Varangaonkar",
          "blueGroups": [
            "cn=US Employees,ou=memberlist,ou=groups,o=<http://employer.com|employer.com>",
          ]
        },
        "entityID": "https://<base>/saml/sps/saml20ip/saml20"
      }
    }
  ],
  "attributes": {},
  "roles": [
    {
      "id": "5bb87e02-f10e-4f24-a67c-afde7383f0c5",
      "name": "datahub"
    }
  ]
}
i am setting up 
AUTH_OIDC_GROUPS_CLAIM
via 
extraEnvs
Copy code
#extraEnvs-7
set {
  name  = "datahub-frontend.extraEnvs[8].name"
  value = "AUTH_OIDC_GROUPS_CLAIM"
}
set {
  name  = "datahub-frontend.extraEnvs[8].value"
  value = "roles"
}
and still get 
WARN  auth.sso.oidc.OidcCallbackLogic - Failed to extract groups: No OIDC claim with name roles found
Do i need to add regex?
b
Hey @careful-artist-3840 - So currently the only group claims we support are a flat array of group names. It seems that your roles are complex objects. Is there any way to leave out the id part and just provide a claim with a list of strings?
c
not really , this is a cloud managed service and we dont have ability to tweak.
b
Typically you can adjust the claims from these identity providers via their dashboard
But if you cannot, then perhaps just disable the groups extraction...
4 Views
Open in Slack
PreviousNext
Powered by