Just posted this issue Not sure if this has bit anyone else DataHub #troubleshoot

Join Slack

Just posted this issue. Not sure if this has bit a...

# troubleshoot

delightful-sunset-48960

01/23/2023, 5:30 PM

Just posted this issue. Not sure if this has bit anyone else: https://github.com/datahub-project/datahub/issues/7107

big-carpet-38439

01/23/2023, 6:19 PM

Thanks for raising the ticket. Going to respond directly on there

white-hydrogen-24531

01/24/2023, 5:33 PM

@thankful-morning-85093 does this relate to your problem?

thankful-morning-85093

01/24/2023, 6:16 PM

this seems to be different. I am not able to ingest Azure SAML gorups

delightful-sunset-48960

01/25/2023, 12:25 AM

@brainy-tent-14503 I think `datahub-helm`'s latest gh-pages release has the wrong

datahub-frontend

version listed for the

0.2.139

chart

delightful-sunset-48960

01/25/2023, 12:25 AM

this should be

0.2.132

not

0.2.131

delightful-sunset-48960

01/25/2023, 12:26 AM

see: https://github.com/acryldata/datahub-helm/pull/249/files#diff-7494f7091065a117c84576e3023b51135d154b7bb29bbf4ebad2c567ee99d655L17

brainy-tent-14503

01/25/2023, 1:07 AM

Think there was a merge conflict, bumping versions should resolve it here.

delightful-sunset-48960

01/25/2023, 2:39 AM

nice

delightful-sunset-48960

01/25/2023, 2:39 AM

thanks

busy-honey-7362

01/25/2023, 11:29 PM

This issue is still open, it was not resolved by setting the AUTH_OIDC_SCOPE to “openid profile” (removing “email”)

busy-honey-7362

01/25/2023, 11:30 PM

I suspect the issue has something to do with Datahub. Not just that env var

big-carpet-38439

01/25/2023, 11:30 PM

Same issue?

busy-honey-7362

01/25/2023, 11:30 PM

Yes

big-carpet-38439

01/25/2023, 11:31 PM

So you're getting redirected to an error screen is my guess right?

busy-honey-7362

01/25/2023, 11:31 PM

IMG_4659.png

big-carpet-38439

01/25/2023, 11:31 PM

Yep okay... and the logs for datahub-frontend pod are giving any hints?

busy-honey-7362

01/25/2023, 11:31 PM

Let me check!

delightful-sunset-48960

01/25/2023, 11:33 PM

Copy code

│ Caused by: java.lang.RuntimeException: Failed to resolve user name claim from profile provided by Identity Provider. Missing attribute. Attribute: 'email', Regex: '(.*)', Profile: {sub=2QrOwEUELuLJYrqBrZw77hy │
│     at auth.sso.oidc.OidcCallbackLogic.extractUserNameOrThrow(OidcCallbackLogic.java:173)                                                                                                                        │
│     at auth.sso.oidc.OidcCallbackLogic.handleOidcCallback(OidcCallbackLogic.java:121)                                                                                                                            │
│     at auth.sso.oidc.OidcCallbackLogic.perform(OidcCallbackLogic.java:107)                                                                                                                                       │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:86)                                                                                                                 │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:72)                                                                                                                 │
│     at org.pac4j.play.CallbackController.lambda$callback$0(CallbackController.java:54)                                                                                                                           │
│     at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)                                                                                                             │
│     ... 8 common frames omitted                                                                                                                                                                                  │
│ 2023-01-25 22:44:54,329 [application-akka.actor.default-dispatcher-10] ERROR controllers.SsoCallbackController - Caught exception while attempting to handle SSO callback! It's likely that SSO integration is m │
│ java.util.concurrent.CompletionException: java.lang.RuntimeException: Failed to resolve user name claim from profile provided by Identity Provider. Missing attribute. Attribute: 'email', Regex: '(.*)', Profil │
│     at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:314)                                                                                                              │
│     at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:319)                                                                                                            │
│     at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1702)                                                                                                             │
│     at play.core.j.HttpExecutionContext.$anonfun$execute$1(HttpExecutionContext.scala:64)                                                                                                                        │
│     at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:49)                                                                                                                                             │
│     at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)                                                                                                   │
│     at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)                                                                                                                                 │
│     at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1020)                                                                                                                │
│     at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1656)                                                                                                                                  │
│     at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1594)                                                                                                                             │
│     at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:183)                                                                                                                    │
│ Caused by: java.lang.RuntimeException: Failed to resolve user name claim from profile provided by Identity Provider. Missing attribute. Attribute: 'email', Regex: '(.*)', Profile: {sub=2QrOwEUELuLJYrqBrZw77hy │
│     at auth.sso.oidc.OidcCallbackLogic.extractUserNameOrThrow(OidcCallbackLogic.java:173)                                                                                                                        │
│     at auth.sso.oidc.OidcCallbackLogic.handleOidcCallback(OidcCallbackLogic.java:121)                                                                                                                            │
│     at auth.sso.oidc.OidcCallbackLogic.perform(OidcCallbackLogic.java:107)                                                                                                                                       │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:86)                                                                                                                 │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:72)                                                                                                                 │
│     at org.pac4j.play.CallbackController.lambda$callback$0(CallbackController.java:54)                                                                                                                           │
│     at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)

big-carpet-38439

01/25/2023, 11:33 PM

okay yep nice

big-carpet-38439

01/25/2023, 11:34 PM

so let me look i do have one suggestion most liikely

big-carpet-38439

01/25/2023, 11:34 PM

ah yes i see it

big-carpet-38439

01/25/2023, 11:34 PM

the default claim we use for extracting dh usernames is indeed email

big-carpet-38439

01/25/2023, 11:34 PM

try setting thing

big-carpet-38439

01/25/2023, 11:34 PM

this

big-carpet-38439

01/25/2023, 11:35 PM

Copy code

AUTH_OIDC_USER_NAME_CLAIM=upn

big-carpet-38439

01/25/2023, 11:35 PM

on datahub-frontend

big-carpet-38439

01/25/2023, 11:35 PM

If you are using helm, you can place this inside the extraEnvs block

delightful-sunset-48960

01/25/2023, 11:36 PM

can i guess?

delightful-sunset-48960

01/25/2023, 11:36 PM

Copy code

extraEnvs:
    - name: AUTH_OIDC_USER_NAME_CLAIM
      value: name

big-carpet-38439

01/25/2023, 11:36 PM

yes this is the one.. on datahub-frontend

delightful-sunset-48960

01/25/2023, 11:36 PM

🔔 ding ding

delightful-sunset-48960

01/25/2023, 11:36 PM

lol ok i'll try

big-carpet-38439

01/25/2023, 11:36 PM

no prize

big-carpet-38439

01/25/2023, 11:36 PM

today

big-carpet-38439

01/25/2023, 11:36 PM

lol

delightful-sunset-48960

01/25/2023, 11:36 PM

i just searched that error message and found https://github.com/datahub-project/datahub/issues/6958

delightful-sunset-48960

01/25/2023, 11:37 PM

and saw someone commented on it

big-carpet-38439

01/25/2023, 11:37 PM

okay let me document this really quick

big-carpet-38439

01/25/2023, 11:37 PM

because came up a few times

delightful-sunset-48960

01/25/2023, 11:37 PM

should i change the

AUTH_OIDC_SCOPE

back to

openid profile email

big-carpet-38439

01/25/2023, 11:37 PM

no its fine

delightful-sunset-48960

01/25/2023, 11:37 PM

big-carpet-38439

01/25/2023, 11:37 PM

what you have is ok

delightful-sunset-48960

01/25/2023, 11:39 PM

wait,

name

upn

big-carpet-38439

01/25/2023, 11:39 PM

it actually depends on what claim your Idp returns

big-carpet-38439

01/25/2023, 11:39 PM

i think you mentioned some notion of UPN above

delightful-sunset-48960

01/25/2023, 11:39 PM

yeah i think for Azure it's

upn

delightful-sunset-48960

01/25/2023, 11:43 PM

name

didn't work. trying

upn

big-carpet-38439

01/25/2023, 11:43 PM

ok cool

delightful-sunset-48960

01/25/2023, 11:47 PM

failed

big-carpet-38439

01/25/2023, 11:47 PM

same thing?

big-carpet-38439

01/25/2023, 11:48 PM

Do you need to add upn to scope to fetch it? Let me check Azure docs

delightful-sunset-48960

01/25/2023, 11:48 PM

Copy code

│ 2023-01-25 23:47:39,404 [application-akka.actor.default-dispatcher-10] WARN  p.api.mvc.LegacySessionCookieBaker - Cookie failed message authentication check                                                     │
│ 2023-01-25 23:47:40,296 [application-akka.actor.default-dispatcher-13] WARN  p.api.mvc.LegacySessionCookieBaker - Cookie failed message authentication check                                                     │
│ 2023-01-25 23:47:43,276 [application-akka.actor.default-dispatcher-8] WARN  o.p.o.profile.creator.TokenValidator - Preferred JWS algorithm: null not available. Using all metadata algorithms: [RS256]           │
│ 2023-01-25 23:47:43,905 [application-akka.actor.default-dispatcher-8] ERROR controllers.SsoCallbackController - Caught exception while attempting to handle SSO callback! It's likely that SSO integration is mi │
│ java.util.concurrent.CompletionException: java.lang.RuntimeException: Failed to resolve user name claim from profile provided by Identity Provider. Missing attribute. Attribute: 'upn', Regex: '(.*)', Profile: │
│     at java.base/java.util.concurrent.CompletableFuture.encodeThrowable(CompletableFuture.java:314)                                                                                                              │
│     at java.base/java.util.concurrent.CompletableFuture.completeThrowable(CompletableFuture.java:319)                                                                                                            │
│     at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1702)                                                                                                             │
│     at play.core.j.HttpExecutionContext.$anonfun$execute$1(HttpExecutionContext.scala:64)                                                                                                                        │
│     at akka.dispatch.TaskInvocation.run(AbstractDispatcher.scala:49)                                                                                                                                             │
│     at akka.dispatch.ForkJoinExecutorConfigurator$AkkaForkJoinTask.exec(ForkJoinExecutorConfigurator.scala:48)                                                                                                   │
│     at java.base/java.util.concurrent.ForkJoinTask.doExec(ForkJoinTask.java:290)                                                                                                                                 │
│     at java.base/java.util.concurrent.ForkJoinPool$WorkQueue.topLevelExec(ForkJoinPool.java:1020)                                                                                                                │
│     at java.base/java.util.concurrent.ForkJoinPool.scan(ForkJoinPool.java:1656)                                                                                                                                  │
│     at java.base/java.util.concurrent.ForkJoinPool.runWorker(ForkJoinPool.java:1594)                                                                                                                             │
│     at java.base/java.util.concurrent.ForkJoinWorkerThread.run(ForkJoinWorkerThread.java:183)                                                                                                                    │
│ Caused by: java.lang.RuntimeException: Failed to resolve user name claim from profile provided by Identity Provider. Missing attribute. Attribute: 'upn', Regex: '(.*)', Profile: {sub=S-I9kPUZp16MYo1HUMaNq5tk0 │
│     at auth.sso.oidc.OidcCallbackLogic.extractUserNameOrThrow(OidcCallbackLogic.java:173)                                                                                                                        │
│     at auth.sso.oidc.OidcCallbackLogic.handleOidcCallback(OidcCallbackLogic.java:121)                                                                                                                            │
│     at auth.sso.oidc.OidcCallbackLogic.perform(OidcCallbackLogic.java:107)                                                                                                                                       │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:86)                                                                                                                 │
│     at controllers.SsoCallbackController$SsoCallbackLogic.perform(SsoCallbackController.java:72)                                                                                                                 │
│     at org.pac4j.play.CallbackController.lambda$callback$0(CallbackController.java:54)                                                                                                                           │
│     at java.base/java.util.concurrent.CompletableFuture$AsyncSupply.run(CompletableFuture.java:1700)                                                                                                             │
│     ... 8 common frames omitted

big-carpet-38439

01/25/2023, 11:48 PM

yeah Azure isn't sending it 😕

big-carpet-38439

01/25/2023, 11:49 PM

can you try this? : preferred_username

delightful-sunset-48960

01/25/2023, 11:49 PM

isn't that the default

big-carpet-38439

01/25/2023, 11:50 PM

actually email was getting picked up^

delightful-sunset-48960

01/25/2023, 11:50 PM

according to DataHub docs

delightful-sunset-48960

01/25/2023, 11:50 PM

delightful-sunset-48960

01/25/2023, 11:50 PM

right

big-carpet-38439

01/25/2023, 11:50 PM

im changing docs rn

big-carpet-38439

01/25/2023, 11:50 PM

to reflect latest

delightful-sunset-48960

01/25/2023, 11:50 PM

~4 minutes to apply

delightful-sunset-48960

01/25/2023, 11:56 PM

it worked!

delightful-sunset-48960

01/25/2023, 11:58 PM

@big-carpet-38439 can I give you a support prize

delightful-sunset-48960

01/25/2023, 11:58 PM

🌮

big-carpet-38439

01/25/2023, 11:58 PM

Hahaha thank you!!

big-carpet-38439

01/25/2023, 11:58 PM

And we got something additional out of this one! https://github.com/datahub-project/datahub/pull/7141

big-carpet-38439

01/25/2023, 11:58 PM

Thanks for helping call out these issues

delightful-sunset-48960

01/25/2023, 11:59 PM

np! more to come I'm sure 😉

delightful-sunset-48960

01/25/2023, 11:59 PM

I hope to contribute some of my own PRs eventually

delightful-sunset-48960

01/26/2023, 12:00 AM

I guess I will have to set up my own Helm repo for that?

big-carpet-38439

01/26/2023, 12:00 AM

Absolutely.. We'll be here to support you... No Helm repo for that! Feel free to take a personal fork off of datahub main repo and then raise PRs from there 🙂 Unless of course you want to contribute to Helm charts specifically

delightful-sunset-48960

01/26/2023, 12:03 AM

i mean to deploy my own version

big-carpet-38439

01/26/2023, 12:03 AM

To deploy DataHub I think you can just use the off the shelf charts

big-carpet-38439

01/26/2023, 12:03 AM

Unless you wanna do something pretty custom

delightful-sunset-48960

01/26/2023, 12:04 AM

got it

alert-traffic-45034

02/09/2023, 10:05 AM

hi all, may i know who encountered sso issue via okta provider? thanks in advance

3 Views

Open in Slack

Previous Next