DependencyTrack / DependencyTrack/dependency-track

OpenID users are not associated with a team

Open
#1,488 3 comments 2 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
User logs in with OpenID for the first the time via Azure Active Directory. The 'OpenID Connect Users' page on DT shows user has been created, but is not associated with any team as was expected. As Administrator, adding the new OpenID user to a team updates the user's profile to confirm their association with a team, but the 'Teams' page does not show the user is part of a team. Manually giving the user individual permissions does work.

I have been successful creating a Managed User and associating that user with a team.

### Steps to Reproduce:
1. Configure Azure App Registration for Dependency-Track (i.e. set Redirect URL)
2. Modify `docker-compose.yml` to configure OpenID as follows (sensitive info is redacted):

API Server:

- ALPINE_OIDC_ENABLED=true

- ALPINE_OIDC_ISSUER=https://login.microsoftonline.com//v2.0

- ALPINE_OIDC_CLIENT_ID=

- ALPINE_OIDC_USERNAME_CLAIM=preferred_username

- ALPINE_OIDC_TEAMS_CLAIM=groups

- ALPINE_OIDC_USER_PROVISIONING=true

- ALPINE_OIDC_TEAM_SYNCHRONIZATION=true

Frontend:

- OIDC_ISSUER=https://login.microsoftonline.com//v2.0

- OIDC_CLIENT_ID=

3. Start Dependency-Track via Docker-Compose
4. Create security group in Azure Active Directory and add users
6. Log in to Dependency-Track as Administrator
7. From 'Access Management' add a new OpenID Connect Group using the group ID from step 4 and map the group to the Administrators team
8. One of the members of the security group created in step 4 logs in to Dependency-Track via OpenID, but has no permissions
9. As Administrator, confirm user profile exists under 'OpenID Connect Users' but user is not associated with any team
10. Manually add user to Administrators team, but the 'Teams' page does not show user associated with Administrators team (or any other team)

### Expected Behavior:
OpenID Connect User should be a member of the team mapped to their OpenID Connect Group after logging in for the first time. Manually adding the user to a team should make them a member of that team.

### Environment:

- Dependency-Track Version: 4.4.1
- Distribution: Docker
- BOM Format & Version: JSON
- Database Server: H2
- Browser: Google Chrome 99.0.4844.74

### Additional Details:
I followed this [tutorial](https://lyny-leandro.medium.com/dependency-track-with-azure-ad-openid-connect-b2d13861c4f5) for configuring Dependency-Track with OpenID.

Users can successfully authenticate to Dependency-Track with OpenID and as Administrator, I can confirm the user profile exists under 'OpenID Connect Users' and that they are associated with the 'OpenID Connect Group' I previously created. In addition, I can go back and confirm that 'OpenID Connect Group' is mapped to a team (I've tried Administrators and a custom defined team).

If I manually add the 'OpenID Connect User' to a team, their user profile shows their association with a team, but if I go to the 'Teams' page, that user is not listed as a member of that team.

I can manually give the 'OpenID Connect User' the same permissions as that team and those permissions are successful, in that the user can now access what I gave them permission for.

I can create a managed user and add them to a team manually without issue.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.