DependencyTrack / DependencyTrack/dependency-track

Group Sync with Azure AD via graph.windows.net does not seem to work anymore.

Open
#2,150 22 comments 2 reactions 0 assignees View on GitHub
defect help wanted p2
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

### Basic Information
- We are using Azure AD as identity provider.
- OIDC group sync does not work anymore for us.
- If we disable group sync we can log in successfully.
- Broken in 4.6.x, works in 4.5.x
- We did not change Dependencytrack config, nor did we change our Azure AD app registration.

### Configs
```
- name: ALPINE_OIDC_ENABLED
value: "true"
- name: ALPINE_OIDC_CLIENT_ID
value:
- name: ALPINE_OIDC_ISSUER
value: https://login.microsoftonline.com//v2.0
- name: ALPINE_OIDC_USERNAME_CLAIM
value: preferred_username
- name: ALPINE_OIDC_USER_PROVISIONING
value: "true"
- name: ALPINE_OIDC_TEAMS_CLAIM
value: groups
- name: ALPINE_OIDC_TEAM_SYNCHRONIZATION
value: "true"
```

### Claims + Logs

Logs:
```
2022-11-14 10:35:30,845 DEBUG [OidcConfigurationResolver] OIDC configuration loaded from cache
2022-11-14 10:35:30,845 DEBUG [OidcIdTokenAuthenticator] JWK set loaded from cache
2022-11-14 10:35:30,846 DEBUG [OidcIdTokenAuthenticator] ID token claims: {"sub":"","ver":"2.0","_claim_names":{"groups":"src1"},"aio":"","roles":["admin"],"iss":"https:\/\/login.microsoftonline.com\/\/v2.0","oid":"","preferred_username":"Bree@example.com","uti":"","tid":"","aud":"","nbf":1668421830,"rh":"","wids":[""],"_claim_sources":{"src1":{"endpoint":"https:\/\/graph.windows.net\/\/users\/\/getMemberObjects"}},"name":"Breesson, Bree","exp":1668425730,"iat":1668421830,"email":"Bree@example.com"}
2022-11-14 10:35:30,847 DEBUG [OidcAuthenticationService] ID token profile: OidcProfile{subject='', username='Bree@example.com', groups=null, email='Bree@example.com'}
2022-11-14 10:35:31,089 DEBUG [OidcUserInfoAuthenticator] UserInfo response: {"sub":"","name":"Breesson, Bree","given_name":"Julian","family_name":"Loeffler","picture":"https:\/\/graph.microsoft.com\/v1.0\/me\/photo\/$value","email":"Bree@example.com"}
2022-11-14 10:35:31,089 DEBUG [OidcAuthenticationService] UserInfo profile: OidcProfile{subject='', username='null', groups=null, email='Bree@example.com'}
2022-11-14 10:35:31,089 DEBUG [OidcAuthenticationService] Merged profile: OidcProfile{subject='', username='Bree@example.com', groups=null, email='Bree@example.com'}
2022-11-14 10:35:31,090 ERROR [OidcAuthenticationService] Unable to assemble complete profile (ID token: OidcProfile{subject='', username='Bree@example.com', groups=null, email='Bree@example.com'}, UserInfo: OidcProfile{subject='', username='null', groups=null, email='Bree@example.com'}, Merged: OidcProfile{subject='', username='Bree@example.com', groups=null, email='Bree@example.com'})
2022-11-14 10:35:31,090 INFO [UserResource] Unauthorized OpenID Connect login attempt / IP Address: xxxxxxxxxxxxxxx / User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
```

Dependency track received ID token contains something similar to:
```
{
"sub": "xxxxxxxxxxxxxxxxxxxxxxxxxxx",
"ver": "2.0",
"_claim_names": {
"groups": "src1"
},
"aio": "xxxxxxxxxxxxxxxxxxxxxxxxxxx",
"roles": [
"admin"
],
"iss": "https:\/\/login.microsoftonline.com\/xxxxxxxxxxxxxxxxxxxxxxxxx\/v2.0",
"oid": "xxxxxxxxxxxxxxxxxxxxxxxx",
"preferred_username": "Bree@example.com",
"uti": "xxxxxxxxxxxxxxxxxxxxxxxxx",
"tid": "xxxxxxxxxxxxxxxxxxxxxxxxx",
"aud": "xxxxxxxxxxxxxxxxxxxxxxxxx",
"nbf": 1668420930,
"rh": "xxxxxxxxxxxxxxxxxxxxxxxxx",
"wids": [
"xxxxxxxxxxxxxxxxxxxxxxxxxx"
],
"_claim_sources": {
"src1": {
"endpoint": "https:\/\/graph.windows.net\/xxxxxxxxxx\/users\/xxxxxxxxxxxx\/getMemberObjects"
}
},
"name": "Breesson, Bree",
"exp": 1668424830,
"iat": 1668420930,
"email": "Bree@example.com"
}
```
The interesting part here is

```
"_claim_sources": {
"src1": {
"endpoint": "https:\/\/graph.windows.net\/xxxxxxxxxx\/users\/xxxxxxxxxxxx\/getMemberObjects"
}
},
```

I was not able to query this API endpoint myself successfully, so maybe something changed in the old graph.windows.net endpoint. Maybe you guys want to consider to migrate to graph.microsoft.com

### Steps to Reproduce

1. Create an Azure AD app registration
2. Configure a groups claim for ID/Access tokens
3. Configure DTrack to use the Azure AD app as OIDC client and activate group sync
4. Login

### Expected Behavior

groups are synced successfully

### Dependency-Track Version

4.6.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

13.8

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.