DependencyTrack / DependencyTrack/dependency-track

OIDC login CORS error

Open
#3,505 4 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

When logging in via a custom OIDC provider, the front end sends a GET request to the .well-known/openid-configuration endpoint, which does not have a CORS header. Front-end triggers:

```
An error occurred while redirecting to the OpenID Connect identity provider.
```

And browser inspect tool shows CORS error.

### Steps to Reproduce

1. Start the service using the following docker-compose file:

```yaml
version: '3.7'

volumes:
dependency-track:

services:
dtrack-apiserver:
image: dependencytrack/apiserver
environment:
- "ALPINE_OIDC_ENABLED=true"
- "ALPINE_OIDC_ISSUER=https://auth.mydomain.com/webman/sso"
- "ALPINE_OIDC_CLIENT_ID=my_client_id"
- "ALPINE_OIDC_USERNAME_CLAIM=preferred_username"
- "ALPINE_OIDC_TEAMS_CLAIM=groups"
- "ALPINE_OIDC_USER_PROVISIONING=true"
- "ALPINE_OIDC_TEAM_SYNCHRONIZATION=true"
deploy:
resources:
limits:
memory: 12288m
reservations:
memory: 8192m
restart_policy:
condition: on-failure
ports:
- '15081:8080'
volumes:
- 'dependency-track:/data'
restart: unless-stopped

dtrack-frontend:
image: dependencytrack/frontend
depends_on:
- dtrack-apiserver
environment:
- "API_BASE_URL=https://dt-api.mydomain.com"
- "OIDC_ISSUER=https://auth.mydomain.com/webman/sso"
- "OIDC_CLIENT_ID=my_client_id"
- "OIDC_SCOPE=openid profile email"
ports:
- "15080:8080"
restart: unless-stopped
```

2. Configure the OIDC provider. I tested both KeyCloak and Synology SSO service.
3. Configure the reverse proxy. The backend is hosted at ``https://dt-api.mydomain.com``, frontend at ``https://dependency-track.mydomain.com``, and the OIDC service at ``https://auth.mydomain.com``.
4. Start the docker stack, go to the login page, click on OIDC button. Get the CORS error.

### Expected Behavior

The OIDC login button should have redirected me to the OIDC provider. The front end, from the environment variables, should have sufficient information on redirecting. The request on the well known endpoint is not really necessary. Is there some config I'm missing, or do I need to proxy the OIDC server under the same domain?

Thank you for your help!

### Dependency-Track Version

4.10.1

### Dependency-Track Distribution

Container Image

### Database Server

N/A

### Database Server Version

_No response_

### Browser

Google Chrome

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.