DependencyTrack / DependencyTrack/dependency-track
OIDC login CORS error
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
When logging in via a custom OIDC provider, the front end sends a GET request to the .well-known/openid-configuration endpoint, which does not have a CORS header. Front-end triggers:
```
An error occurred while redirecting to the OpenID Connect identity provider.
```
And browser inspect tool shows CORS error.
### Steps to Reproduce
1. Start the service using the following docker-compose file:
```yaml
version: '3.7'
volumes:
dependency-track:
services:
dtrack-apiserver:
image: dependencytrack/apiserver
environment:
- "ALPINE_OIDC_ENABLED=true"
- "ALPINE_OIDC_ISSUER=https://auth.mydomain.com/webman/sso"
- "ALPINE_OIDC_CLIENT_ID=my_client_id"
- "ALPINE_OIDC_USERNAME_CLAIM=preferred_username"
- "ALPINE_OIDC_TEAMS_CLAIM=groups"
- "ALPINE_OIDC_USER_PROVISIONING=true"
- "ALPINE_OIDC_TEAM_SYNCHRONIZATION=true"
deploy:
resources:
limits:
memory: 12288m
reservations:
memory: 8192m
restart_policy:
condition: on-failure
ports:
- '15081:8080'
volumes:
- 'dependency-track:/data'
restart: unless-stopped
dtrack-frontend:
image: dependencytrack/frontend
depends_on:
- dtrack-apiserver
environment:
- "API_BASE_URL=https://dt-api.mydomain.com"
- "OIDC_ISSUER=https://auth.mydomain.com/webman/sso"
- "OIDC_CLIENT_ID=my_client_id"
- "OIDC_SCOPE=openid profile email"
ports:
- "15080:8080"
restart: unless-stopped
```
2. Configure the OIDC provider. I tested both KeyCloak and Synology SSO service.
3. Configure the reverse proxy. The backend is hosted at ``https://dt-api.mydomain.com``, frontend at ``https://dependency-track.mydomain.com``, and the OIDC service at ``https://auth.mydomain.com``.
4. Start the docker stack, go to the login page, click on OIDC button. Get the CORS error.
### Expected Behavior
The OIDC login button should have redirected me to the OIDC provider. The front end, from the environment variables, should have sufficient information on redirecting. The request on the well known endpoint is not really necessary. Is there some config I'm missing, or do I need to proxy the OIDC server under the same domain?
Thank you for your help!
### Dependency-Track Version
4.10.1
### Dependency-Track Distribution
Container Image
### Database Server
N/A
### Database Server Version
_No response_
### Browser
Google Chrome
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.