DependencyTrack / DependencyTrack/dependency-track

OIDC user teams reset after login

Open
#4,846 3 comments 2 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

I enabled SSO with Entra ID but the assigned teams to a OIDC user are always resetted after logging in.

### Steps to Reproduce

1. Run Dependency-Track as separate containers with the 4.13 image and an additional psql instance on the host.
2. Enable portfolio access control
3. Set up OIDC with Entra ID in accordance to the documentation: [https://docs.dependencytrack.org/getting-started/openidconnect-configuration/](https://docs.dependencytrack.org/getting-started/openidconnect-configuration/ )
4. The app was registered like described in this documentation: [https://docs.dependencytrack.org/getting-started/openidconnect-configuration/#microsoft-entra-id-app-registration](https://docs.dependencytrack.org/getting-started/openidconnect-configuration/#microsoft-entra-id-app-registration)
5. In Dependency-Track create a team "default users" and assign only view portfolio privileges but no project.
6. My OIDC user has two groups, from which I need one to be responsible for assigning default view privileges. So in Dependency-Track under "OpenID Connect Groups" i created a new group with the ObjectID (Group ID from Azure) as the name of the group, and assigned it to the default users team.
7. Now create the OIDC user in advance (before login) and assign the OIDC user any team, for example Administrator. Additionally grant it all permissions
8. Now Log in with the OIDC user (I tried google chrome and ms edge)
9. It should work once. Now log out
10. Log back in. The Administrators team is now gone. The default users team remains and all permissons are still there. So for some reason it only resets the team.

Step 7 can be variated to not set up the user in advance, but log in first, so the auto provisioning of default users team happens - this works fine. But when adding any team (like Administrators) and then logging in again, the team disappears.

Step 6 can also be left out, so no team is assigned to the user when first logging in. It will work because the user has all permissions. Assign the Administrator team, log in and the Administrator team is gone.

I disabled the alpine_oidc_user_provisioning first and retried. Same issue
Then disabled the alpine_oidc_team_synchronization: The administrator team sticks now but the default user is not assigned anymore

### Expected Behavior

The team should not be reset or re-provisioned after logging in with an OIDC user using Entra ID.

### Dependency-Track Version

4.13.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

13.11

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.