DependencyTrack / DependencyTrack/dependency-track

OIDC user unable to log in after change in users groups

Open
#5,218 4 comments 0 reactions 0 assignees View on GitHub
defect wontfix
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

A user whose permissions are managed via OIDC Connected Groups was unable to log in at all after a change in the users groups.
Previously the users had Administrator permissions via a group, but after a team change, their permissions were dropped to Authorized.
When the user tried to log into Dependency-Track 4.13.2 via OIDC, they were unable with the following error in the Logs:
`ERROR [OidcAuthenticationService] Refusing to authenticate user username: subject identifier has changed (xxxxxx to yyyyyy) [requestId=zzzzzz, requestMethod=POST, requestUri=/v1/user/oidc/login]`

After deleting the user from “OpenID Connected Users” they were able to log in with the expected permissions.

### Steps to Reproduce

1. Log in with a OIDC user.
2. Change the users groups so they have different (reduced?) permissions.
3. Try to log in again.

### Expected Behavior

I would expect the user to be able to log in at first try with the right permissions.

Maybe when the subject identifier changes, instead of giving an error, dependency-track could replace the subject identifier with the new one and update the users permissions.

### Dependency-Track Version

4.13.2

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

Mozilla Firefox

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.