DependencyTrack / DependencyTrack/dependency-track
OIDC configuration not available when connecting behind corporate proxy with authentication
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
I am trying to deploy Dependency-Track behind a corporate proxy that requires authentication. Dependency-Track is able to download CVE data from https://nvd.nist.gov/ successfully through the proxy, using the **ALPINE_HTTP_PROXY_
** environment variables.However, when it tries to fetch the OIDC configuration, I encounter a **407 Proxy Authentication Required error**.
I found a similar issue (https://github.com/DependencyTrack/dependency-track/issues/1940) but it doesn't specifically mention proxy authentication.
```
------- Downloading from https://nvd.nist.gov using proxy authentication is OK -------
2025-09-30 08:41:46,591 INFO [NistMirrorTask] Starting NIST mirroring task
2025-09-30 08:41:46,592 INFO [NistMirrorTask] Mirrored data directory created successfully
2025-09-30 08:41:46,599 INFO [NistMirrorTask] Downloading files at Tue Sep 30 08:41:46 UTC 2025
2025-09-30 08:41:46,601 INFO [NistMirrorTask] Initiating download of https://nvd.nist.gov/feeds/json/cve/2.0/nvdcve-2.0-2025.json.gz
2025-09-30 08:41:47,379 INFO [NistMirrorTask] Downloading...
2025-09-30 08:41:47,962 INFO [NistMirrorTask] Uncompressing nvdcve-2.0-2025.json.gz
2025-09-30 08:41:48,320 INFO [NvdParser] Parsing nvdcve-2.0-2025.json
------- Unable to fetch OIDC - Error 407 "Proxy Authentication Required" -------
2025-09-30 08:42:39,317 ERROR [OidcConfigurationResolver] Failed to fetch OIDC configuration from issuer https://oidc-config.com [requestId=xxxxx, requestMethod=GET, requestUri=/v1/oidc/available]
java.io.IOException: Couldn't download OpenID Provider metadata from https://oidc-config.com/.well-known/openid-configuration:
**Status code 407**
at alpine.server.auth.OidcConfigurationResolver.resolve(OidcConfigurationResolver.java:100)
at alpine.server.util.OidcUtil.isOidcAvailable(OidcUtil.java:44)
at org.dependencytrack.resources.v1.OidcResource.isAvailable(OidcResource.java:85)
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189)
at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$ResponseOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:176)
at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400)
at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81)
at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248)
at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244)
at org.glassfish.jersey.internal.Errors.process(Errors.java:292)
at org.glassfish.jersey.internal.Errors.process(Errors.java:274)
at org.glassfish.jersey.internal.Errors.process(Errors.java:244)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266)
at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253)
at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696)
at org.glassfish.jersey.servlet.WebComponent.serviceImpl(WebComponent.java:397)
at org.glassfish.jersey.servlet.WebComponent.service(WebComponent.java:349)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:358)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:312)
at org.glassfish.jersey.servlet.ServletContainer.service(ServletContainer.java:205)
at org.eclipse.jetty.ee10.servlet.ServletHolder$NotAsync.service(ServletHolder.java:1379)
at org.eclipse.jetty.ee10.servlet.ServletHolder.handle(ServletHolder.java:736)
at org.eclipse.jetty.ee10.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1621)
at alpine.server.filters.ContentSecurityPolicyFilter.doFilter(ContentSecurityPolicyFilter.java:225)
at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1593)
at alpine.server.filters.ClickjackingFilter.doFilter(ClickjackingFilter.java:93)
at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:205)
at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1593)
at alpine.server.filters.WhitelistUrlFilter.doFilter(WhitelistUrlFilter.java:166)
at org.eclipse.jetty.ee10.servlet.FilterHolder.doFilter(FilterHolder.java:208)
at org.eclipse.jetty.ee10.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1593)
at org.eclipse.jetty.ee10.servlet.ServletHandler$MappedServlet.handle(ServletHandler.java:1554)
at org.eclipse.jetty.ee10.servlet.ServletChannel.dispatch(ServletChannel.java:819)
at org.eclipse.jetty.ee10.servlet.ServletChannel.handle(ServletChannel.java:436)
at org.eclipse.jetty.ee10.servlet.ServletHandler.handle(ServletHandler.java:469)
at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:575)
at org.eclipse.jetty.ee10.servlet.SessionHandler.handle(SessionHandler.java:717)
at org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1064)
at org.eclipse.jetty.server.Server.handle(Server.java:182)
at org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:662)
at org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:416)
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:322)
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:99)
at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:979)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1209)
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1164)
at java.base/java.lang.Thread.run(Unknown Source)
```
Then when i get **"https://my-dtrack-url.com/api/v1/oidc/available"** endpoint :
I have checked on alpine repository in url bellow, it seems that the OidcConfigurationResolver is getting the proxy configuration with credentials to send the http request :
https://github.com/stevespringett/Alpine/blob/master/alpine-server/src/main/java/alpine/server/auth/OidcConfigurationResolver.java
https://github.com/stevespringett/Alpine/blob/master/alpine-common/src/main/java/alpine/common/util/ProxyUtil.java
https://github.com/stevespringett/Alpine/blob/master/alpine-common/src/main/java/alpine/common/util/ProxyConfig.java
But still dont understand the 407. Do you have any idea if the proxy is really passing credentials to proxy to fetch OIDC ?
### Steps to Reproduce
- Set as environment variables
* Proxy properties : **ALPINE_HTTP_PROXY_
* OIDC properties dtrack-api : **ALPINE_OIDC_ENABLED | ALPINE_OIDC_CLIENT_ID | ALPINE_OIDC_ISSUER | ALPINE_OIDC_USERNAME_CLAIM | ALPINE_OIDC_TEAMS_CLAIM | ALPINE_OIDC_USER_PROVISIONING | ALPINE_OIDC_TEAM_SYNCHRONIZATION**
* OIDC properties dtrack-frontend : **OIDC_ISSUER | OIDC_CLIENT_ID**
- Enable basic authentication scheme in **/opt/java/openjdk/conf/net.properties** (which is disabled by default)
```
jdk.http.auth.tunneling.disabledSchemes=Basic
```
**To** :
```
jdk.http.auth.tunneling.disabledSchemes=
```
- Comment the nltm properties
- Try to use an external OIDC provider when inside a corporate environment that needs a proxy **with authentication** to fetch oidc-configuration
### Expected Behavior
Authenticated proxy is supported to reach the OIDC provider
### Dependency-Track Version
4.13.5
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
15
### Browser
Microsoft Edge
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start with Alpine's OidcConfigurationResolver, ProxyUtil, and ProxyConfig, then compare their proxy handling with the ALPINE_HTTP_PROXY settings and the Java net.properties authentication settings described here. Reproduce the 407 through the /api/v1/oidc/available endpoint using an authenticated corporate proxy; done means the OIDC provider configuration is fetched successfully through that proxy.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, backend, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100