DependencyTrack / DependencyTrack/dependency-track
Overlapping OpenID Connect group assignments to Teams block user logins
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
**Meta:**
- Azure IdP (UUID as OpenIDC group names in DT with OpenIDC user and group provisioning + Team mapping)
- SSL-termating reverse proxy in front of both dependency track services
**Problem Summary:**
Users are unable to login, because they're added to the same team multiple times. This let's the ".../openidc/login" POST request receive a 404 response.
**Description / Likely cause:**
We have mapped OpenIDC groups to Teams. We had one group per team (e.g. "Group A" mapped to "Team A") and everything was working.
Recently, we added a user group "Group ABC" that gives access to "Team A", "Team B" and "Team C" while Groups "Group A" ..B..C still exist.
Some users that are included in overlapping groups sometimes (not consistently) get assigned to the mapped Teams multiple times (checking the OpenIDC User's "Team Membership" list), and if this happens, they're unable to login. I've seen as many as 12 duplicate assignments on the same user ("Team A" was there 12 times).
When I remove one duplicate entry for "Team A", the list is immediately updated to remove all redundant versions (Team A completely removed), and the user can login again just fine. Groups are re-provisioned as needed (and only once) until it breaks again.
The endpoint for .../openidc/login then simply returns 404, as if it wouldn't exist.
The API server logs did not log an exception (or I didn't find it).
The reverse proxy logs to have received a 404 from the API server
### Steps to Reproduce
1.Create two OpenID groups
1. Group A is mapped to Team A
2. Group AB is mapped to Team A and Team B
2. Existing user logs in via OIDC
3. Initially, this works just fine, but after a few logins (not a consistent number), the user is added to Team A multiple times, and cannot login anymore
5. Admin removes redundant group[s] (as described above)
6. User can login again and groups are re-provisioned
7. Back to 3.
### Expected Behavior
Overlapping OpenIDC group and Team assignments are not reflecting as duplicates on a user's profile AND do not prevent the user from logging in
### Dependency-Track Version
4.13.6
### Dependency-Track Distribution
Container Image
### Database Server
Microsoft SQL Server
### Database Server Version
Not sure, it's Azure Management MS SQL
### Browser
Microsoft Edge
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.