DependencyTrack / DependencyTrack/frontend

Illegal argument provided on OIDC Keycloak login

Open
#1,266 0 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Vue
Stars
171
Forks
250
Avg merge
10h 56m
Merged PRs (30d)
84

Description

### Current Behavior

After successfully retrieving the access token, I get the message:
```json
{"status":400,"title":"Illegal argument provided","detail":"The value must not be null or empty string"}
```
on `POST /api/v1/user/oidc/login`

When I test with the same access token like:
```shell
export ACCESS_TOKEN="xyz"
curl https://my.keycloak.local/realms/my-realm/protocol/openid-connect/userinfo -H "Authorization: Bearer $ACCESS_TOKEN"
```
I get the following response:
```json
{
"sub":"abc",
"email_verified":false,
"name":"First",
"preferred_username":"first.last@example.com",
"given_name":"First",
"family_name":"Last",
"email":"first.last@example.com",
"group":["admins","users"]
}
```

The ID-Token is:
```json
{
"exp": 1780399803,
"iat": 1748930413,
"auth_time": 1748863803,
"jti": "xxx",
"iss": "https://my.keycloak.local/realms/my-realm",
"aud": "my-client",
"sub": "xxx",
"typ": "ID",
"azp": "my-client",
"session_state": "xxx",
"at_hash": "xxx",
"acr": "0",
"sid": "xxx",
"email_verified": false,
"name": "First Last",
"preferred_username": "first.last@example.com",
"given_name": "First",
"family_name": "Last",
"email": "first.last@example.com",
"group": [
"admins",
"users"
]
}
```

The API-Server config is (from env):
```
ALPINE_OIDC_ENABLED="true"
ALPINE_OIDC_ISSUER="https://my.keycloak.local/realms/my-realm"
ALPINE_OIDC_TEAMS_CLAIM="group"
ALPINE_OIDC_TEAM_SYNCHRONIZATION="true"
ALPINE_OIDC_USERNAME_CLAIM="preferred_username"
ALPINE_OIDC_USER_PROVISIONING="true"
```

Frontend config (from env):
```
OIDC_CLIENT_ID="my-client"
OIDC_ISSUER="https://my.keycloak.local/realms/my-realm"
OIDC_SCOPE="openid profile email"
```

The only difference to the official documentation is the claim name `group` instead of `groups`. But providing `groups` claim doesn't change anything according to the error message or details.

### Steps to Reproduce

1. Integrate OIDC Keycloak via https://docs.dependencytrack.org/getting-started/openidconnect-configuration/#example-setup-with-keycloak

2. I already tried to debug this by enabling `LOGGING_LEVEL=DEBUG` on the api server, but it's just silent about this issue.

### Expected Behavior

I expect any detailed error message somewhere (frontend or backend).

### Dependency-Track Frontend Version

4.13.2

### Browser

Mozilla Firefox

### Browser Version

139.0.1 (aarch64)

### Operating System

macOS

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/frontend/issues) for whether this defect was already reported

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.