OIDC Frontend JavaScript Bug: Incorrect Authorization URL Construction with Microsoft Entra ID #521

New Issue

2025-10-31T15:14:11-05:00

GiteaMirror commented

2025-10-31 15:14:11 -05:00

Originally created by @brandonleegit on GitHub (Aug 20, 2025).

Environment

Komodo Version: v1.19.0
Platform: Docker Compose
OIDC Provider: Microsoft Entra ID
Browser: Multiple browsers
Operating System: Docker container installation of Komodo

Description

The OIDC login frontend is constructing incorrect authorization URLs by mixing the KOMODO_HOST with parts of the OIDC provider URL, causing authentication failures with Microsoft Entra ID.

Expected Behavior

When clicking the OIDC button, the browser should redirect to:

https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize?...

Actual Behavior

The browser redirects to this malformed URL instead:

https://[MY-KOMODO-HOST]/[TENANT-ID]/oauth2/v2.0/authorize?...

Notice how the hostname is [MY-KOMODO-HOST] (my KOMODO_HOST) instead of login.microsoftonline.com.

Configuration

OIDC Configuration (tried both approaches):

Environment Variables:

KOMODO_OIDC_ENABLED=true
KOMODO_OIDC_PROVIDER=https://login.microsoftonline.com/[TENANT-ID]/v2.0
KOMODO_OIDC_REDIRECT_HOST=https://[MY-KOMODO-HOST]
KOMODO_OIDC_CLIENT_ID=[CLIENT-ID]
KOMODO_OIDC_CLIENT_SECRET=[CLIENT-SECRET]
KOMODO_OIDC_SCOPE=openid profile email

TOML Config File:

host = "https://[MY-KOMODO-HOST]"
oidc_enabled = true
oidc_provider = "https://login.microsoftonline.com/[TENANT-ID]/v2.0"
oidc_redirect_host = "https://[MY-KOMODO-HOST]"
oidc_client_id = "[CLIENT-ID]"
oidc_client_secret = "[CLIENT-SECRET]"
oidc_scope = "openid profile email"

Backend Logs (Successful OIDC Initialization)

2025-08-20T16:27:52.957824Z  INFO core: CoreConfig { ..., oidc_enabled: true, oidc_provider: "https://login.microsoftonline.com/[TENANT-ID]/v2.0", oidc_redirect_host: "https://[MY-KOMODO-HOST]", oidc_client_id: "##############", oidc_client_secret: "##############", ... }
2025-08-20T16:27:53.493296Z  INFO core::api::auth: 🔑 OIDC Login Enabled

No backend errors - the OIDC client initializes successfully.

Steps to Reproduce

Configure Komodo with Microsoft Entra ID OIDC settings
Navigate to Komodo login page
Click the "OIDC" button
Observe the malformed URL in the browser address bar
Page "blinks" and stays on login page instead of redirecting to Microsoft

Additional Context

The backend configuration is correct (no OIDC initialization errors)
Microsoft's OIDC discovery endpoint is accessible and returns correct URLs
The issue appears to be in the frontend JavaScript that constructs the authorization URL
Similar issue reported in #165 with different OIDC provider
Tested with both environment variables and TOML config - same result

Verification

I verified Microsoft's OIDC endpoint returns the correct authorization endpoint:

curl -s "https://login.microsoftonline.com/[TENANT-ID]/v2.0/.well-known/openid-configuration" | grep authorization_endpoint

# Returns: "authorization_endpoint":"https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize"

Impact

This bug prevents OIDC authentication with Microsoft Entra ID, which is a common enterprise identity provider.

Potential Root Cause

The frontend JavaScript appears to be incorrectly using the KOMODO_HOST as the base URL instead of the OIDC provider's domain when constructing the authorization URL.

Originally created by @brandonleegit on GitHub (Aug 20, 2025). ## Environment - **Komodo Version**: v1.19.0 - **Platform**: Docker Compose - **OIDC Provider**: Microsoft Entra ID - **Browser**: Multiple browsers - **Operating System**: Docker container installation of Komodo ## Description The OIDC login frontend is constructing incorrect authorization URLs by mixing the `KOMODO_HOST` with parts of the OIDC provider URL, causing authentication failures with Microsoft Entra ID. ## Expected Behavior When clicking the OIDC button, the browser should redirect to: ``` https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize?... ``` ## Actual Behavior The browser redirects to this malformed URL instead: ``` https://[MY-KOMODO-HOST]/[TENANT-ID]/oauth2/v2.0/authorize?... ``` Notice how the hostname is `[MY-KOMODO-HOST]` (my KOMODO_HOST) instead of `login.microsoftonline.com`. ## Configuration ### OIDC Configuration (tried both approaches): **Environment Variables:** ```bash KOMODO_OIDC_ENABLED=true KOMODO_OIDC_PROVIDER=https://login.microsoftonline.com/[TENANT-ID]/v2.0 KOMODO_OIDC_REDIRECT_HOST=https://[MY-KOMODO-HOST] KOMODO_OIDC_CLIENT_ID=[CLIENT-ID] KOMODO_OIDC_CLIENT_SECRET=[CLIENT-SECRET] KOMODO_OIDC_SCOPE=openid profile email ``` **TOML Config File:** ```toml host = "https://[MY-KOMODO-HOST]" oidc_enabled = true oidc_provider = "https://login.microsoftonline.com/[TENANT-ID]/v2.0" oidc_redirect_host = "https://[MY-KOMODO-HOST]" oidc_client_id = "[CLIENT-ID]" oidc_client_secret = "[CLIENT-SECRET]" oidc_scope = "openid profile email" ``` ### Backend Logs (Successful OIDC Initialization) ``` 2025-08-20T16:27:52.957824Z INFO core: CoreConfig { ..., oidc_enabled: true, oidc_provider: "https://login.microsoftonline.com/[TENANT-ID]/v2.0", oidc_redirect_host: "https://[MY-KOMODO-HOST]", oidc_client_id: "##############", oidc_client_secret: "##############", ... } 2025-08-20T16:27:53.493296Z INFO core::api::auth: 🔑 OIDC Login Enabled ``` No backend errors - the OIDC client initializes successfully. ## Steps to Reproduce 1. Configure Komodo with Microsoft Entra ID OIDC settings 2. Navigate to Komodo login page 3. Click the "OIDC" button 4. Observe the malformed URL in the browser address bar 5. Page "blinks" and stays on login page instead of redirecting to Microsoft ## Additional Context - The backend configuration is correct (no OIDC initialization errors) - Microsoft's OIDC discovery endpoint is accessible and returns correct URLs - The issue appears to be in the frontend JavaScript that constructs the authorization URL - Similar issue reported in #165 with different OIDC provider - Tested with both environment variables and TOML config - same result ## Verification I verified Microsoft's OIDC endpoint returns the correct authorization endpoint: ```bash curl -s "https://login.microsoftonline.com/[TENANT-ID]/v2.0/.well-known/openid-configuration" | grep authorization_endpoint # Returns: "authorization_endpoint":"https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize" ``` ## Impact This bug prevents OIDC authentication with Microsoft Entra ID, which is a common enterprise identity provider. ## Potential Root Cause The frontend JavaScript appears to be incorrectly using the `KOMODO_HOST` as the base URL instead of the OIDC provider's domain when constructing the authorization URL.

GiteaMirror closed this issue

2025-10-31 15:14:11 -05:00

GiteaMirror commented

2025-10-31 15:14:12 -05:00

@brandonleegit commented on GitHub (Aug 20, 2025):

Workaround

As a temporary workaround, I was able to use Traefik reverse proxy to redirect the malformed URLs to the correct Microsoft endpoints:

# Traefik labels for docker-compose.yml core service
labels:
  # OIDC Redirect Workaround
  "traefik.http.routers.komodo-oidc-fix.rule": "Host(`[MY-KOMODO-HOST]`) && PathPrefix(`/[TENANT-ID]/oauth2/v2.0/authorize`)"
  "traefik.http.routers.komodo-oidc-fix.entrypoints": "websecure"
  "traefik.http.routers.komodo-oidc-fix.tls.certresolver": "[CERT-RESOLVER]"
  "traefik.http.routers.komodo-oidc-fix.priority": "100"
  "traefik.http.routers.komodo-oidc-fix.middlewares": "oidc-redirect"
  
  # OIDC Redirect Middleware
  "traefik.http.middlewares.oidc-redirect.redirectregex.regex": "https://[MY-KOMODO-HOST]/[TENANT-ID]/oauth2/v2\\.0/authorize"
  "traefik.http.middlewares.oidc-redirect.redirectregex.replacement": "https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize"
  "traefik.http.middlewares.oidc-redirect.redirectregex.permanent": "false"

This workaround successfully redirects the malformed URLs to the correct Microsoft Entra ID authorization endpoint, allowing OIDC authentication to work properly.

@brandonleegit commented on GitHub (Aug 20, 2025): ## Workaround As a temporary workaround, I was able to use Traefik reverse proxy to redirect the malformed URLs to the correct Microsoft endpoints: ```yaml # Traefik labels for docker-compose.yml core service labels: # OIDC Redirect Workaround "traefik.http.routers.komodo-oidc-fix.rule": "Host(`[MY-KOMODO-HOST]`) && PathPrefix(`/[TENANT-ID]/oauth2/v2.0/authorize`)" "traefik.http.routers.komodo-oidc-fix.entrypoints": "websecure" "traefik.http.routers.komodo-oidc-fix.tls.certresolver": "[CERT-RESOLVER]" "traefik.http.routers.komodo-oidc-fix.priority": "100" "traefik.http.routers.komodo-oidc-fix.middlewares": "oidc-redirect" # OIDC Redirect Middleware "traefik.http.middlewares.oidc-redirect.redirectregex.regex": "https://[MY-KOMODO-HOST]/[TENANT-ID]/oauth2/v2\\.0/authorize" "traefik.http.middlewares.oidc-redirect.redirectregex.replacement": "https://login.microsoftonline.com/[TENANT-ID]/oauth2/v2.0/authorize" "traefik.http.middlewares.oidc-redirect.redirectregex.permanent": "false" ``` This workaround successfully redirects the malformed URLs to the correct Microsoft Entra ID authorization endpoint, allowing OIDC authentication to work properly.

GiteaMirror commented

2025-10-31 15:14:12 -05:00

@mbecker20 commented on GitHub (Aug 28, 2025):

See https://github.com/moghtech/komodo/issues/445#issuecomment-3164971889

@mbecker20 commented on GitHub (Aug 28, 2025): See https://github.com/moghtech/komodo/issues/445#issuecomment-3164971889