Help with OIDC Authentication

[chinghwa]

From the docker and Okta logs, I believe I'm successfully being authenticated however when it redirects to the main page, the authentication window is still shown. How can I debug this further?

docker log:

2024-05-21 21:45:07 INFO    Monocle.Main:174: AuthSystemReady {"provider":"okta"}

MONOCLE_OIDC_OKTA_CLIENT_SECRET is set in .secrets.

auth:
  auth_provider:
    oidc_client_id: <id>
    oidc_issuer_url: https://<okta_url>/oauth2/default
    oidc_provider_name: okta
    oidc_user_claim: sub
  enforce_auth: true

[morucci]

Perhaps a claim is missing, the monocle api logs should display some info that might help to debug this. Check the 'handleLoggedIn' function into https://github.com/change-metrics/monocle/blob/master/src/Monocle/Api/Server.hs that might give you some info and log message that you can look for in the logs.

[chinghwa]

Here's a screenshot of the api logs. It seems like it's successful(?). I'm not sure what else to look for...

[morucci]

Check that you have in your config file AuthProviderUID: for an user aliases. If not, it is unable to match any Monocle idents. See https://github.com/change-metrics/monocle?tab=readme-ov-file#identity-management and quote the docs:

Monocle uses the UID (from the OIDC provider) to discover through the idents settings a matching Monocle Ident. A matching ident defines an alias which is AuthProviderUID:<user_unique_id>

[chinghwa]

thanks... I added the appropriate section in config.yaml with my name as ident and the Okta sub value as AuthProviderID (since that's the UID). I think it found me but I'm still not logged in.

The uid now has a value in the log where it was empty previously:

2024-05-22 22:25:21 INFO    Monocle.Api.Server:1085: JWTCreated {"uid":{"<workspace name>":"<ident>"},"redir":"http://<monocle_url>:8080/api/2/auth/cb"}

Any other thoughts?