Error with Gitlab Auth : AuthCanceled at /complete/gitlab/ - Exception Value: Authentication process canceled

[Aminoss46]

I am trying to set a Gitlab authentification to Defect Dojo i followed all steps and respected the configuration as mentioned on the https://defectdojo.github.io/django-DefectDojo/integrations/social-authentication/#:~:text=for%20record%20purposes.-,Gitlab,-In%20a%20similar

Unfortunately after being redirected to Gitlab to authenticate, i get redirected to Defect Dojo with the error : Authentication process canceled

Any one please have an idea how to fix that ?

Environment: Request Method: GET Request URL: http://my-gitlab-url.com/complete/gitlab/?code=41fc4464d801ad97ceebb65f9ea2944059dafb4e4ad73887c8f658507dc75441&state=Jz5OyXaiaeOJvDBBIgS6pbd5KNrBMX9R

Django Version: 4.1.13 Python Version: 3.11.4 Installed Applications: ('django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'polymorphic', 'django.contrib.admin', 'django.contrib.humanize', 'auditlog', 'dojo', 'watson', 'tagging', 'imagekit', 'multiselectfield', 'rest_framework', 'rest_framework.authtoken', 'dbbackup', 'django_celery_results', 'social_django', 'drf_spectacular', 'drf_spectacular_sidecar', 'tagulous', 'fontawesomefree', 'django_filters') Installed Middleware: ['django.middleware.common.CommonMiddleware', 'dojo.middleware.APITrailingSlashMiddleware', 'dojo.middleware.DojoSytemSettingsMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'dojo.remote_user.RemoteUserMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', 'dojo.middleware.LoginRequiredMiddleware', 'dojo.middleware.AdditionalHeaderMiddleware', 'social_django.middleware.SocialAuthExceptionMiddleware', 'watson.middleware.SearchContextMiddleware', 'auditlog.middleware.AuditlogMiddleware', 'crum.CurrentRequestUserMiddleware', 'dojo.request_cache.middleware.RequestCacheMiddleware']

Traceback (most recent call last): File "/usr/local/lib/python3.11/site-packages/social_core/utils.py", line 253, in wrapper return func(*args, kwargs) File "/usr/local/lib/python3.11/site-packages/social_core/backends/oauth.py", line 418, in auth_complete response = self.request_access_token( File "/usr/local/lib/python3.11/site-packages/social_core/backends/oauth.py", line 397, in request_access_token return self.get_json(*args, *kwargs) File "/usr/local/lib/python3.11/site-packages/social_core/backends/base.py", line 250, in get_json return self.request(url, args, kwargs).json() File "/usr/local/lib/python3.11/site-packages/social_core/backends/base.py", line 246, in request response.raise_for_status() File "/usr/local/lib/python3.11/site-packages/requests/models.py", line 1021, in raise_for_status raise HTTPError(http_error_msg, response=self)

During handling of the above exception (400 Client Error: Bad Request for url: https://my-gitlab-url.com/oauth/token), another exception occurred: File "/usr/local/lib/python3.11/site-packages/django/core/handlers/exception.py", line 56, in inner response = get_response(request) File "/usr/local/lib/python3.11/site-packages/django/core/handlers/base.py", line 197, in _get_response response = wrapped_callback(request, *callback_args, callback_kwargs) File "/usr/local/lib/python3.11/site-packages/django/views/decorators/cache.py", line 62, in _wrapped_view_func response = view_func(request, *args, *kwargs) File "/usr/local/lib/python3.11/site-packages/django/views/decorators/csrf.py", line 55, in wrapped_view return view_func(args, kwargs) File "/usr/local/lib/python3.11/site-packages/social_django/utils.py", line 49, in wrapper return func(request, backend, *args, kwargs) File "/usr/local/lib/python3.11/site-packages/social_django/views.py", line 31, in complete return do_complete( File "/usr/local/lib/python3.11/site-packages/social_core/actions.py", line 49, in do_complete user = backend.complete(user=user, redirect_name=redirect_name, *args, *kwargs) File "/usr/local/lib/python3.11/site-packages/social_core/backends/base.py", line 39, in complete return self.auth_complete(args, kwargs) File "/usr/local/lib/python3.11/site-packages/social_core/utils.py", line 256, in wrapper raise AuthCanceled(args[0], response=err.response)

Exception Type: AuthCanceled at /complete/gitlab/ Exception Value: Authentication process canceled

[manuel-sommer]

I guess this is rather an official consulting question or question for the OWASP slack channel. Shall we close this @mtesauro ?

[mtesauro]

@Aminoss46 I've never used Github auth with DefectDojo and you're likely to get a bigger audience if you ask your question on OWASP's Slack instance

Info on joining the OWASP Slack for DefectDojo questions is at https://github.com/DefectDojo/django-DefectDojo?tab=readme-ov-file#community-getting-involved-and-updates