search

openfoodfoundation / openfoodnetwork

Connect suppliers, distributors and consumers to trade local produce.
https://www.openfoodnetwork.org
GNU Affero General Public License v3.0
1.11k stars 719 forks source link

OIDC relink fails when trying to link to an OIDC realm_admin account #12901

Open RaggedStaff opened 1 week ago

RaggedStaff commented 1 week ago

Description

When adjusting an Enterprise OIDC user, if I attempt to use my OIDC realm_admin account, I encounter a 500, "No Grow" slug.

NB A normal OIDC user account seems to work ok. Contact @RaggedStaff for more details/an appropriate account for testing.

Expected Behavior

The system normally allows a different OIDC account to be linked to an Enterprise user account that has previously disconnected from OIDC. When I try to reconnect to my OIDC realm_admin account, it fails.

Actual Behaviour

When attempting to connect to a different lescommuns account, the linkage fails & the Enterprise User remains disconnected from OIDC.

Steps to Reproduce

  1. In Enterprise > OIDC Settings : "Link your Les Communs OIDC Account"
  2. Once successfully linked (screen should display "This account is linked to xxxx@xxxx.xxx" ), us "Disconnect from lescommuns" button to delink accounts
  3. Go to lescommuns.org & sign out of account 1.
  4. Return to OIDC Settings & click "Link you Les Communs OIDC Account"
  5. Log in to OIDC realm_admin account
  6. 500 "No Grow" slug error is returned.

Animated Gif/Screenshot

https://github.com/user-attachments/assets/d14babd5-95b8-49fb-a631-0e0574d93bf8

Workaround

Don't use a realm-admin OIDC account to link to OFN.

Severity

Your Environment

Possible Fix

Not sure, may be to do with 2FA being enabled on the OIDC account, but I can use it if it's the first account I link to an Enterprise user.

RaggedStaff commented 1 week ago

Update - I've encountered the same error on Staging, with an account that's been linked to testdfc@p... for a while (potentially since initial testing of the OIDC work last year) and I get the slug when I attempt to change to my non-admin OIDC account (gar...@food...tion.org.uk). 😖

I'm wondering if it could be something to do with the old account setup, some settings lurking in users (OIDC or OFN) that have been setup for a while? 🤔