search

vouch / vouch-proxy

an SSO and OAuth / OIDC login solution for Nginx using the auth_request module
MIT License
2.92k stars 327 forks source link

Cognito: /auth Invalid session state: stored %!s(<nil>) on first login #507

Closed avishayil closed 1 year ago

avishayil commented 1 year ago

Describe the problem I'm trying to utilize vouch proxy in order to secure Kuberentes Dashboard (blog post coming soon btw) Vouch proxy returns response code 400 on first login using Cognito user pool OAuth provider Deployed on EKS with helm chart, route53 domain points to ingress-nginx alb, then route to vouch-proxy to perform auth. Cognito provides the JWT, then vouch-proxy instructs ingress-nginx to include the JWT in the Authorization header

Expected behavior Successfully redirect to the client application instead of returning code 400.

Desktop (please complete the following information):

Additional context Logs: https://gist.github.com/avishayil/57997ff80fc10e993573ce96a037eaf4 Repository: https://github.com/avishayil/kubernetes-dashboard-vouch-cognito (full Cognito integration implementation)

When using testing: true redirect works fine. After first login, the application works just fine. When JWT expires, error occurs again. Error does not reproduce after deleting the vouch cookie. Error reproduce after using the "sign out user" feature of Cognito: https://docs.aws.amazon.com/cognito-user-identity-pools/latest/APIReference/API_AdminUserGlobalSignOut.html

Found similar issue on #430, but it is reproducible this time

bnfinet commented 1 year ago

@avishayil happy to help but I need more info. Please consult the README for what to provide when submitting an issue.

I'd be very excited to read a blog post about VP + Kuberentes Dashboard !

bnfinet commented 1 year ago

@avishayil I'm going to close this for now, feel free to post again to this thread if you'd still like me to take a look