unable to login via OpenID Connect

Question

Hi everybody,
I reopen the issue because I'm unable to login via OIDC.
The claims sent back to ArcGis are the ones below and the error I get is "Did not receive 'user profile' parameter from the provider."

Any suggestion?

claims: {
nickname: 'xyzxyzxyz xyzxy',
sub: 'XYZXYZXYZXYZXYZXYZXYZXYZXY',
given_name: 'xyzxyzx',
email: 'xyzx@xyzx.xy',
family_name: xyzxy'
]
},

Thank you all,
A.

AriannaArona · Answer

Hi,
I don't authenticate via Azure, but I read the bug you sent me.
I think I configured everything in the right way.

This is the client registration in my satosa instance:
{
_id: ObjectId('66df00cc95c914657c7b2db0'),
client_id: 'arcgisonline',
client_name: 'ArcGis - OIDC',
client_salt: 'xyzxyzx',
client_id_issued_at: 1630952311.410208,
client_secret: 'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
client_secret_expires_at: 16624883110.410213,
registration_access_token: 'arcgis-registration-acess-token',
registration_client_uri: 'https://foo-arcgis.unimi.it/',
application_type: 'web',
contacts: [
'xyz@yyyy.yy'
],
token_endpoint_auth_method: 'client_secret_basic',
redirect_uris: [
[
'https://unimi.maps.arcgis.com/sharing/rest/oauth2/oidc/Cq6hVwUSKnNrL8XG/signin',
{}
]
],
post_logout_redirect_uris: [
[
'https://unimi.maps.arcgis.com/sharing/rest/oauth2/oidc/Cq6hVwUSKnNrL8XG/signout',
null
]
],
response_types: [
'code'
],
grant_types: [
'authorization_code'
],
allowed_scopes: [
'openid',
'profile',
'email'
]
}

The Client ID and Client segret are the same in ArcGis configuration page.
Send access token in header is enabled.
ArcGIS username field/claim name is set to email.

This is the complete session registration in my satosa instance:
{
_id: ObjectId('670e30e442ace302fcaa8cdb'),
expires_at: ISODate('2024-10-15T23:07:48.000Z'),
sub: '2ce9ba9c344a66ab1595d624f89ba6bff1d4f429e37af1b4e006f0e97d78a822',
client_id: 'arcgisonline',
grant_id: 'FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline;;f2b8c5b88ad411ef99f802420aff0004',
sid: 'FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline;;f2b8c5b88ad411ef99f802420aff0004',
sid_encrypted: 'Z0FBQUFBQm5EakRrcjhoV2loN3F4V09VZVQwQzVlQWVRQTMxRjVBMzlQRDVJSEtUbHkwVVF4bXBjdjIzeS1ZcTZaSzBuZDgtVXVFYmcxNzF4NG5OZTk0TE9uZTExVXJlMlZlX05KejkzeWwxZGF2TFljbDVnWWIteTBYVjFqX1ozVl90X0luTHFPQm9qcWE5SGRoWDAxX21Ga1dBVXZrV2RkQ2pfX2tuR3dOQXIwSW83ZE0tb0FrMlRSRDJaVmhXRUkzODhTYmFPTldQQUhoNzFtTFpqWjVkVkswMXhjSlE2VGJTaEtlQlA2bkRPeTh2Smg1ODVQeDdFOHA2WUNsYW1SRUQxUDRwbS1qRG90bFFWYktNeVVxc3JvRnBpVWF2RWc9PQ==',
authorization_code: 'Z0FBQUFBQm5EakRrU196UXJ3NFNVanpjbjNxVjB6N3hlRlFRRGdMLVlEMUpzWF9jM0kyTXNzMTRDdGRoQU81WlNzbTdITnNtakZfaUkzUVBWaG4xMVBHclk2cWprSDY1ZXpzRnNFR2Jzb2RESTFFNzZ0azRiYnBJT0x2VEYzQVE2bS1mX0JOSEtLMXRBa0IwTVVPLVpVanpEbFBEc05YZFM2bkE4MXdRNW5ieTlrTGFUWXdHR3VHLUdyUUFIQzRsUGNsempjMUFqdUxKdWF4aC1GQzVYbnJyVlNfakNablAxd0IyMW1nQ0t6RTFFN1o0M3dObURqRENOQkotb0hlVmpRZXVGb0txdktkNDBMTHZWYTlpdXJqdmVIdjFRTzB4cWZKS1Nkb2UxSVZ2dmxacUgtN3RIaGZHb190WDJKVTB4QTE3Z0VIS05CX2tJV1F2dDZhdHM2MFdJSjVoamw4MG5SUG1FN3EtdjR0dU95dmRJVXR6TW1sNkpMZWRxMzFSa0RGU1NvWDgtNks2OHdhb1g3M3NldXRnSGJ3TG5wZi0xRUw3R25YVE5HUjJLSm8xQ2M5TVktN1Zhc2RfWi1xZ2k1RDN6S2ltMjZ3QlpUVUpFdlprYWhjc1c3dEFfNU0waEI0X2tHTFRzXzhnQndVaUthZGxMZEVicmllbUJrZ05QbHRsNzZZY1ZZNXg4SzVPUGxXYnZzeEFyYmN1S3M2S190alJmRW9RSkljRkg0RE1ENDgxd1d2alg2S0NIRkFxZG1FaGVrUU1jXzRnNkwwcFhGNC1GXzUzb2dPOTVhWjNuaGdrcC13aUNjbVNFdWVTSGdkSnR4STk4NXBYcWRxY0ptZThSRHY5czg5SDJ4QzlIRjJpcXJtckg3OVRoMEdtQUs3d1Y0R0F6ZFMzcXZLT1ppWFhFUEktbThqd00wXzEtQWk2enJ3Q3JYSFhqMWczVnUyZHZoRXlwVHF1dS0zSzZnPT0=',
access_token: null,
id_token: null,
refresh_token: null,
claims: {
nickname: 'xyzxyzx xyzxy,
sub: 'FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT',
given_name: 'xyzxyzx',
email: 'xyz@yyy.yy',
family_name: 'xyzxy',
spidcode: [
'FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT'
]
},
dump: '{"FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT": ["idpyoidc.server.session.info.UserSessionInfo", {"subordinate": ["FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline"], "revoked": false, "type": "UserSessionInfo", "extra_args": {}, "id": "FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT"}], "FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline": ["idpyoidc.server.session.info.ClientSessionInfo", {"subordinate": ["FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline;;f2b8c5b88ad411ef99f802420aff0004"], "revoked": false, "type": "ClientSessionInfo", "extra_args": {}, "id": "arcgisonline"}], "FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT;;arcgisonline;;f2b8c5b88ad411ef99f802420aff0004": ["idpyoidc.server.session.grant.Grant", {"expires_at": 1729026468, "issued_at": 1728983268, "not_before": 0, "revoked": false, "usage_rules": {"access_token": {}, "authorization_code": {"max_usage": 1, "supports_minting": ["access_token", "refresh_token", "id_token"]}, "refresh_token": {"supports_minting": ["access_token", "refresh_token"]}}, "used": 1, "authentication_event": {"idpyoidc.server.authn_event.AuthnEvent": {"uid": "FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT", "authn_info": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", "authn_time": 1728983268, "valid_until": 1728986868}}, "authorization_request": {"idpyoidc.message.oidc.AuthorizationRequest": {"redirect_uri": "https://unimi.maps.arcgis.com/sharing/rest/oauth2/oidc/Cq6hVwUSKnNrL8XG/signin", "client_id": "arcgisonline", "scope": "openid profile email", "response_type": "code", "state": "avxclbbSRa2kr0vKwtP0M1Q..2ml3Jx678axQqNK3dn7_iLUJ8ud0N6fqCYAHFMGqFaANitBBDk4Re8l_bXkYkl90xeUDxI0ABrHDprBv_8xin1EGZSwoRuVcBox7U4ZcwTHsXvfHV-I7R_3mu_1Z_OQqWg3RBmioe1HUfmHeqWSn3UiB6pasMvwfrmPXcZ0Jvcg8Xh_3kqHPGtOzZjvj6kn9Dmpr0nY0pYt1CtcUIrMSAwKaRi8NZg60LWszSn2JMImFb41AwitRkW_wcfBio_1LdTnEgkELjlPrRpw4Tnt8SDnLPo6e-TkgcuGWyqO7YxGQ9PfG7SIjEnTW2Dl-LFkUsy2xfzHLKGaoLXe6I4ZFokbhMD8TkrxHHgOfq_5JqKSVR-QBJ-Mk7XmgkWE1apFvCJqmbw1t005trUdGjitKrbjXuZybCZ-fpAuDm-bGytZuYuWKvM_I4-4-NEZchk5UVif2cgfTLJ4YfF-whGP6TdIYZV6aHozj1Odd89CTSXyIsUU0FyAKZtysAqFPmLKMJ9dk5voIbz46VK-xw1vKGzQd_awXKZHuzsXLRayAETIMYT227yqwHLE464AVq48s-XCLGCntrJPsulG8ewlUcw0twHVKITLZsoRj5YSly834xycmjEIM-c7tOyWmZcyBLl3SoXgzR-9DAnwSY_F5JMJeWBSkpFItcholAAdjfy-ZNEoNaYtS-e5oNGGgmpX1IoYNn0lprrBkhrkdW1K_FBHwLnDSWx4WMIPStG9FehjDFzyxSDyKyFdngm9RJRa3U7YJii898BZfFU2mzUnVVE0Jz02Ivz9-pSlAW4R7dbIUj-6yDB0YZDuCKOIcXAYbIiSmpo3vNTaWWvRExU5Stb9eiHkqw9DTj64ljM5xi1agyJmFSaCrZ8GHnqVxnHRD_MLiTSorPjT44d_1VzHaMwUh7lRMWmn3c5Nlk3_AlUapkJu-jzbtDuu5HaCa-ib5RWEbQhZGeYod5tM_IDi-xvB578ELDyIu2NpMK6UVo4V9WTIQHotZ1hOnXgWepjSXEGS1gw2UF6kxe0BtpBkYBWVzA7oIHeZe41L6I8LQkPVzwFMCFh1x9cfNImDX-K6B53IqPoGxePul58-hlQjbUyT3abPlLZ8jRFZpff6_9XDzmhK_qoRhoX76hf6oqN1g12JgaK2p1o7tb-898njf37LHvjbcv-yESQ4yk_T2LmCNtHrxv_HJQB8zWxg."}}, "claims": {"userinfo": {"sub": null, "name": null, "given_name": null, "family_name": null, "middle_name": null, "nickname": null, "profile": null, "picture": null, "website": null, "gender": null, "birthdate": null, "zoneinfo": null, "locale": null, "updated_at": null, "preferred_username": null, "email": null, "email_verified": null}, "introspection": {}, "id_token": {}, "access_token": {}}, "extra": {}, "resources": ["arcgisonline"], "scope": ["openid", "profile", "email"], "sub": "2ce9ba9c344a66ab1595d624f89ba6bff1d4f429e37af1b4e006f0e97d78a822", "issued_token": [{"idpyoidc.server.session.token.AuthorizationCode": {"expires_at": 0, "issued_at": 1728983268, "not_before": 0, "revoked": false, "usage_rules": {"max_usage": 1, "supports_minting": ["access_token", "refresh_token", "id_token"]}, "used": 0, "claims": {}, "id": "f2b9446f8ad411efada602420aff0004", "name": "AuthorizationCode", "resources": [], "scope": ["openid", "profile", "email"], "token_class": "authorization_code", "value": "Z0FBQUFBQm5EakRrU196UXJ3NFNVanpjbjNxVjB6N3hlRlFRRGdMLVlEMUpzWF9jM0kyTXNzMTRDdGRoQU81WlNzbTdITnNtakZfaUkzUVBWaG4xMVBHclk2cWprSDY1ZXpzRnNFR2Jzb2RESTFFNzZ0azRiYnBJT0x2VEYzQVE2bS1mX0JOSEtLMXRBa0IwTVVPLVpVanpEbFBEc05YZFM2bkE4MXdRNW5ieTlrTGFUWXdHR3VHLUdyUUFIQzRsUGNsempjMUFqdUxKdWF4aC1GQzVYbnJyVlNfakNablAxd0IyMW1nQ0t6RTFFN1o0M3dObURqRENOQkotb0hlVmpRZXVGb0txdktkNDBMTHZWYTlpdXJqdmVIdjFRTzB4cWZKS1Nkb2UxSVZ2dmxacUgtN3RIaGZHb190WDJKVTB4QTE3Z0VIS05CX2tJV1F2dDZhdHM2MFdJSjVoamw4MG5SUG1FN3EtdjR0dU95dmRJVXR6TW1sNkpMZWRxMzFSa0RGU1NvWDgtNks2OHdhb1g3M3NldXRnSGJ3TG5wZi0xRUw3R25YVE5HUjJLSm8xQ2M5TVktN1Zhc2RfWi1xZ2k1RDN6S2ltMjZ3QlpUVUpFdlprYWhjc1c3dEFfNU0waEI0X2tHTFRzXzhnQndVaUthZGxMZEVicmllbUJrZ05QbHRsNzZZY1ZZNXg4SzVPUGxXYnZzeEFyYmN1S3M2S190alJmRW9RSkljRkg0RE1ENDgxd1d2alg2S0NIRkFxZG1FaGVrUU1jXzRnNkwwcFhGNC1GXzUzb2dPOTVhWjNuaGdrcC13aUNjbVNFdWVTSGdkSnR4STk4NXBYcWRxY0ptZThSRHY5czg5SDJ4QzlIRjJpcXJtckg3OVRoMEdtQUs3d1Y0R0F6ZFMzcXZLT1ppWFhFUEktbThqd00wXzEtQWk2enJ3Q3JYSFhqMWczVnUyZHZoRXlwVHF1dS0zSzZnPT0="}}], "token_map": {"authorization_code": "idpyoidc.server.session.token.AuthorizationCode", "access_token": "idpyoidc.server.session.token.AccessToken", "refresh_token": "idpyoidc.server.session.token.RefreshToken", "id_token": "idpyoidc.server.session.token.IDToken"}}], "Z0FBQUFBQm5EakRrcjhoV2loN3F4V09VZVQwQzVlQWVRQTMxRjVBMzlQRDVJSEtUbHkwVVF4bXBjdjIzeS1ZcTZaSzBuZDgtVXVFYmcxNzF4NG5OZTk0TE9uZTExVXJlMlZlX05KejkzeWwxZGF2TFljbDVnWWIteTBYVjFqX1ozVl90X0luTHFPQm9qcWE5SGRoWDAxX21Ga1dBVXZrV2RkQ2pfX2tuR3dOQXIwSW83ZE0tb0FrMlRSRDJaVmhXRUkzODhTYmFPTldQQUhoNzFtTFpqWjVkVkswMXhjSlE2VGJTaEtlQlA2bkRPeTh2Smg1ODVQeDdFOHA2WUNsYW1SRUQxUDRwbS1qRG90bFFWYktNeVVxc3JvRnBpVWF2RWc9PQ==": ["idpyoidc.server.session.grant.Grant", {"expires_at": 1729026468, "issued_at": 1728983268, "not_before": 0, "revoked": false, "usage_rules": {"access_token": {}, "authorization_code": {"max_usage": 1, "supports_minting": ["access_token", "refresh_token", "id_token"]}, "refresh_token": {"supports_minting": ["access_token", "refresh_token"]}}, "used": 1, "authentication_event": {"idpyoidc.server.authn_event.AuthnEvent": {"uid": "FZ3VZ25OOFM5WVNOKC6LOZRDBBKYXWAT", "authn_info": "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", "authn_time": 1728983268, "valid_until": 1728986868}}, "authorization_request": {"idpyoidc.message.oidc.AuthorizationRequest": {"redirect_uri": "https://unimi.maps.arcgis.com/sharing/rest/oauth2/oidc/Cq6hVwUSKnNrL8XG/signin", "client_id": "arcgisonline", "scope": "openid profile email", "response_type": "code", "state": "avxclbbSRa2kr0vKwtP0M1Q..2ml3Jx678axQqNK3dn7_iLUJ8ud0N6fqCYAHFMGqFaANitBBDk4Re8l_bXkYkl90xeUDxI0ABrHDprBv_8xin1EGZSwoRuVcBox7U4ZcwTHsXvfHV-I7R_3mu_1Z_OQqWg3RBmioe1HUfmHeqWSn3UiB6pasMvwfrmPXcZ0Jvcg8Xh_3kqHPGtOzZjvj6kn9Dmpr0nY0pYt1CtcUIrMSAwKaRi8NZg60LWszSn2JMImFb41AwitRkW_wcfBio_1LdTnEgkELjlPrRpw4Tnt8SDnLPo6e-TkgcuGWyqO7YxGQ9PfG7SIjEnTW2Dl-LFkUsy2xfzHLKGaoLXe6I4ZFokbhMD8TkrxHHgOfq_5JqKSVR-QBJ-Mk7XmgkWE1apFvCJqmbw1t005trUdGjitKrbjXuZybCZ-fpAuDm-bGytZuYuWKvM_I4-4-NEZchk5UVif2cgfTLJ4YfF-whGP6TdIYZV6aHozj1Odd89CTSXyIsUU0FyAKZtysAqFPmLKMJ9dk5voIbz46VK-xw1vKGzQd_awXKZHuzsXLRayAETIMYT227yqwHLE464AVq48s-XCLGCntrJPsulG8ewlUcw0twHVKITLZsoRj5YSly834xycmjEIM-c7tOyWmZcyBLl3SoXgzR-9DAnwSY_F5JMJeWBSkpFItcholAAdjfy-ZNEoNaYtS-e5oNGGgmpX1IoYNn0lprrBkhrkdW1K_FBHwLnDSWx4WMIPStG9FehjDFzyxSDyKyFdngm9RJRa3U7YJii898BZfFU2mzUnVVE0Jz02Ivz9-pSlAW4R7dbIUj-6yDB0YZDuCKOIcXAYbIiSmpo3vNTaWWvRExU5Stb9eiHkqw9DTj64ljM5xi1agyJmFSaCrZ8GHnqVxnHRD_MLiTSorPjT44d_1VzHaMwUh7lRMWmn3c5Nlk3_AlUapkJu-jzbtDuu5HaCa-ib5RWEbQhZGeYod5tM_IDi-xvB578ELDyIu2NpMK6UVo4V9WTIQHotZ1hOnXgWepjSXEGS1gw2UF6kxe0BtpBkYBWVzA7oIHeZe41L6I8LQkPVzwFMCFh1x9cfNImDX-K6B53IqPoGxePul58-hlQjbUyT3abPlLZ8jRFZpff6_9XDzmhK_qoRhoX76hf6oqN1g12JgaK2p1o7tb-898njf37LHvjbcv-yESQ4yk_T2LmCNtHrxv_HJQB8zWxg."}}, "claims": {"userinfo": {"sub": null, "name": null, "given_name": null, "family_name": null, "middle_name": null, "nickname": null, "profile": null, "picture": null, "website": null, "gender": null, "birthdate": null, "zoneinfo": null, "locale": null, "updated_at": null, "preferred_username": null, "email": null, "email_verified": null}, "introspection": {}, "id_token": {}, "access_token": {}}, "extra": {}, "resources": ["arcgisonline"], "scope": ["openid", "profile", "email"], "sub": "2ce9ba9c344a66ab1595d624f89ba6bff1d4f429e37af1b4e006f0e97d78a822", "issued_token": [{"idpyoidc.server.session.token.AuthorizationCode": {"expires_at": 0, "issued_at": 1728983268, "not_before": 0, "revoked": false, "usage_rules": {"max_usage": 1, "supports_minting": ["access_token", "refresh_token", "id_token"]}, "used": 0, "claims": {}, "id": "f2b9446f8ad411efada602420aff0004", "name": "AuthorizationCode", "resources": [], "scope": ["openid", "profile", "email"], "token_class": "authorization_code", "value": "Z0FBQUFBQm5EakRrU196UXJ3NFNVanpjbjNxVjB6N3hlRlFRRGdMLVlEMUpzWF9jM0kyTXNzMTRDdGRoQU81WlNzbTdITnNtakZfaUkzUVBWaG4xMVBHclk2cWprSDY1ZXpzRnNFR2Jzb2RESTFFNzZ0azRiYnBJT0x2VEYzQVE2bS1mX0JOSEtLMXRBa0IwTVVPLVpVanpEbFBEc05YZFM2bkE4MXdRNW5ieTlrTGFUWXdHR3VHLUdyUUFIQzRsUGNsempjMUFqdUxKdWF4aC1GQzVYbnJyVlNfakNablAxd0IyMW1nQ0t6RTFFN1o0M3dObURqRENOQkotb0hlVmpRZXVGb0txdktkNDBMTHZWYTlpdXJqdmVIdjFRTzB4cWZKS1Nkb2UxSVZ2dmxacUgtN3RIaGZHb190WDJKVTB4QTE3Z0VIS05CX2tJV1F2dDZhdHM2MFdJSjVoamw4MG5SUG1FN3EtdjR0dU95dmRJVXR6TW1sNkpMZWRxMzFSa0RGU1NvWDgtNks2OHdhb1g3M3NldXRnSGJ3TG5wZi0xRUw3R25YVE5HUjJLSm8xQ2M5TVktN1Zhc2RfWi1xZ2k1RDN6S2ltMjZ3QlpUVUpFdlprYWhjc1c3dEFfNU0waEI0X2tHTFRzXzhnQndVaUthZGxMZEVicmllbUJrZ05QbHRsNzZZY1ZZNXg4SzVPUGxXYnZzeEFyYmN1S3M2S190alJmRW9RSkljRkg0RE1ENDgxd1d2alg2S0NIRkFxZG1FaGVrUU1jXzRnNkwwcFhGNC1GXzUzb2dPOTVhWjNuaGdrcC13aUNjbVNFdWVTSGdkSnR4STk4NXBYcWRxY0ptZThSRHY5czg5SDJ4QzlIRjJpcXJtckg3OVRoMEdtQUs3d1Y0R0F6ZFMzcXZLT1ppWFhFUEktbThqd00wXzEtQWk2enJ3Q3JYSFhqMWczVnUyZHZoRXlwVHF1dS0zSzZnPT0="}}], "token_map": {"authorization_code": "idpyoidc.server.session.token.AuthorizationCode", "access_token": "idpyoidc.server.session.token.AccessToken", "refresh_token": "idpyoidc.server.session.token.RefreshToken", "id_token": "idpyoidc.server.session.token.IDToken"}}]}',
key: 'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy',
salt: 'xxxxxxxxxxxxxxxxxxxxx',
revoked: false
}

RClavero · Answer

Hello @AriannaArona, did you check this BUG and related information?

But you might also want to share other relevant/contextual details.