I can't select any option with OIDC authentication #3036

imacq · 2025-03-27T12:09:45Z

imacq
Mar 27, 2025

I have been configuring OIDC authentication with Google Workspace/OAuth, but after successfully logging in to the application, I can't select any options from the frontend.

headlamp1.mov

This is my config (I deleted part of the configuration)

What do I need to do to achieve a successful configuration?

Thank

@dosu · 2025-03-27T12:12:32Z

dosubot[bot]
bot Mar 27, 2025

I found a similar unsolved discussion titled "I can't select any option with OIDC authentication" on the Headlamp GitHub repository, which was last updated on March 24, 2025 ^[1].

To configure Headlamp correctly with Google Workspace/OAuth using OIDC, ensure you have the following settings:

Client ID: Use the argument -oidc-client-id or the environment variable HEADLAMP_CONFIG_OIDC_CLIENT_ID. Alternatively, configure it in the YAML file under config.oidc.clientID.
Client Secret: Use the argument -oidc-client-secret or the environment variable HEADLAMP_CONFIG_OIDC_CLIENT_SECRET. Alternatively, configure it in the YAML file under config.oidc.clientSecret.
Issuer URL: Use the argument -oidc-idp-issuer-url or the environment variable HEADLAMP_CONFIG_OIDC_IDP_ISSUER_URL. Alternatively, configure it in the YAML file under config.oidc.issuerURL.
OpenId Scopes (optional): Use the argument -oidc-scopes or the environment variable HEADLAMP_CONFIG_OIDC_SCOPES. The default scopes include openid, profile, and email. You can override these scopes if needed, but remember to include the default ones if they are required. Alternatively, configure it in the YAML file under config.oidc.scopes.

Additionally, configure the OIDC provider with the callback URL, which is your Headlamp URL plus the /oidc-callback path, e.g., https://YOUR_URL/oidc-callback ^[2]^[3].

If you have already set these configurations correctly and are still facing issues, consider checking for any frontend-specific settings or dependencies that might be affecting the interaction. Unfortunately, I couldn't find specific troubleshooting steps for frontend interaction issues after OIDC authentication in the available data.

To continue talking to Dosu, mention @dosu.

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

8 replies

dosubot[bot] bot Mar 27, 2025

If you've implemented the configurations correctly and ensured that the OIDC callback URL is set up, but you're still unable to select any options in the frontend, consider checking the following:

JavaScript Console Errors: Open your browser's developer tools and check the console for any JavaScript errors that might indicate what's going wrong on the frontend.
Network Requests: Use the network tab in the developer tools to verify that requests related to OIDC authentication are being made and are successful. Look for any failed requests or unexpected responses.
CORS Issues: Ensure that there are no Cross-Origin Resource Sharing (CORS) issues preventing the frontend from communicating with the backend.
Frontend Dependencies: Verify that all necessary frontend dependencies are correctly installed and up to date. Sometimes, missing or outdated dependencies can cause issues with UI interactions.
Browser Extensions: Disable any browser extensions that might interfere with the application's functionality, as they can sometimes block or alter requests.
Clear Cache: Try clearing your browser cache or using an incognito window to rule out any caching issues.

If none of these steps resolve the issue, it might be helpful to review any recent changes or updates to the Headlamp application or your environment that could have introduced this problem.

To continue talking to Dosu, mention @dosu.

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

imacq Mar 27, 2025
Author

I got this:

index-COoiscxT.js:977 Cross-Origin-Opener-Policy policy would block the window.close call.
F @ index-COoiscxT.js:977
index-COoiscxT.js:977 Cross-Origin-Opener-Policy policy would block the window.close call.
F @ index-COoiscxT.js:977
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/nodes 401 (Unauthorized)
backendFetch @ index-COoiscxT.js:867
clusterFetch @ index-COoiscxT.js:867
await in clusterFetch
queryFn @ index-COoiscxT.js:867
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/apis/metrics.k8s.io/v1beta1/nodes 401 (Unauthorized)
clusterRequest @ index-COoiscxT.js:867
await in clusterRequest
I @ index-COoiscxT.js:867
metrics @ index-COoiscxT.js:867
(anonymous) @ index-COoiscxT.js:867
(anonymous) @ index-COoiscxT.js:867
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 Logging out due to auth error {status: 401, statusText: '', path: '/apis/metrics.k8s.io/v1beta1/nodes'}
clusterRequest @ index-COoiscxT.js:867
await in clusterRequest
I @ index-COoiscxT.js:867
metrics @ index-COoiscxT.js:867
(anonymous) @ index-COoiscxT.js:867
(anonymous) @ index-COoiscxT.js:867
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/pods 401 (Unauthorized)
backendFetch @ index-COoiscxT.js:867
clusterFetch @ index-COoiscxT.js:867
await in clusterFetch
queryFn @ index-COoiscxT.js:867
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/version 401 (Unauthorized)
clusterRequest @ index-COoiscxT.js:867
await in clusterRequest
getVersion @ index-COoiscxT.js:867
queryFn @ index-COoiscxT.js:1129
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 Logging out due to auth error {status: 401, statusText: '', path: '/version'}
clusterRequest @ index-COoiscxT.js:867
await in clusterRequest
getVersion @ index-COoiscxT.js:867
queryFn @ index-COoiscxT.js:1129
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/namespaces 401 (Unauthorized)
backendFetch @ index-COoiscxT.js:867
clusterFetch @ index-COoiscxT.js:867
await in clusterFetch
queryFn @ index-COoiscxT.js:867
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 
            
            
           GET https://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/events?limit=2000 401 (Unauthorized)
backendFetch @ index-COoiscxT.js:867
clusterFetch @ index-COoiscxT.js:867
await in clusterFetch
queryFn @ index-COoiscxT.js:867
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:1129 Getting the cluster version: Error:  - Unauthorized
    at clusterRequest (index-COoiscxT.js:867:4908)
(anonymous) @ index-COoiscxT.js:1129
Promise.catch
queryFn @ index-COoiscxT.js:1129
L @ index-COoiscxT.js:2
U @ index-COoiscxT.js:2
start @ index-COoiscxT.js:2
fetch @ index-COoiscxT.js:2
Hs @ index-COoiscxT.js:2
onSubscribe @ index-COoiscxT.js:2
subscribe @ index-COoiscxT.js:2
(anonymous) @ index-COoiscxT.js:2
xb @ vendor-mui-DHkS_647.js:38
gu @ vendor-mui-DHkS_647.js:40
Zi @ vendor-mui-DHkS_647.js:40
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Kh @ vendor-mui-DHkS_647.js:40
Br @ vendor-mui-DHkS_647.js:38
VR @ vendor-mui-DHkS_647.js:40
Wr @ vendor-mui-DHkS_647.js:40
Zb @ vendor-mui-DHkS_647.js:40
R @ vendor-mui-DHkS_647.js:25
B @ vendor-mui-DHkS_647.js:25
index-COoiscxT.js:867 WebSocket connection to 'wss://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/namespaces?watch=1&resourceVersion=21467299' failed: 
openWebSocket @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket error: Event {isTrusted: true, type: 'error', target: WebSocket, currentTarget: WebSocket, eventPhase: 2, …}
(anonymous) @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket connection to 'wss://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/events?limit=2000&watch=1&resourceVersion=21467380' failed: 
openWebSocket @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket error: Event {isTrusted: true, type: 'error', target: WebSocket, currentTarget: WebSocket, eventPhase: 2, …}
(anonymous) @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket connection to 'wss://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/pods?watch=1&resourceVersion=21467299' failed: 
openWebSocket @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket error: Event {isTrusted: true, type: 'error', target: WebSocket, currentTarget: WebSocket, eventPhase: 2, …}
(anonymous) @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket connection to 'wss://k8s-dash-core-test-dev.onum-labs.com/clusters/main/api/v1/nodes?watch=1&resourceVersion=21467305' failed: 
openWebSocket @ index-COoiscxT.js:867
index-COoiscxT.js:867 WebSocket error: Event {isTrusted: true, type: 'error', target: WebSocket, currentTarget: WebSocket, eventPhase: 2, …}
(anonymous) @ index-COoiscxT.js:867

@dosu

dosubot[bot] bot Mar 27, 2025

The errors you're encountering seem to be related to two main issues: Cross-Origin-Opener-Policy (COOP) and 401 Unauthorized errors.

Cross-Origin-Opener-Policy (COOP): This policy is designed to prevent cross-origin attacks by isolating browsing contexts. The error message indicates that the COOP policy is blocking the window.close call. To address this, you may need to adjust the COOP settings on your server to allow the necessary operations. This might involve setting the Cross-Origin-Opener-Policy header to same-origin or same-origin-allow-popups depending on your security requirements.
401 Unauthorized Errors: These errors suggest that the authentication process is not completing successfully. Here are a few steps to troubleshoot:
- Verify OIDC Configuration: Double-check your OIDC settings, including the client ID, client secret, issuer URL, and scopes. Ensure they match the configuration expected by your OIDC provider.
- Token Expiry: Ensure that the tokens are not expired and are being refreshed correctly.
- Network Requests: Use the browser's network tab to inspect the requests and responses related to authentication. Look for any discrepancies or errors in the authentication flow.
- Backend Logs: Check the backend logs for any errors or warnings that might provide more context on why the authentication is failing.
WebSocket Connection Failures: These could be related to the authentication issues. Ensure that the WebSocket connections are properly authenticated and that the necessary permissions are granted.

If these steps don't resolve the issues, consider reviewing any recent changes to your environment or application that might have affected the authentication or COOP settings.

To continue talking to Dosu, mention @dosu.

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

imacq Mar 29, 2025
Author

The OIDC configuration is ok.
Cross-Origin-Opener-Policy (COOP): I don't need that if I authenticate with a token.
The token expiry is 1h

The headlamp developers can tell me what is the possible issue?

@dosu

dosubot[bot] bot Mar 29, 2025

The issue you're facing with 401 Unauthorized errors might be related to token handling in Headlamp. Headlamp manages token expiration and refresh by checking if the token is about to expire and refreshing it if necessary. Ensure that the token refresh mechanism is functioning correctly. The backend should send a refreshed token in the response header if the token is nearing expiration, and this new token should be set using the setToken function ^[1].

Additionally, the error message 'http: proxy error: No valid id-token, and cannot refresh without refresh-token' indicates a potential issue with token refresh. Ensure that your configuration allows for token refresh and that the necessary refresh tokens are available ^[2].

If the token refresh mechanism is not working as expected, it could lead to the 401 errors you're experiencing. Double-check the backend configuration and logs to ensure that tokens are being refreshed properly.

This is a tough nut to crack, could really use your help on this, @joaquimrocha.

To continue talking to Dosu, mention @dosu.

^{Help Dosu learn! Give it feedback: Great Response | Irrelevant Answer | Incorrect Sources | Too Verbose | Hallucination | Bug Report | Other}

I can't select any option with OIDC authentication #3036

Uh oh!

Uh oh!

imacq Mar 27, 2025

Replies: 1 comment · 8 replies

Uh oh!

dosubot[bot] bot Mar 27, 2025

Uh oh!

dosubot[bot] bot Mar 27, 2025

Uh oh!

Uh oh!

imacq Mar 27, 2025 Author

Uh oh!

dosubot[bot] bot Mar 27, 2025

Uh oh!

Uh oh!

imacq Mar 29, 2025 Author

Uh oh!

dosubot[bot] bot Mar 29, 2025

imacq
Mar 27, 2025

Replies: 1 comment 8 replies

dosubot[bot]
bot Mar 27, 2025

imacq Mar 27, 2025
Author

imacq Mar 29, 2025
Author