Facing an issue with profile switch during OIDC authentication in OBIEE.

[Satyam92023]

Hi,

We have a OBIEE Environment where we have implemented OIDC authentication. We have seen a behaviour in which when a user login to our portal it gets authenticated from Azure and when he moves to another page his profile gets swapped with different user.
We have enabled the debug and found this behaviour when this function is running.

src/mod_auth_openidc.c(1276): [client 10.*****:44465] oidc_copy_tokens_to_request_state:

[zandbelt]

that sounds off and something that I don't recognize, but we need all available information to debug this, i.e. the full debug logs; also, which version are you on?

[Satyam92023]

Hi zandbelt,

Please find below the detailed summary of the issue.

1. at Thu Dec 05 09:13:26 - Jamie logs in to analytics portal where apache oidc is configured
2. Oidc cookie gets "BT-OIDC-SESSION-APP06635_OrbitKpiDr_PROD" = . it happen twice initially (at 09:13:26.584407 and 09:13:28.225065)
3. Then at 09:13:29.314097 it gets the value "BT-OIDC-SESSION-APP06635_OrbitKpiDr_PROD" = "cfLt5KC38WLHtihkvR7UATSOioI2e"
4. At 09:14:06.534392 Jamie tried to access https://www.test.co.uk/analytics/saw.dll?dashboard&PortalPath=%2Fshared%2FPIA%20Fund%20Report%2F_portal%2FPIA%20Reporting%20Suite
5. Then it seems the session value changed to "BT-OIDC-SESSION-APP06635_OrbitKpiDr_PROD" = "5DvjXq9HTwIpq_corMiJj-IQlBJ"
6. at 09:14:06.534739 we can see oidc set remote_user to "IsLYOcJfi_5gCmnINmf4XuIKqIGWGf9iU3sjwa4jnGcol@login.microsoftonline.com/a7f35688-9c00-4d5e-ba41-2jh146377ab0/v2.0" in existing session "5DvjXq9HTwIpq_corMiJj-IQlBJ"
7. above remove user key value belongs to Shakir which we can see at 09:14:06.534845 when oidc tried to copy token to existing state. There after Jamie's profile switches to Shakir's and is visible in frontend analytics page.

Can someone help us understand the below pointers?

1. why Jamie received 2 null sessions initially?
2. finally when Jamie received successful session, why it changed the session to another User's session?
3. we are seeing this behaviour intermittently, why is this causing?

[Satyam92023]

Attaching the debug logs.
Linux version 7
OBIEE version 12.2.1.3
apache_log_github.txt

[zandbelt]

the log suggests that you're on an old/obsolete version of mod_auth_openidc

[Satyam92023]

mod_auth_openidc-2.4.14.2 --this is the version we are using.

[zandbelt]

running on Oracle HTTP Server is only supported when using the most recent licensed binaries provided as part of the OpenIDC commercial support program