# Error using OIDC

**URL:** <https://community.temporal.io/t/error-using-oidc/4501>\
**Category:** Community Support\
**Tags:** web-ui\
**Created:** [April 21, 2022, 3:00pm UTC](https://community.temporal.io/t/error-using-oidc/4501 "2022-04-21T15:00:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sumesh\_kanayi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sumesh_kanayi/32/1876_2.png) [@sumesh\_kanayi](https://community.temporal.io/u/sumesh_kanayi)\
**Post date:** [April 21, 2022, 3:00pm UTC](https://community.temporal.io/t/error-using-oidc/4501/1 "2022-04-21T15:00:25Z")

</div>

Hi I am running temporal on docker-compose (v1.14.0 web) and currently trying to use hashicorp vault as an OIDC provider ([Vault as an OIDC Identity Provider | Vault - HashiCorp Learn](https://learn.hashicorp.com/tutorials/vault/oidc-identity-provider?in=vault/new-release)).  
I can see temporal home page redirecting to [http://localhost:8088/signin](http://localhost:8088/signin) but ends up with the below message (as seen in docker compose logs)

```auto
temporal | {"level":"info","ts":"2022-04-21T14:43:43.583Z","msg":"Get dynamic config","name":"history.shardUpdateMinInterval","value":300,"default-value":300,"logging-call-at":"config.go:79"}
temporal | {"level":"info","ts":"2022-04-21T14:43:43.585Z","msg":"Get dynamic config","name":"history.emitShardDiffLog","value":false,"default-value":false,"logging-call-at":"config.go:79"}
temporal-web | [2022-04-21T14:43:45.130Z] Error: Request unauthorized. method: getVersionInfo, req: undefined
temporal-web | at buildGrpcMetadata (/usr/app/server/temporal-client/with-auth-metadata.js:43:13)
temporal-web | at async Proxy.<anonymous> (/usr/app/server/temporal-client/with-auth-metadata.js:20:24)
temporal-web | at async TemporalClient.getVersionInfo (/usr/app/server/temporal-client/temporal-client.js:294:15)
temporal-web | at async Proxy.<anonymous> (/usr/app/server/temporal-client/with-error-converter.js:30:18)
temporal-web | at async /usr/app/server/routes.js:395:15
temporal-web | at async initialize (/usr/app/server/auth/index.js:47:3)
temporal-web | at async session (/usr/app/node_modules/koa-session/index.js:41:7)
temporal-web | at async bodyParser (/usr/app/node_modules/koa-bodyparser/index.js:95:5)
temporal-web | at async /usr/app/server/index.js:43:9

```

Chrome dev tools shows the below error

```auto
vue-router.esm.js:1958 Uncaught (in promise) NavigationDuplicated: Avoided redundant navigation to current location: "/signin".
    at createRouterError (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:110502:15)
    at createNavigationDuplicatedError (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:110487:15)
    at HTML5History.confirmTransition (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:110761:18)
    at HTML5History.transitionTo (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:110696:8)
    at HTML5History.push (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:111028:10)
    at http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:111450:22
    at new Promise (<anonymous>)
    at VueRouter.push (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:111449:12)
    at VueComponent.redirectIfApplicable (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:77009:22)
    at _callee$ (http://localhost:8088/temporal.ccf42fcdf96a0e6e3cff.js:76914:21)
createRouterError @ vue-router.esm.js:1958
createNavigationDuplicatedError @ vue-router.esm.js:1928
confirmTransition @ vue-router.esm.js:2222
transitionTo @ vue-router.esm.js:2152
push @ vue-router.esm.js:2519
(anonymous) @ vue-router.esm.js:2950
push @ vue-router.esm.js:2949
redirectIfApplicable @ App.vue:113
_callee$ @ App.vue:72
tryCatch @ runtime.js:65
invoke @ runtime.js:303
prototype.<computed> @ runtime.js:117
asyncGeneratorStep @ App.vue:22
_next @ App.vue:22
Promise.then (async)
asyncGeneratorStep @ App.vue:22
_next @ App.vue:22
(anonymous) @ App.vue:22
(anonymous) @ App.vue:22
created @ App.vue:70
invokeWithErrorHandling @ vue.esm.js:1863
callHook @ vue.esm.js:4228
Vue._init @ vue.esm.js:5017
VueComponent @ vue.esm.js:5163
createComponentInstanceForVnode @ vue.esm.js:3292
init @ vue.esm.js:3123
createComponent @ vue.esm.js:5989
createElm @ vue.esm.js:5936
patch @ vue.esm.js:6527
Vue._update @ vue.esm.js:3954
updateComponent @ vue.esm.js:4075
get @ vue.esm.js:4488
Watcher @ vue.esm.js:4477
mountComponent @ vue.esm.js:4082
Vue.$mount @ vue.esm.js:9063
Vue.$mount @ vue.esm.js:11974
Vue._init @ vue.esm.js:5027
Vue @ vue.esm.js:5094
(anonymous) @ main.js:292
__webpack_require__ @ bootstrap ccf42fcdf96a0e6e3cff:19
(anonymous) @ temporal.ccf42fcdf96a0e6e3cff.js:101151
__webpack_require__ @ bootstrap ccf42fcdf96a0e6e3cff:19
(anonymous) @ bootstrap ccf42fcdf96a0e6e3cff:62
(anonymous) @ bootstrap ccf42fcdf96a0e6e3cff:62
http.js:42 GET http://localhost:8088/api/cluster/version-info 500 (Internal Server Error)

```

Below is my temporal config file

```auto
auth:
  enabled: true
  providers:
        - label: 'vault' # for internal use; in future may expose as button text
          type: oidc # for futureproofing; only oidc is supported today
          issuer: https://temporal-vault-dev.mycom.net:8200/v1/identity/oidc/provider/temporal1
          client_id: T258grwetuoBcibuSjYMwLwoJl2miwwP
          client_secret: hvo_secret_ojo6IiVW1GHi0Jl1c0WDxdTs1WssN4vckvxD7Ac0V2cTLWLVdW1RSyaVAL71gVWf
          scope: openid profile email groups

```

OIDC provider config as below

```auto
{
  "issuer": "https://temporal-vault-dev.mycom.net:8200/v1/identity/oidc/provider/temporal1",
  "jwks_uri": "https://temporal-vault-dev.mycom.net:8200/v1/identity/oidc/provider/temporal1/.well-known/keys",
  "authorization_endpoint": "https://temporal-vault-dev.mycom.net:8200/ui/vault/identity/oidc/provider/temporal1/authorize",
  "token_endpoint": "https://temporal-vault-dev.mycom.net:8200/v1/identity/oidc/provider/temporal1/token",
  "userinfo_endpoint": "https://temporal-vault-dev.mycom.net:8200/v1/identity/oidc/provider/temporal1/userinfo",
  "request_uri_parameter_supported": false,
  "id_token_signing_alg_values_supported": [
    "RS256",
    "RS384",
    "RS512",
    "ES256",
    "ES384",
    "ES512",
    "EdDSA"
  ],
  "response_types_supported": [
    "code"
  ],
  "scopes_supported": [
    "email",
    "groups",
    "profile",
    "openid"
  ],
  "subject_types_supported": [
    "public"
  ],
  "grant_types_supported": [
    "authorization_code"
  ],
  "token_endpoint_auth_methods_supported": [
    "none",
    "client_secret_basic"
  ]
}

```

i can also confirm that the entity against which i generated the client id are part of groups system:admin,temporal-system:admin etc

---

<div class="post-metadata">

**Author:** ![Ruslan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruslan/32/66_2.png) [@Ruslan](https://community.temporal.io/u/Ruslan)\
**Post date:** [April 21, 2022, 6:17pm UTC](https://community.temporal.io/t/error-using-oidc/4501/2 "2022-04-21T18:17:56Z")

</div>

does the page itself renders blank or you can see the `SSO` button? If you see the button, can you still log in?

Regarding the logged errors, both are somewhat expected (if not yet logged in)

- `getVersionInfo` may fail as your Temporal Service authorizer plugin may reject the call that doesn’t have proper permissions/token. After the user logs in, i would expect your authorizer plugin implementation to allow the request. Even if not, this failure shouldn’t block the UI
- `NavigationDuplicated` is a known issue in Web UI v1/vue. You can just ignore this error, it doesn’t affect the UI functionality

---

<div class="post-metadata">

**Author:** ![sumesh\_kanayi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sumesh_kanayi/32/1876_2.png) [@sumesh\_kanayi](https://community.temporal.io/u/sumesh_kanayi)\
**Post date:** [April 22, 2022, 4:24am UTC](https://community.temporal.io/t/error-using-oidc/4501/3 "2022-04-22T04:24:17Z")

</div>

Thanks for your quick resoponse @Ruslan . I started debugging more on this and can see that its failing with this error from vault and redirects back to SSO

secrets.identity.identity\_e7699e9d: client failed to authenticate with invalid client secret: client\_id=rjtQZdIhEspKmMhBDCfz6ve02luEDiYX

Same i tested with [GitHub - dexidp/dex: OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors](https://github.com/dexidp/dex) and it went through fine.Seems like it has to do something with the way temporal talks to the OIDC backend? I will share more details on it soon

---

<div class="post-metadata">

**Author:** ![sumesh\_kanayi](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/sumesh_kanayi/32/1876_2.png) [@sumesh\_kanayi](https://community.temporal.io/u/sumesh_kanayi)\
**Post date:** [April 22, 2022, 4:29am UTC](https://community.temporal.io/t/error-using-oidc/4501/4 "2022-04-22T04:29:26Z")

</div>

Ohh i just saw your comments in slack changing [web/oidc.js at master · temporalio/web · GitHub](https://github.com/temporalio/web/blob/master/server/auth/oidc.js#L10) to to client\_secret\_basic seems to have fixed the problem