I successfully deployed a dex authentication provider which XWiki connects to via OpenID. However, only the email and the user ID are taken over by XWiki. Is there any way to log the JSON response from the OpenID provider in XWiki to allow me to debug what’s going on?
I though that having openid in the oidc.scope is enough to retrieve the userinfo but apparently it does not work. This is how a user profile looks like after authenticating:
My guess is that either a scope is wrongly set or the field names are different and I need to set up some oidc.user.mapping=... in the xwiki.properties configuration, but I am only guessing.
I really need to see the JSON that arrives at XWiki…
The annoying thing is that I have to enable superadmin each time, bypass OpenID by setting oidc.skip=true, restart the whole container and wait 5 minutes or so until everything is up. Delete the user in XWiki, then re-enable OpenID, waiting 5 minutes and try again with the OpenID login. So each change and guess takes like 15min to validate. It’s so tedious
The <logger name="org.xwiki.contrib.oidc" level="trace"/> setting is instantaneous isn’t it? I am running XWiki in a Docker Swarm and the WEB-INF stuff gets reset on each restart.
It’s enough, if that’s what you mean, yes. I assume you restarted several times already after setting that. You might want to double check in the logging admin view if this name indeed is associated to TRACE level.
Any authentication is supposed to produce quite a lot of debug log.
After fiddling around, this is all I can squeeze out (grepping for org.xwiki.contrib). Nothing with user info unfortunately.
wiki_web | at org.xwiki.contrib.oidc.auth.internal.session.ClientHttpSessionListener.onEvent(ClientHttpSessionListener.java:62)
wiki_web | at org.xwiki.contrib.oidc.auth.internal.session.ClientHttpSessions.logout(ClientHttpSessions.java:136)
wiki_web | at org.xwiki.contrib.oidc.auth.internal.OIDCUserManager.logout(OIDCUserManager.java:906)
wiki_web | at org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl.checkAuthOIDC(OIDCAuthServiceImpl.java:123)
wiki_web | at org.xwiki.contrib.oidc.auth.OIDCAuthServiceImpl.checkAuth(OIDCAuthServiceImpl.java:92)
wiki_web | 2025-03-11 09:32:47,524 [http-nio-8080-exec-3 - http://wiki/bin/logout/XWiki/XWikiLogout?xredirect=%2Fbin%2Fview%2FXWiki%2Ftamasgal] ERROR .o.i.DefaultObservationManager - Failed to send event [org.xwiki.container.servlet.events.SessionDestroyedEvent@59e3f2aa] to listener [org.xwiki.contrib.oidc.auth.internal.session.ClientHttpSessionListener@5363d5ca]
wiki_web | at org.xwiki.contrib.oidc.auth.internal.session.ClientHttpSessionListener.onEvent(ClientHttpSessionListener.java:62)
EDIT: I just created a completely new user with a completely different GitHub account. No user info JSON was printed in the logs, only lines like above.
I hope I am doing it correctly. Just for the sake of completeness, this is where I added the oidc logger:
...
...
<!-- Deactive PDF Export CSS Applier warnings -->
<logger name="org.apache.fop.layoutmgr.inline.ContentLayoutManager" level="error"/>
<logger name="info.informatica.doc.style.css.dom" level="error"/>
<!-- Deactivate JGroups warnings -->
<logger name="org.jgroups" level="error"/>
<logger name="org.xwiki.contrib.oidc" level="trace"/>
<!-- By default everything that is of severity WARN, ERROR or FATAL is logged to the console.
Since the console output is captured and redirected by the servlet container in most cases,
the logs will end up the container's logs, for example in catalina.out in Tomcat.
-->
<root level="warn">
<appender-ref ref="stdout"/>
</root>
</configuration>
Looks OK. It really feels like the logback.xml file you are modifying is not the one that actually end up being loaded. Not really an expert in the docker way of deploying XWiki, so I’m not sure where it’s supposed to be modified or if there is a known problem with it.
In any case, you should check the logging admin for the level of org.xwiki.contrib.oidc. If it’s not TRACE, you can switch it in the UI (you have to do it after each restart, but at least you are sure it works).
One simple possibility might be to map the XWiki first_name with the OIDC name. It’s not ideal in terms of user profile, but at least the user display name should look pretty much as expected elsewhere.
