Master

[AMDoellal]

Signed-off-by: aldo [email protected]

Description

The redirection logic after successful OIDC login has been adjusted to prevent redirection to the callback or login page. This prevents an infinite loop that previously led to a ‘Maximum call stack size exceeded’ error. This improves the stability of the login flow and ensures correct redirection after successful authentication.

Addressed Issue

This change fixes the issue from Issue #5098.

Checklist

• I have read and understand the contributing guidelines
  ~ - [ ] This PR introduces new or alters existing behavior, and I have updated the documentation accordingly ~

[owasp-dt-bot]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

[sebdanielsson]

@nscuro can you take a look at this? Currently preventing SSO with Entra, and a couple of other IDPs I believe.

[sebdanielsson]

Fixes DependencyTrack/dependency-track#5098

[nscuro]

Preventing a redirect to /login would break OIDC authentication entirely, since that is where the actual authentication with DT happens:

frontend/src/views/pages/Login.vue

Lines 266 to 281 in 8fd757b

	// oidcUser will only be set when coming from oidc-callback.html
	if (oidcUser === null) {
	return;
	}
	// Exchange OAuth2 Access Token for a JWT issued by Dependency-Track
	const url = this.$api.BASE_URL + '/' + this.$api.URL_USER_OIDC_LOGIN;
	const requestBody = {
	accessToken: oidcUser.access_token,
	idToken: oidcUser.id_token,
	};
	const config = {
	headers: {
	'Content-Type': 'application/x-www-form-urlencoded',
	},
	};

Was this fix tested?

[nscuro]

Related: #1380