Unregistered redirect_uri using Built-in OIDC Identity Provider

Hello @ashok, 

the redirect_url has wrong schema (http instead of https). This error is caused by the fact the Ingress controller doesn’t pass X-Forwarded-* headers from upstream load balancer to application.

Please add the following annotations to ingress-nginx service helm chart (using values-ingress.yaml file) and perform rollout restart of ingress-nginx deployment:

controller:
  service:
    annotations:
      # This resolves a possible issue with big headers
      proxy-buffer-size: '16k'

      # Improve performance of requests with a large body
      client-body-buffer-size: '1m'

      # use X-Forwarded-* received from ELB - important for proper propagation 
      # of LoadBalancer host, port, and schema
      use-forwarded-headers: 'true'

      # some other annotations...

Especially the “use-forwarded-headers” is very important.

Reapply the ingress-nginx helm chart with these updated values file and restart ingress-nginx deployment using “kubectl rollout restart deployment ...” command.

Then, delete your organization using “kubectl -n gooddata-cn delete org <<your-organization-name>>” and recreate it again with the original definition. This command will reconfigure Dex Oauth2 client with a correct redirect_url.

Dex user will be preserved, but you’ll need to recreate user mapping to organization as described here, with the same authenticationId as before.

Kind regards,

Robert Moucha