Hello All, Did something change with GoodData's authentication protocols?

Hi Steve, Sorry to hear about your troubles, but I am not aware of such change on our end. Could you be so kind and share some error or traceId with me, please? (Feel free to use a DM, if it works better for you).

Hi Steve, I am investigating, just a question in the meantime, which OIDC IdP are you using?

IdentityServer4

Steve, the situation is following - we indeed made some small changes today to our OIDC implementation as part of preparation for JIT provisioning. We tested it against the standard OIDC IdPs and implementations, but it seems to have broken something in yours related to scopes. Which is strange, because any changes needed to be explicitly enabled in the organization config. GoodData operates with following scopes:

openid, profile, email, offline_access

As per your OIDC config file <issuer_url>/.well-known/openid-configuration your IdP supports all of these. But it's possible that the

email

scope was added with this change. It could mean that it's not included in the client you use for gooddata and the solution could be as simple as adding it. Also, you might be able to find more in your OIDC logs with request id

400182f8-0000-d300-b63f-84710c7967bb

. We are still looking into it, but if this cannot be resolved soon, we will consider reverting the changes.

"AllowedScopes": [ "openid", "profile", "name", "offline_access" ],

yes, so it seems that it's indeed missing email.

I can try, though I cannot guarantee its being passed

sure, I guess we'll find out right away ....

looks like that might be the issue

I can see that your DEV environment now redirects correctly, so I guess it works

yeah, guess i'm glad tahts the fix

Really sorry for the caused inconvenience Steve

just makes me real nervous as this is not the first time something like this has caused us issues

it wasn't, it was just a partial change of the bigger implementation,

Luckily we're doing a release tonight where we can address this, but 100% not a great experience.

We are really sorry for your troubles here and we will try our best to avoid similar situations in future.

I mean I understand and am glad it was easy to fix and not a customer impact.