[GH-ISSUE #1565] Bug in OpenID based federated login #342

New issue

Closed

opened 2026-03-07 20:47:58 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 20:47:58 +03:00

Owner

Originally created by @HeedoKang on GitHub (Mar 24, 2023).
Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/1565

Describe the bug
I am currently conducting tests on CloudBeaver EE version 23.0.0 running on EKS with AWS Cognito, using OpenID-based federated authentication. Although I have successfully configured all the necessary OpenID settings (Client ID, Client Secret, IDP authentication endpoint URL, IDP token endpoint URL) in CloudBeaver, I am encountering an error. My configuration details are as follows:

Client ID: ID of Cognito user pool client
Client Secret: Secret of Cognito user pool client
IDP authentication endpoint URL: https://$custom_user_pool_domain/oauth2/authorize
IDP token endpoint URL: https://$custom_user_pool_domain/oauth2/token

To verify that the access token can be issued successfully, I have tested my configuration using the curl tool in both the terminal on my laptop and CloudBeaver's EKS pod, and both tests produced successful results. However, when attempting to use federated login in CloudBeaver, I consistently receive the following error:

Caused by: io.cloudbeaver.DBWebException: Cannot invoke com.nimbusds.oauth2.sdk.Scope.toString() because the return value of com.nimbusds.oauth2.sdk.token.AccessToken.getScope() is null

I have also checked the scope field in the access token by decoding it via the terminal, but it was not empty. An example of the issued token is provided below.

{
  “id_token”: “...”,
  “access_token”: “eyJraWQiOiJYUHN2Y2MxUTA4UENFXC9XejY0ekhFbXcrMktJM3ByUlpLcDJzVmNkYTZVVT0iLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIzNTk1Y2E3Yi1mYjZiLTRmZmMtYmI0OC05YjQ3NGVlMGIzNGYiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAuYXAtbm9ydGhlYXN0LTIuYW1hem9uYXdzLmNvbVwvYXAtbm9ydGhlYXN0LTJfam9CRmdmN1RsIiwidmVyc2lvbiI6MiwiY2xpZW50X2lkIjoiN2lxYzQzbW9ybGY1bWVkbGkzbnE3a25pdTAiLCJvcmlnaW5fanRpIjoiNTFmYmMzOTAtZGNkNi00YmU5LTg4ZTEtMTkwZGZiNTljYjFjIiwidG9rZW5fdXNlIjoiYWNjZXNzIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCIsImF1dGhfdGltZSI6MTY3OTY1ODc3MSwiZXhwIjoxNjc5NjczMTcxLCJpYXQiOjE2Nzk2NTg3NzEsImp0aSI6ImI2Y2Y4ZGVhLTRjZTUtNGJiNC04MjUxLTQzMGUyMTUwMWM0ZiIsInVzZXJuYW1lIjoi6rCV7Z2s64-EIn0.ItcXcI9x5quocN3Ucj_fMcz16S70jHu0v2jAjQvuLvaUXhQf6wbC_Fs7-SrzBkJvvkjq1j3nRwgCukmqF-SDqBEp9Exn5abTyZAHxYyJzdEKw0txGnBcBIYvtwYn71v7svF_N4IBlYYV-1cc3l_Ny7Uvl-6YqFeo3m4b4lpxt7R8O4U_M4ZGnlvrYuPFQKwHzgUcZiklrlWJU0UfK3DZbo3enLQfd9-1GZN7tJk56ZrWt2cdBx5GyR0MXdWT2lk-8glvyFBUb88xVvn-tTTeKqFw22cv06Sg_x1tuViJ24EOCDQ6kH0aKpzhb1a9rMcN7yOSfCe31iwwntrJKCZ7Aw”,
  “refresh_token”:“...”,
  “expires_in”:14400,
  “token_type”:“Bearer”
}

To Reproduce

Set AWS Cognito as identity provider (add callback url https://<>/api/openid/cognito/callback)
Set CloudBeaver's OpenID based federated login
Federated login
See error

Screenshots

Desktop (please complete the following information):

OS: Both of Mac/Windows
Browser: Both of chrome/safari
Version : dbeaver/cloudbeaver-ee:23.0.0

Additional context

Error log in the CloudBeaver's container:

12:05:11.627 [qtp326692514-61] DEBUG i.c.server.graphql.GraphQLEndpoint - GraphQL call failed at '/authInfo'
io.cloudbeaver.DBWebException: Cannot invoke "com.nimbusds.oauth2.sdk.Scope.toString()" because the return value of "com.nimbusds.oauth2.sdk.token.AccessToken.getScope()" is null
	at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authUpdateStatus(WebServiceAuthImpl.java:124)
	at jdk.internal.reflect.GeneratedMethodAccessor17.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.base/java.lang.reflect.Method.invoke(Unknown Source)
	at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:166)
	at jdk.proxy6/jdk.proxy6.$Proxy12.authUpdateStatus(Unknown Source)
	at io.cloudbeaver.service.auth.WebServiceBindingAuth.lambda$2(WebServiceBindingAuth.java:53)
	at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:258)
	at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:197)
	at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:72)
	at graphql.execution.Execution.executeOperation(Execution.java:160)
	at graphql.execution.Execution.execute(Execution.java:101)
	at graphql.GraphQL.execute(GraphQL.java:591)
	at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:521)
	at graphql.GraphQL.executeAsync(GraphQL.java:495)
	at graphql.GraphQL.execute(GraphQL.java:426)
	at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:254)
	at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:200)
	at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:183)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:517)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:584)
	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764)
	at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665)
	at org.eclipse.jetty.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:170)
	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202)
	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635)
	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1571)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221)
	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1383)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176)
	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484)
	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1544)
	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174)
	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1305)
	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129)
	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122)
	at org.eclipse.jetty.server.Server.handle(Server.java:563)
	at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:505)
	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:762)
	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:497)
	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
	at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277)
	at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:139)
	at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:933)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1077)
	at java.base/java.lang.Thread.run(Unknown Source)
Caused by: io.cloudbeaver.DBWebException: Cannot invoke "com.nimbusds.oauth2.sdk.Scope.toString()" because the return value of "com.nimbusds.oauth2.sdk.token.AccessToken.getScope()" is null
	at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authUpdateStatus(WebServiceAuthImpl.java:117)
	... 53 common frames omitted

Originally created by @HeedoKang on GitHub (Mar 24, 2023). Original GitHub issue: https://github.com/dbeaver/cloudbeaver/issues/1565 **Describe the bug** I am currently conducting tests on CloudBeaver EE version 23.0.0 running on EKS with AWS Cognito, using OpenID-based federated authentication. Although I have successfully configured all the necessary OpenID settings (Client ID, Client Secret, IDP authentication endpoint URL, IDP token endpoint URL) in CloudBeaver, I am encountering an error. My configuration details are as follows: Client ID: ID of Cognito user pool client Client Secret: Secret of Cognito user pool client IDP authentication endpoint URL: https://$custom_user_pool_domain/oauth2/authorize IDP token endpoint URL: https://$custom_user_pool_domain/oauth2/token To verify that the access token can be issued successfully, I have tested my configuration using the curl tool in both the terminal on my laptop and CloudBeaver's EKS pod, and both tests produced successful results. However, when attempting to use federated login in CloudBeaver, I consistently receive the following error: ```Caused by: io.cloudbeaver.DBWebException: Cannot invoke com.nimbusds.oauth2.sdk.Scope.toString() because the return value of com.nimbusds.oauth2.sdk.token.AccessToken.getScope() is null``` I have also checked the scope field in the access token by decoding it via the terminal, but it was not empty. An example of the issued token is provided below. ``` { “id_token”: “...”, “access_token”: “eyJraWQiOiJYUHN2Y2MxUTA4UENFXC9XejY0ekhFbXcrMktJM3ByUlpLcDJzVmNkYTZVVT0iLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiIzNTk1Y2E3Yi1mYjZiLTRmZmMtYmI0OC05YjQ3NGVlMGIzNGYiLCJpc3MiOiJodHRwczpcL1wvY29nbml0by1pZHAuYXAtbm9ydGhlYXN0LTIuYW1hem9uYXdzLmNvbVwvYXAtbm9ydGhlYXN0LTJfam9CRmdmN1RsIiwidmVyc2lvbiI6MiwiY2xpZW50X2lkIjoiN2lxYzQzbW9ybGY1bWVkbGkzbnE3a25pdTAiLCJvcmlnaW5fanRpIjoiNTFmYmMzOTAtZGNkNi00YmU5LTg4ZTEtMTkwZGZiNTljYjFjIiwidG9rZW5fdXNlIjoiYWNjZXNzIiwic2NvcGUiOiJvcGVuaWQgcHJvZmlsZSBlbWFpbCIsImF1dGhfdGltZSI6MTY3OTY1ODc3MSwiZXhwIjoxNjc5NjczMTcxLCJpYXQiOjE2Nzk2NTg3NzEsImp0aSI6ImI2Y2Y4ZGVhLTRjZTUtNGJiNC04MjUxLTQzMGUyMTUwMWM0ZiIsInVzZXJuYW1lIjoi6rCV7Z2s64-EIn0.ItcXcI9x5quocN3Ucj_fMcz16S70jHu0v2jAjQvuLvaUXhQf6wbC_Fs7-SrzBkJvvkjq1j3nRwgCukmqF-SDqBEp9Exn5abTyZAHxYyJzdEKw0txGnBcBIYvtwYn71v7svF_N4IBlYYV-1cc3l_Ny7Uvl-6YqFeo3m4b4lpxt7R8O4U_M4ZGnlvrYuPFQKwHzgUcZiklrlWJU0UfK3DZbo3enLQfd9-1GZN7tJk56ZrWt2cdBx5GyR0MXdWT2lk-8glvyFBUb88xVvn-tTTeKqFw22cv06Sg_x1tuViJ24EOCDQ6kH0aKpzhb1a9rMcN7yOSfCe31iwwntrJKCZ7Aw”, “refresh_token”:“...”, “expires_in”:14400, “token_type”:“Bearer” } ``` **To Reproduce** 1. Set AWS Cognito as identity provider (add callback url https://<<cloudbeaver domain>>/api/openid/cognito/callback) 2. Set CloudBeaver's OpenID based federated login 3. Federated login 4. See error **Screenshots** ![image](https://user-images.githubusercontent.com/17255127/227518138-4742f825-6854-4e26-882d-6675c8685ff8.png) **Desktop (please complete the following information):** - OS: Both of Mac/Windows - Browser: Both of chrome/safari - Version : dbeaver/cloudbeaver-ee:23.0.0 **Additional context** - Error log in the CloudBeaver's container: ``` 12:05:11.627 [qtp326692514-61] DEBUG i.c.server.graphql.GraphQLEndpoint - GraphQL call failed at '/authInfo' io.cloudbeaver.DBWebException: Cannot invoke "com.nimbusds.oauth2.sdk.Scope.toString()" because the return value of "com.nimbusds.oauth2.sdk.token.AccessToken.getScope()" is null at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authUpdateStatus(WebServiceAuthImpl.java:124) at jdk.internal.reflect.GeneratedMethodAccessor17.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.base/java.lang.reflect.Method.invoke(Unknown Source) at io.cloudbeaver.service.WebServiceBindingBase$ServiceInvocationHandler.invoke(WebServiceBindingBase.java:166) at jdk.proxy6/jdk.proxy6.$Proxy12.authUpdateStatus(Unknown Source) at io.cloudbeaver.service.auth.WebServiceBindingAuth.lambda$2(WebServiceBindingAuth.java:53) at graphql.execution.ExecutionStrategy.fetchField(ExecutionStrategy.java:258) at graphql.execution.ExecutionStrategy.resolveFieldWithInfo(ExecutionStrategy.java:197) at graphql.execution.AsyncExecutionStrategy.execute(AsyncExecutionStrategy.java:72) at graphql.execution.Execution.executeOperation(Execution.java:160) at graphql.execution.Execution.execute(Execution.java:101) at graphql.GraphQL.execute(GraphQL.java:591) at graphql.GraphQL.parseValidateAndExecute(GraphQL.java:521) at graphql.GraphQL.executeAsync(GraphQL.java:495) at graphql.GraphQL.execute(GraphQL.java:426) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeQuery(GraphQLEndpoint.java:254) at io.cloudbeaver.server.graphql.GraphQLEndpoint.executeSingleQuery(GraphQLEndpoint.java:200) at io.cloudbeaver.server.graphql.GraphQLEndpoint.doPost(GraphQLEndpoint.java:183) at javax.servlet.http.HttpServlet.service(HttpServlet.java:517) at javax.servlet.http.HttpServlet.service(HttpServlet.java:584) at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:764) at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1665) at org.eclipse.jetty.websocket.servlet.WebSocketUpgradeFilter.doFilter(WebSocketUpgradeFilter.java:170) at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:202) at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1635) at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:527) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1571) at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:221) at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1383) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:176) at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:484) at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1544) at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:174) at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1305) at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:129) at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:122) at org.eclipse.jetty.server.Server.handle(Server.java:563) at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:505) at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:762) at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:497) at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282) at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:314) at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100) at org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:53) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:421) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:390) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:277) at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:139) at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:411) at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:933) at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1077) at java.base/java.lang.Thread.run(Unknown Source) Caused by: io.cloudbeaver.DBWebException: Cannot invoke "com.nimbusds.oauth2.sdk.Scope.toString()" because the return value of "com.nimbusds.oauth2.sdk.token.AccessToken.getScope()" is null at io.cloudbeaver.service.auth.impl.WebServiceAuthImpl.authUpdateStatus(WebServiceAuthImpl.java:117) ... 53 common frames omitted ```