Invalid token when to many groups #169

bbung · 2025-05-15T08:38:24Z

Hi,

we are using OIDC with AzureAD and this works fine until we have more then 8 Groups in a user. I do get the following error message:

otc-auth login idp-oidc --overwrite-token
E0515 10:31:12.245137   81673 functions.go:58] fatal: status 400 , body:
{"error":{"code":400,"message":"Request parameter 'id token' is invalid.","title":"Bad Request"}}

As soon as i put my user in only 8 groups this error does no longer occur. The second thing that i observed: It also works when i explicitly logout from Azure AD.

I have no idea how to debug that. So any help would be appreciated.

Due to the general OIDC Group Limit in OTC we use roles from AD and map them to groups in OTC

Mapping rule:

[
          {
                    "remote": [
                              {
                                        "type": "email"
                              },
                              {
                                        "type": "roles"
                              }
                    ],
                    "local": [
                              {
                                        "user": {
                                                  "name": "{0}"
                                        }
                              },
                              {
                                        "groups": "{1}"
                              }
                    ]
          }
]```

We are requesting the following scopes: "profile,openid,email".

If you can point me in any direction on how to debug that issue. I can try get more information or find the issue myself. Currently i am a bit lost.

Thanks and regards,
Björn

The text was updated successfully, but these errors were encountered:

Ninja243 · 2025-05-16T11:13:30Z

Hi! This sounds like an issue we've had previously which occurs when the length of the token is too long. We'll look into it!

bbung · 2025-05-16T12:23:45Z

Can the issue be caused by the mapping rule when we have a very long username?

To see our groups we had the groups added to the username: like:

[
          {
                    "remote": [
                              {
                                        "type": "email"
                              },
                              {
                                        "type": "roles"
                              }
                    ],
                    "local": [
                              {
                                        "user": {
                                                  "name": "{0} {1}"
                                        }
                              },
                              {
                                        "groups": "{1}"
                              }
                    ]
          }
]```

Ninja243 · 2025-05-16T18:59:14Z

Yeah that might be! As far as I know the issue is with the total length of the token, so if the username is part of that and is long, that might be a contributing factor.

Ninja243 self-assigned this May 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Invalid token when to many groups #169

Invalid token when to many groups #169

Invalid token when to many groups #169

Invalid token when to many groups #169

Comments