Frequent Cookies Clear Required to Navigate

[echoAwoo]

Authenticating through OIDC/Entra and requiring frequent cookie clears and reauthing to navigate the UI. Service UI just hangs entirely until otherwise.

❯ lxc --version
5.21.4 LTS

Installed via snap

[edlerd]

Thanks, can you give a bit more details what "Service UI just hangs entirely" means? Maybe post a screenshot of the problem.

[echoAwoo]

When already authenticated, after about a minute, attempts to navigate to other links in the UI just hang. They spin and do nothing. The request goes out, nothing comes back, and it takes an obnoxiously long time to timeout, longer than no server response at all.

Client network traffic is similarly not helpful, you see the request leave, cookies present, Host network traffic shows the request come in, an ack goes out (probably why it just spins in client), but nothing happens.

While it spins, I can clear cookies, it triggers the client-side login redirect (twice), and then I can sign into the service through OIDC again just fine, until it times out. Similarly, I can private browse to the UI while the primary window is spinning and it authenticates and responds just fine. Until the session dies.

[edlerd]

Thanks for the details.

From your symptom description it sounds to me like the identity token refresh in the API is broken. @markylaing or @tomponline do you have an idea why the auth session with entra suddenly could fail after some time passed since successful login?

The slowness of UI spinning seems like a second bug. The UI does try to rerun requests on failure. We do have logic in place for when the failure is authentication related to immediately log out the user and redirect to login. Seems like not all possibilities are covered correctly here and you run into API request retries (with backoff time) causing a very long visible spinners.

[echoAwoo]

Some additional details I've pulled out:

Issue affects local docs browser identically only after authing, however, if you clear the cookies, and then browse the docs first before attempting to reauth, it fails and throws an error that it can't contact the oidc provider when you attempt to reauth. I've only found rebooting the host entirely as the only solution here.

[markylaing]

I've gained access to an EntraID tenant to check the status of OIDC auth with LXD and I can't recreate this behaviour. One thing that is possible is that your entra ID tenant is configured to only issue ID tokens with a short expiry. After expiry, LXD will try to refresh the ID token and this could be failing and blocking the requests. (Note that I'm not able to troubleshoot this scenario because I don't have sufficient permission to change these settings for our organisations Entra ID tenant.)

In order to investigate further we will need:

1. Exact set up steps of the application in entra ID.
2. Info about your entra ID tenant. Including any settings about token expiration.
3. The OIDC configuration of LXD.
4. Screenshots of errors and any meaningful logs.