{"record":{"id":"d60247b88656918c","repo":"apache/druid","slug":"no-profiles-found-after-oidc-auth","errorCode":null,"errorMessage":"No profiles found after OIDC auth.","messagePattern":"No profiles found after OIDC auth\\.","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java","lineNumber":119,"sourceCode":"    } else {\n      DefaultSecurityLogic securityLogic = new DefaultSecurityLogic();\n      try {\n        securityLogic.perform(\n            context,\n            sessionStore,\n            pac4jConfig,\n            (ctx, session, profiles, parameters) -> {\n              try {\n                // Extract user ID from pac4j profiles and create AuthenticationResult\n                if (profiles != null && !profiles.isEmpty()) {\n                  String uid = profiles.iterator().next().getId();\n                  if (uid != null) {\n                    AuthenticationResult authenticationResult = new AuthenticationResult(uid, authorizerName, name, null);\n                    servletRequest.setAttribute(AuthConfig.DRUID_AUTHENTICATION_RESULT, authenticationResult);\n                    filterChain.doFilter(servletRequest, servletResponse);\n                  }\n                } else {\n                  LOGGER.warn(\"No profiles found after OIDC auth.\");\n                  // Don't continue the filter chain - let pac4j handle the authentication failure\n                }\n              }\n              catch (IOException | ServletException e) {\n                throw new RuntimeException(e);\n              }\n              return null;\n            },\n            JEEHttpActionAdapter.INSTANCE,\n            null,\n            \"none\",  // Use \"none\" instead of authorizerName to avoid CSRF issues\n            null\n        );\n      }\n      catch (HttpAction e) {\n        JEEHttpActionAdapter.INSTANCE.adapt(e, context);\n      }\n    }","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/extensions-core/druid-pac4j/src/main/java/org/apache/druid/security/pac4j/Pac4jFilter.java#L101-L137","documentation":"Pac4jFilter.doFilter() completes OIDC (OpenID Connect) authentication but the resulting user profile list is empty — no profiles were recovered from the OIDC session/token. The filter logs this warning and deliberately does not continue the filter chain, letting pac4j handle the authentication failure (typically a redirect to the identity provider or an error response).","triggerScenarios":"After the OIDC callback, the session/cookie store returns no UserProfile (profileManager.getProfiles() empty) while a uid could not be derived: IdP did not return expected claims, session cookie lost between redirect legs, or pac4j client misconfiguration.","commonSituations":"Session cookie dropped due to HTTPS/hostname mismatch or SameSite issues; IdP scopes not configured to include identifying claims (e.g. missing email/profile scope); clock skew making the ID token invalid; load-balanced Druid nodes without shared session state.","solutions":["Check pac4j/OIDC client configuration: correct client id/secret, discovery URI, and requested scopes (openid, profile, email).","Verify cookies survive the redirect: correct callback URL scheme/host, HTTPS in front, no cookie-stripping proxy or SameSite/Lax misconfig.","Confirm the IdP actually returns the expected claims by inspecting the token (decode the ID token payload).","If running multiple Druid nodes, ensure session/user-profile storage works across nodes (shared cookie/session store configuration)."],"exampleFix":"// before\n// scopes: openid            -> no profile claims, empty UserProfile\n// after\n// scopes: openid profile email -> IdP returns sub/name/email, UserProfile populated","handlingStrategy":"validation","validationCode":"// decode and verify the ID token carries expected claims\nconst payload = JSON.parse(atob(idToken.split('.')[1]));\nif (!payload.sub) throw new Error(\"IdP returned no subject claim\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Request openid/profile/email scopes in the OIDC client config.","Test the full redirect flow over the exact scheme/host users use.","Avoid cookie-stripping proxies; check SameSite settings.","Decode a sample ID token to confirm claim presence."],"tags":["oidc","pac4j","authentication","sso","session"],"backgroundTag":"authentication-required","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}