OIDC Not working after update - Getting 502 Bad Gateway

[crsnchng]

Update: Discovered that OIDC seems to work locally but not externally.
Update 2: Not working fully internally - getting "Error constructing OIDC authentication strategy" after logging in via Azure OIDC. Google Auth works fine all around.

Was working before 1.0.150/1.0.149. Did not change anything about the OIDC configuration or the Platform URL.

The URL throwing the Bad Gateway is: [app address]/api/global/auth/default/oidc/configs/[auth config id]

[crsnchng]

After a few days of troubleshooting, I finally decided to check the Nginx logs (duh). Turns out, Nginx was throwing an error: "Nginx upstream sent too big header while reading response header from upstream"

Added the following to the top of my Nginx reverse proxy config:

proxy_busy_buffers_size 512k; proxy_buffers 4 512k; proxy_buffer_size 256k;

OIDC is now working again.

[p10tyr]

Are you kidding me! I have been banging my head with all sorts. I did check ngxinx access logs but didnt check the error logs. I also was going through cloudflare so it just wen 502 while my app didnt do much.

Thank you soooo much! I owe you !

[erlendfg]

Thanks, this saved my day as well! We had exactly the same issue!

[south-indian-programmer]

Wonderful worked like a charm
Thanks

[tomcatcw1980]

wonderfull. this helped.

[thomasbergernz]

I'm seeing the same issue. Which file do I need to edit "Nginx reverse proxy config"?

[thomasbergernz]

I did end up editing the ConfigMap budibase-ingress-nginx-controller data: section:

apiVersion: v1
data:
  allow-snippet-annotations: 'true'
  proxy-buffer-size: 256k
  proxy-buffers: 4 512k
  proxy-busy-buffers-size: 512k
kind: ConfigMap
metadata:

And this did the trick and OIDC (Keycloak) auth is working fine.
I'm on K8s with Helm deployment...

[AiCaptain]

Hi Thomas,

we have the same problem and also using the K8s helm chart.
I wonder, where you edited the configmap? I can't find the config map "budibase-ingress-nginx-controller" you mentioned and the name suggests to me that the configmap is for the IngressController and not the ReverseProxy.

Thx for your help!

Regards
André

[thomasbergernz]

André
kubectl describe configmap/budibase-ingress-nginx-controller -n budibase assuming you did use the default namespace 'budibase' to view it and kubectl edit configmap/budibase-ingress-nginx-controller -n budibase to edit the configmap.

Cheers,
Thomas

[AiCaptain]

Thomas, thank you for your hint!
After some debugging and configuration tangle I got a solution for our environment. We do not use the nginx ingress controller, so the configmap is not available in our cluster. Instead we use a kong ingress controller and the parameters needs to be passed via environment parameters. I added them to the values.yaml of the kong helm chart:

env:
  NGINX_PROXY_PROXY_BUFFER_SIZE: 160k
  NGINX_PROXY_PROXY_BUFFERS: 64 160k  

For everyone else with a similar problem: See also Kong/kong#3974 (comment)

Regards,
André

[mschaefer-gresham]

Thank you for this! You saved me hours/days!

[bushrod]

Not familiar with budibase, but this discussion was a top hit from Google search on microsoft oidc 502, so I thought I would leave a comment that the suggestion also fixed this issue that started happening in my Quarkus Java project following a dependency/version update. In our AKS build pipeline, the settings are made in Jenkinsfile like this:

nginxAnnotations = [
'ingress.kubernetes.io/proxy-buffer-size': '32k',
'ingress.kubernetes.io/proxy-buffers-number': '4'
]
Also see: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/nginx-configuration/annotations.md