{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/dex/issues/543","repository_url":"https://api.github.com/repos/coreos/dex","labels_url":"https://api.github.com/repos/coreos/dex/issues/543/labels{/name}","comments_url":"https://api.github.com/repos/coreos/dex/issues/543/comments","events_url":"https://api.github.com/repos/coreos/dex/issues/543/events","html_url":"https://github.com/coreos/dex/issues/543","id":170497863,"number":543,"title":"DEX with multiple oidc connectors is not working ","user":{"login":"ghost","id":10137,"avatar_url":"https://avatars.githubusercontent.com/u/10137?v=3","gravatar_id":"","url":"https://api.github.com/users/ghost","html_url":"https://github.com/ghost","followers_url":"https://api.github.com/users/ghost/followers","following_url":"https://api.github.com/users/ghost/following{/other_user}","gists_url":"https://api.github.com/users/ghost/gists{/gist_id}","starred_url":"https://api.github.com/users/ghost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghost/subscriptions","organizations_url":"https://api.github.com/users/ghost/orgs","repos_url":"https://api.github.com/users/ghost/repos","events_url":"https://api.github.com/users/ghost/events{/privacy}","received_events_url":"https://api.github.com/users/ghost/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/dex/labels/kind/bug","name":"kind/bug","color":"ff0000"},{"url":"https://api.github.com/repos/coreos/dex/labels/priority/P1","name":"priority/P1","color":"eb6420"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-08-10T19:24:56Z","updated_at":"2016-09-01T19:46:09Z","closed_at":null,"body":"Just started looking into DEX for its ability to federate multiple identity mechanisms. Everything works as documented when I have the google oidc connector configured. As soon as I add another connector for my own OP, nothing works. Here is my connector json, \r\n```\r\n[\r\n    {\r\n        \"type\": \"local\",\r\n        \"id\": \"local\"\r\n    },\r\n    {\r\n        \"type\": \"oidc\",\r\n        \"id\": \"google\",\r\n        \"issuerURL\": \"https://accounts.google.com\",\r\n        \"clientID\": \"redacted\",\r\n        \"clientSecret\": \"redacted\",\r\n        \"trustedEmailProvider\": true\r\n    },\r\n    {\r\n        \"type\": \"oidc\",\r\n        \"id\": \"boxy\",\r\n        \"issuerURL\": \"https://auth.qa03.bluetest.com\",\r\n        \"clientID\": \"redacted\",\r\n        \"clientSecret\": \"redacted\",\r\n        \"trustedEmailProvider\": false\r\n    }\r\n] \r\n```\r\n\r\nWith this configuration when I click on the \"google\" or the \"boxy\" link in the discovery page, I keep getting redirected to the back to the discovery page in an endless loop I see the following in the dex-worker log\r\n\r\n```\r\nubuntu@allinone2:~/dex$ tail -f dex-worker.log \r\n\r\nINFO: Debug logging enabled.\r\n\r\nDEBUG: Debug logging enabled.\r\n\r\n2016/08/10 18:36:50 WARN: Running with no limit on: database idle connections\r\n\r\n2016/08/10 18:36:50 WARN: Running with no limit on: database open connections\r\n\r\n2016/08/10 18:36:50 INFO: Loaded IdP connector: id=local type=local\r\n\r\n2016/08/10 18:36:50 INFO: Loaded IdP connector: id=google type=oidc\r\n\r\n2016/08/10 18:36:50 INFO: Loaded IdP connector: id=boxpanel type=oidc\r\n\r\n2016/08/10 18:36:50 INFO: Binding to 0.0.0.0:5556...\r\n\r\n2016/08/10 18:37:30 INFO: 169.44.130.21 - - [10/Aug/2016:18:37:30 +0000] \"GET /dex/.well-known/openid-configuration HTTP/1.1\" 200 542\r\n\r\n2016/08/10 18:37:30 INFO: 32.97.110.50 - - [10/Aug/2016:18:37:30 +0000] \"GET /dex/auth?response_type=code&scope=openid%20email%20profile&client_id=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q%3D%40allinone2.open-test.ibmcloud.com&state=egZUc3OqzIhtfT7xWIw3NfrcNTo&redirect_uri=https%3A%2F%2Fallinone2.open-test.ibmcloud.com%3A5000%2Fv3%2Fauth%2FOS-FEDERATION%2Fwebsso%2Foidc%2Fredirect&nonce=znob-jLaMbeia-SU30R_SBl5hSyWylgU5TEQ0orJEWY HTTP/2.0\" 200 26848\r\n\r\n2016/08/10 18:37:38 INFO: Session SD0jNE3n-zc= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session hg6ZwVUW8KU= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session F5H0rzFgdEM= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session XnmxKVUM0Z8= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session MyjIlIE05y4= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session fEg4NpN83yA= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session 6cg3yjwMtmA= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session AnEOy8mok7I= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session oPqJTtrzK-Q= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session Te2JV6vK11o= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session k_cd_8um7g4= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:39 INFO: Session _efsgXd6AA4= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:40 INFO: Session SC7SzUThvVc= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:40 INFO: Session wPHmHjxYUj4= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:40 INFO: Session zIBHvVI8rik= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:40 INFO: Session -CjFgPt7t1U= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n\r\n2016/08/10 18:37:40 INFO: Session JDU79Zhm5ns= created: clientID=6DUOHVpT27OY87kFabSe9EgveEgl_c-9ffeZiAYrT9Q=@allinone2.open-test.ibmcloud.com clientState=egZUc3OqzIhtfT7xWIw3NfrcNTo\r\n```\r\n \r\n\r\nOn Firefox I get a generic \"Secure Connection Failed\" error message\r\n\r\nIf I remove the \"boxy\" connector everything works again\r\n```\r\n[\r\n    {\r\n        \"type\": \"local\",\r\n        \"id\": \"local\"\r\n    },\r\n    {\r\n        \"type\": \"oidc\",\r\n        \"id\": \"google\",\r\n        \"issuerURL\": \"https://accounts.google.com\",\r\n        \"clientID\": \"redacted\",\r\n        \"clientSecret\": \"redacted\",\r\n        \"trustedEmailProvider\": true\r\n    }\r\n]\r\n```"},"comment":{"url":"https://api.github.com/repos/coreos/dex/issues/comments/244190576","html_url":"https://github.com/coreos/dex/issues/543#issuecomment-244190576","issue_url":"https://api.github.com/repos/coreos/dex/issues/543","id":244190576,"user":{"login":"lihkin213","id":13207646,"avatar_url":"https://avatars.githubusercontent.com/u/13207646?v=3","gravatar_id":"","url":"https://api.github.com/users/lihkin213","html_url":"https://github.com/lihkin213","followers_url":"https://api.github.com/users/lihkin213/followers","following_url":"https://api.github.com/users/lihkin213/following{/other_user}","gists_url":"https://api.github.com/users/lihkin213/gists{/gist_id}","starred_url":"https://api.github.com/users/lihkin213/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lihkin213/subscriptions","organizations_url":"https://api.github.com/users/lihkin213/orgs","repos_url":"https://api.github.com/users/lihkin213/repos","events_url":"https://api.github.com/users/lihkin213/events{/privacy}","received_events_url":"https://api.github.com/users/lihkin213/received_events","type":"User","site_admin":false},"created_at":"2016-09-01T19:46:09Z","updated_at":"2016-09-01T19:46:09Z","body":"So I was able to validate that this works after I change the issuer url in the connector to ```https://dex-test.auth0.com/``` from ```https://dex-test.auth0.com```\r\nAs far as the error you are seeing, it is a config on the auth0 side that you need to tweak. You need to go to\r\n\r\nAdvanced Settings under your client and click on the OAuth tab and change the ```JsonWebToken Signature Algorithm``` from HS256 that uses the client secret to sign the JWT to RS256.\r\n\r\nPlease close this issue."}}
{"actor":{"display_login":"lihkin213"}}