DependencyTrack / dependency-track

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Home Page:https://dependencytrack.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Cannot delete OpenID Connect users

DrakezulsMinimalism opened this issue · comments

commented

Current Behavior

  1. When browsing "OpenID Connect Users" in the admin interface, deleting a user is not possible, as a 500 status code is returned.
    image
  2. Backend logs report a NPE:

java.lang.NullPointerException: Cannot invoke "alpine.model.OidcUser.getUsername()" because "jsonUser" is null
at org.dependencytrack.resources.v1.UserResource.deleteOidcUser(UserResource.java:580)

Steps to Reproduce

  1. Deployment via docker with
    • OpenIDC Teams Claim = groups, OIDC User Provisioning = true and OIDC Team Synchronization = true
    • Azure Tenant
  2. See current behavior for steps until error is encountered.

Tested with 4.9.1 and 4.10.1.
Also, while upgrading from an older version to a new one (not sure if it was 4.9.x -> 4.10.1 or 4.8.x -> 4.9.x) a non-admin SQL account was used without the ability to manipulate the database schema, therefore the deployment has to be temporarily restarted with an admin account.

Expected Behavior

Deleting and removing any user, permission or team without issues.

Dependency-Track Version

4.10.1

Dependency-Track Distribution

Container Image

Database Server

Microsoft SQL Server

Database Server Version

12.0

Browser

Microsoft Edge

Checklist

commented

I believe it's closely related, so I'm not opening multiple issues: Can also not remove permissions (see screenshot above) of OpenIDC Users AND cannot delete (normal/dependency track) Teams.