[Bug]: Login using OpenID not working for some scenarios in v0.7.3

[cshenrik]

What happened?

I'm currently running v0.7.0, and I am trying to upgrade to v0.7.3.

I have configured authentication as follows:

ALLOW_EMAIL_LOGIN=false
ALLOW_REGISTRATION=false
ALLOW_SOCIAL_LOGIN=true
ALLOW_SOCIAL_REGISTRATION=true

The various OPENID_* environment variables have also been set. Notably, I've set OPENID_SCOPE=openid profile email.

I have configured it like this so users are only able to login via my OpenID provider.

This works fine in v0.7.0, but after I upgraded to v0.7.3 I get a server error when I try to log in.

Do I need to change some configuration for this to work on v0.7.3?

Thanks for your hard work maintaining this project!

Steps to Reproduce

1. Configuration authention like this:

ALLOW_EMAIL_LOGIN=false
ALLOW_REGISTRATION=false
ALLOW_SOCIAL_LOGIN=true
ALLOW_SOCIAL_REGISTRATION=true

Add OpenID configuration
2. Login to LibreChat using OpenID connect.

What browsers are you seeing the problem on?

Firefox

Relevant log output

[openidStrategy] verify login openidId: <REDACTED>
[openidStrategy] user not found with openidId: <REDACTED>
[openidStrategy] user not found with email: <REDACTED> for openidId: <REDACTED>
[openidStrategy] login failed User validation failed: email: can't be blank
ValidationError: User validation failed: email: can't be blank
at Document.invalidate (/app/node_modules/mongoose/lib/document.js:3200:32)
at /app/node_modules/mongoose/lib/document.js:2993:17
at /app/node_modules/mongoose/lib/schematype.js:1368:9
at process.processTicksAndRejections (node:internal/process/task_queues:77:11)

Screenshots

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[danny-avila]

Can you check the Users collection in the database? The emails can't be blank as the errors suggest, it's curious that it was allowed before, unless the emails are there?

[cshenrik]

I checked the Users collection in both my production environment that runs v0.7.0, and my newly created test environment that runs v0.7.3. Both have the email field set correctly. Here's from my test environment:

{
    "_id": ObjectId("<REDACTED>"),
    "name": "<REDACTED>",
    "username": "henrik",
    "email": "<REDACTED>",
    "emailVerified": false,
    "provider": "openid",
    "role": "USER",
    "openidId": "<REDACTED>",
    "plugins": [],
    "refreshToken": [],
    "avatar": "",
    "createdAt": ISODate("2024-06-16T19:46:52.108Z"),
    "updatedAt": ISODate("2024-06-16T19:46:52.108Z"),
    "__v": 0
}

[cshenrik]

Wait a moment... I downgraded to v0.7.0 in my test environment and tested that login works there. The object in the users collection probably came from that. I suspect that it is not created if I use v0.7.3. I'll verify and get back to you.

[cshenrik]

I deleted all document in the users collection, and tried logging in again. It failed in the described way, and a new document for my user was not created.

Before I deleted the document, I tried to log in on v0.7.3. It still didn't work, but the behavior was different. Instead of showing "Internal Server Error" to the user, it showed the login page again. The logs contain:

[openidStrategy] verify login openidId: <REDACTED>
[openidStrategy] user found with openidId: <REDACTED>
[openidStrategy] login success openidId: <REDACTED> | email: <REDACTED> | username: <REDACTED>
[Social Login not allowed] [Email: <REDACTED>]
Error in setting authentication tokens: Cannot set headers after they are sent to the client
[setAuthTokens] Error in setting authentication tokens: Cannot set headers after they are sent to the client

[danny-avila]

Interesting, do you have allowedDomains configured?

https://www.librechat.ai/docs/configuration/librechat_yaml/object_structure/registration#alloweddomains

If not, do your "email" values have "@" symbols?

This may be closer to the issue, that isDomainAllowed is causing this behavior in either case

[cshenrik]

allowedDomains is configured. The full contents of librechat.yaml is:

# For more information, see the Configuration Guide:
# https://docs.librechat.ai/install/configuration/custom_config.html

version: 1.0.3

cache: true

registration:
  allowedDomains:
    - "<REDACTED>.com"

[awickham10]

I ran into this same thing. It appears to impact new users for us. I did not have allowedDomains set, but setting it did not appear to change the behavior.

[awickham10]

I think I've found the bug. This line, the user data isn't passed as a parameter to the createUser function, so it's trying to create a user document with no data.

LibreChat/api/strategies/openidStrategy.js

Line 167 in dad25bd

const userId = await createUser();

[danny-avila]

I think I've found the bug. This line, the user data isn't passed as a parameter to the createUser function, so it's trying to create a user document with no data.

LibreChat/api/strategies/openidStrategy.js

Line 167 in dad25bd

const userId = await createUser();

thanks for noticing, I will patch that and push up a new release candidate

[danny-avila]

Resolved now, thanks! Sorry for the inconvenience, I pushed a new release candidate but the docker images may still be building

[danny-avila]

@cshenrik I am able to reproduce the email validation error before v0.7.4-rc1 with a new user OpenID login.

After pulling the latest image, I can't reproduce it with new user login. I don't have ALLOW_UNVERIFIED_EMAIL_LOGIN set.

On the latest update, I can reproduce the issue if I manually delete the email field from a user document, but deleting the document or setting an email manually resolves it.

[cshenrik]

Ah, I see that my deployment failed, so I tested on the old version after all. 0.7.4-rc1 is probably fine.

[cshenrik]

Yeah, I can confirm that 0.7.4-rc1 fixes the login issue. Thank you!

[skyking363]

docker images may still be building

Is the docker image complete?

[fuegovic]

Is the docker image complete?

yes, v0.7.4-rc1 is available

[a1010s]

Is this problem fixed?
I am still getting this same error.
I deployed librechat on kubernetes and set following Vars regarding OPENID and login:

ALLOW_EMAIL_LOGIN: "false"
ALLOW_REGISTRATION: "false"
ALLOW_SOCIAL_LOGIN: "true"
ALLOW_SOCIAL_REGISTRATION: "false"
ALLOW_PASSWORD_RESET: "false"
ALLOW_UNVERIFIED_EMAIL_LOGIN: "true"
SESSION_EXPIRY: "900000"
REFRESH_TOKEN_EXPIRY: "604800000"
JWT_SECRET: ...
JWT_REFRESH_SECRET: ...
OPENID_CLIENT_ID: ...
OPENID_CLIENT_SECRET: ...
OPENID_ISSUER: https://login.microsoftonline.com/.../v2.0/
OPENID_SESSION_SECRET: ...
OPENID_SCOPE: "openid profile email"
OPENID_CALLBACK_URL: /oauth/openid/callback
OPENID_BUTTON_LABEL: "Login with SSO"

I also exposed the app via ingress.
I reach my domain, and click on openid connect (SSO), then I get redirected to Azure where i can input my mail address (also note that when i use another email that is not in the tenant i get the coresponding error..so this is working) and when loging in, i get internal server error 500.

The logs are looking similar:

Warning: connect.session() MemoryStore is not                                                                                                                                                                                              │
│ designed for a production environment, as it will leak                                                                                                                                                                                     │
│ memory, and will not scale past a single process.                                                                                                                                                                                          │
│ 2024-09-19 12:02:13 info: Server listening on all interfaces at port 3080. Use http://localhost:3080 to access it                                                                                                                          │
│ 2024-09-19 12:03:03 info: [openidStrategy] verify login openidId: N9yDq-FJ...ASU                                                                                                                              │
│ 2024-09-19 12:03:03 info: [openidStrategy] user not found with openidId: N9yD...jASU                                                                                                                       │
│ 2024-09-19 12:03:03 info: [openidStrategy] user not found with email: undefined for openidId: N9...jASU                                                                                                  │
│ 2024-09-19 12:03:03 error: [openidStrategy] login failed User validation failed: email: can't be blank                                                                                                                                     │
│ ValidationError: User validation failed: email: can't be blank                                                                                                                                                                             │
│     at Document.invalidate (/app/node_modules/mongoose/lib/document.js:3200:32)                                                                                                                                                            │
│     at /app/node_modules/mongoose/lib/document.js:2993:17                                                                                                                                                                                  │
│     at /app/node_modules/mongoose/lib/schematype.js:1368:9                                                                                                                                                                                 │
│     at process.processTicksAndRejections (node:internal/process/task_queues:77:11)

Also need to mention that using localhost instead of exposing the app thru ingress gives the same result.
When using docker-compose to start the app and working on localhost, everything works fine, I can login with SSO via my Azure Entra ID (with the registered app).

I belive that I am missing something im my kubernetes configuration.
NOTE: The allowedDomains option is present, didn't changed the problem.

I configured all the ENV VARS via a Kubernetes Secret.
The librechat.yaml is deployed as ConfigMap and mounted accordingly.

Any help will be apreciated. Thanks!

[attiyafathalla]

Did you happen to fix this issue, I am facing it now, and would like to ask you for help if you fixed it.

[brianverb]

Same issue here, with similar settings on localhost and hosted on azure

[danny-avila]

Upgrade to the latest build

[brianverb]

Currently using the latest build, will check with our system admin to see if there is something wrong at our azure side

[brianverb]

For us it was the simple issue of the e-mail field not being set on our azure test environment!