(Re)Connect to OIDC failed with "uninitialized constant Gitlab::Auth::Oidc::IdentityLinker" after Gitlab - Upgrade
Summary
We use Keycloak for authentication in our self-hosted Gitlab instance (installed by Helm chart). After we have upgraded to Gitlab version 15.11.3-ee a user can not connect the account to Keycloak.
Steps to reproduce
- Login to self-hosted Gitlab instance (using local user)
- Open "User Settings"
- Open "Account"
- Click on "Connect keycloak"
- Login with Keycloak credentials
- Callback-URL throws status code 500
Relevant logs and/or screenshots
{"action":"openid_connect", "component":"gitlab", "controller":"OmniauthCallbacksController", "correlation_id":"01H07RS9C913CPM8CCQX59KNRY", "cpu_s":0.241552, "db_cached_count":0, "db_count":6, "db_duration_s":0.04235, "db_main_cached_count":0, "db_main_count":6, "db_main_duration_s":0.011, "db_main_replica_cached_count":0, "db_main_replica_count":0, "db_main_replica_duration_s":0, "db_main_replica_wal_cached_count":0, "db_main_replica_wal_count":0, "db_main_wal_cached_count":0, "db_main_wal_count":0, "db_primary_cached_count":0, "db_primary_count":6, "db_primary_duration_s":0.011, "db_primary_wal_cached_count":0, "db_primary_wal_count":0, "db_replica_cached_count":0, "db_replica_count":0, "db_replica_duration_s":0, "db_replica_wal_cached_count":0, "db_replica_wal_count":0, "db_write_count":2, "duration_s":0.1656, "exception.backtrace":[…], "exception.class":"NameError", "exception.message":"uninitialized constant Gitlab::Auth::Oidc::IdentityLinker
Did you mean? Gitlab::Identifier", "format":"html", "level":"error", "mem_bytes":7070592, "mem_mallocs":26408, "mem_objects":58913, "mem_total_bytes":9427112, "meta.caller_id":"OmniauthCallbacksController#openid_connect", "meta.client_id":"user/7", "meta.feature_category":"system_access", "meta.remote_ip":"46.167.40.29", "meta.user":"block02", "meta.user_id":7, "method":"GET", "params":[…], "path":"/users/auth/openid_connect/callback", "pid":36, "rate_limiting_gates":[…], "redis_allowed_cross_slot_calls":1, "redis_cache_calls":5, "redis_cache_duration_s":0.004628, "redis_cache_read_bytes":1015, "redis_cache_write_bytes":288, "redis_calls":9, "redis_duration_s":0.005995, "redis_read_bytes":1602, "redis_sessions_allowed_cross_slot_calls":1, "redis_sessions_calls":3, "redis_sessions_duration_s":0.001024, "redis_sessions_read_bytes":587, "redis_sessions_write_bytes":594, "redis_shared_state_calls":1, "redis_shared_state_duration_s":3.43E-4, "redis_shared_state_write_bytes":53, "redis_write_bytes":935, "remote_ip":"46.167.40.29", "request_urgency":"default", "status":500, "subcomponent":"production_json", "target_duration_s":1, "ua":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", "user_id":7, "username":"block02", "view_duration_s":0, "worker_id":"puma_0"}
Results of GitLab environment info
omniauth:
enabled: true
allowSingleSignOn:
- openid_connect
auto_link_user: ["openid_connect"]
blockAutoCreatedUsers: false
providers:
- secret: keycloak-provider
{
name: 'openid_connect',
label: 'keycloak',
args: {
name: 'openid_connect',
scope: [
'openid',
'profile',
'email'
],
response_type: 'code',
issuer: 'https://<keycloak_url>/auth/realms/bgroup',
discovery: true,
client_auth_method: 'query',
uid_field: 'sub',
pkce: true,
send_scope_to_token_endpoint: false,
client_options: {
identifier: 'gitlab',
secret: '******',
redirect_uri: 'https://<keycloak_url>/users/auth/openid_connect/callback'
}
}
}
Expand for output related to GitLab environment info
System information System: Proxy: GITLAB_GITLAB_PAGES_SERVICE_PORT_HTTP_GITLAB_PAGES_PROXY: 8090 GITLAB_GITLAB_PAGES_ING_SERVICE_PORT_HTTP_GITLAB_PAGES_PROXY: 8090 Current User: git Using RVM: no Ruby Version: 3.0.6p216 Gem Version: 3.4.12 Bundler Version:2.4.12 Rake Version: 13.0.6 Redis Version: 6.0.16 Sidekiq Version:6.5.7 Go Version: unknown GitLab information Version: 15.11.3-ee Revision: 9850c263897 Directory: /srv/gitlab DB Adapter: PostgreSQL DB Version: 12.8 URL: https://git.postadress.io HTTP Clone URL: https://git.postadress.io/some-group/some-project.git SSH Clone URL: ssh://git@git.postadress.io:5222/some-group/some-project.git Elasticsearch: yes Geo: no Using LDAP: no Using Omniauth: yes Omniauth Providers: openid_connect GitLab Shell Version: 14.18.0 Repository storages: - default: tcp://gitlab-gitaly-0.gitlab-gitaly.gitlab.svc:8075 GitLab Shell path: /home/git/gitlab-shell
Results of GitLab application Check
Expand for output related to the GitLab application check
Checking GitLab subtasks ...
Checking GitLab Shell ...
GitLab Shell: ... GitLab Shell version >= 14.18.0 ? ... OK (14.18.0) Running /home/git/gitlab-shell/bin/check gitlab-shell self-check failed Try fixing it: Make sure GitLab is running; Check the gitlab-shell configuration file: sudo -u git -H editor /home/git/gitlab-shell/config.yml Please fix the error above and rerun the checks.
Checking GitLab Shell ... Finished
Checking Gitaly ...
Gitaly: ... default ... OK
Checking Gitaly ... Finished
Checking Sidekiq ...
Sidekiq: ... Running? ... no Try fixing it: sudo -u git -H RAILS_ENV=production bin/background_jobs start For more information see: doc/install/installation.md in section "Install Init Script" see log/sidekiq.log for possible errors Please fix the error above and rerun the checks.
Checking Sidekiq ... Finished
Checking Incoming Email ...
Incoming Email: ... Reply by email is disabled in config/gitlab.yml
Checking Incoming Email ... Finished
Checking LDAP ...
LDAP: ... LDAP is disabled in config/gitlab.yml
Checking LDAP ... Finished
Checking GitLab App ...
Database config exists? ... yes All migrations up? ... yes Database contains orphaned GroupMembers? ... no GitLab config exists? ... yes GitLab config up to date? ... yes Cable config exists? ... yes Resque config exists? ... yes Log directory writable? ... yes Tmp directory writable? ... yes Uploads directory exists? ... yes Uploads directory has correct permissions? ... yes Uploads directory tmp has correct permissions? ... skipped (no tmp uploads folder yet) Systemd unit files or init script exist? ... no Try fixing it: Install the Service For more information see: doc/install/installation.md in section "Install the Service" Please fix the error above and rerun the checks. Systemd unit files or init script up-to-date? ... can't check because of previous errors Projects have namespace: ... 2/3 ... yes 2/4 ... yes 2/5 ... yes 2/6 ... yes 2/8 ... yes 2/9 ... yes 2/10 ... yes 2/11 ... yes 13/12 ... yes 13/13 ... yes 13/14 ... yes 2/15 ... yes 3/16 ... yes 2/18 ... yes 2/19 ... yes 15/21 ... yes 15/22 ... yes 15/23 ... yes 15/24 ... yes 15/25 ... yes 15/26 ... yes 15/27 ... yes 15/28 ... yes 15/29 ... yes 15/30 ... yes 2/31 ... yes 13/33 ... yes 1735/34 ... yes 13/35 ... yes 2/36 ... yes 36/37 ... yes 2/38 ... yes 36/39 ... yes 37/40 ... yes 2/43 ... yes 17/44 ... yes 17/45 ... yes 13/46 ... yes 37/48 ... yes 15/49 ... yes 35/53 ... yes 37/54 ... yes 37/55 ... yes 13/58 ... yes 20/68 ... yes 37/72 ... yes 2/73 ... yes 80/74 ... yes 37/75 ... yes 80/76 ... yes 80/78 ... yes 37/79 ... yes 13/80 ... yes 18/81 ... yes 13/82 ... yes 2/83 ... yes 18/84 ... yes 2/85 ... yes 142/86 ... yes 18/90 ... yes 35/91 ... yes 2/92 ... yes 2/93 ... yes 2/94 ... yes 2/95 ... yes 36/96 ... yes 47/98 ... yes 47/99 ... yes 2/103 ... yes 3/104 ... yes 33/106 ... yes 37/107 ... yes 47/108 ... yes 94/110 ... yes 47/112 ... yes 47/115 ... yes 13/116 ... yes 47/117 ... yes 2/118 ... yes 2/119 ... yes 2/120 ... yes 13/122 ... yes 13/124 ... yes 13/127 ... yes 2/128 ... yes 2/129 ... yes 3/130 ... yes 2/131 ... yes 52/132 ... yes 94/133 ... yes 37/134 ... yes 13/135 ... yes 54/136 ... yes 54/137 ... yes 54/138 ... yes 52/139 ... yes 52/141 ... yes 2/142 ... yes 2/143 ... yes 52/144 ... yes 56/145 ... yes 54/146 ... yes 35/147 ... yes 54/148 ... yes 54/149 ... yes 2/150 ... yes 94/151 ... yes 36/152 ... yes 79/153 ... yes 79/154 ... yes 37/155 ... yes 37/156 ... yes 2/157 ... yes 80/158 ... yes 80/160 ... yes 2/161 ... yes 33/164 ... yes 47/165 ... yes 79/166 ... yes 79/167 ... yes 47/169 ... yes 47/171 ... yes 2/174 ... yes 129/175 ... yes 4/176 ... yes 2/177 ... yes 2/178 ... yes 2/179 ... yes 17/180 ... yes 63/183 ... yes 63/184 ... yes 63/185 ... yes 68/186 ... yes 23/187 ... yes 37/189 ... yes 55/190 ... yes 68/191 ... yes 2/192 ... yes 63/193 ... yes 94/194 ... yes 79/195 ... yes 56/196 ... yes 54/197 ... yes 2/200 ... yes 74/204 ... yes 74/205 ... yes 62/206 ... yes 38/207 ... yes 38/208 ... yes 75/209 ... yes 79/211 ... yes 83/212 ... yes 47/213 ... yes 47/214 ... yes 82/215 ... yes 37/216 ... yes 94/217 ... yes 13/218 ... yes 37/221 ... yes 37/222 ... yes 47/223 ... yes 89/225 ... yes 89/226 ... yes 71/227 ... yes 83/229 ... yes 36/230 ... yes 47/233 ... yes 94/235 ... yes 63/237 ... yes 89/238 ... yes 89/239 ... yes 37/240 ... yes 94/241 ... yes 89/242 ... yes 89/243 ... yes 94/245 ... yes 89/246 ... yes 94/247 ... yes 89/249 ... yes 89/250 ... yes 89/251 ... yes 89/252 ... yes 68/254 ... yes 89/255 ... yes 94/257 ... yes 1735/258 ... yes 94/259 ... yes 37/260 ... yes 89/261 ... yes 94/262 ... yes 47/263 ... yes 89/264 ... yes 33/265 ... yes 89/266 ... yes 47/267 ... yes 94/268 ... yes 89/269 ... yes 89/270 ... yes 89/271 ... yes 89/272 ... yes 89/273 ... yes 89/274 ... yes 89/275 ... yes 89/276 ... yes 128/277 ... yes 89/278 ... yes 37/279 ... yes 89/280 ... yes 89/281 ... yes 89/282 ... yes 89/283 ... yes 89/284 ... yes 89/285 ... yes 89/286 ... yes 89/287 ... yes 37/288 ... yes 89/289 ... yes 89/290 ... yes 89/291 ... yes 89/292 ... yes 89/293 ... yes 2/294 ... yes 89/295 ... yes 89/296 ... yes 55/297 ... yes 89/299 ... yes 36/300 ... yes 36/301 ... yes 89/302 ... yes 89/303 ... yes 89/305 ... yes 89/306 ... yes 89/307 ... yes 89/308 ... yes 89/309 ... yes 1662/310 ... yes 89/311 ... yes 89/312 ... yes 89/313 ... yes 119/316 ... yes 89/317 ... yes 119/318 ... yes 119/319 ... yes 2/320 ... yes 89/321 ... yes 89/323 ... yes 1735/325 ... yes 68/326 ... yes 55/327 ... yes 68/328 ... yes 89/329 ... yes 89/330 ... yes 55/331 ... yes 89/365 ... yes 68/366 ... yes 33/367 ... yes 36/368 ... yes 129/369 ... yes 68/371 ... yes 89/372 ... yes 36/373 ... yes 89/374 ... yes 47/375 ... yes 131/376 ... yes 128/377 ... yes 83/379 ... yes 89/380 ... yes 2/381 ... yes 89/382 ... yes 89/383 ... yes 94/384 ... yes 2/385 ... yes 142/386 ... yes 128/387 ... yes 128/388 ... yes 89/389 ... yes 89/390 ... yes 94/391 ... yes 68/392 ... yes 89/393 ... yes 83/394 ... yes 73/395 ... yes 127/396 ... yes 68/397 ... yes 68/399 ... yes 94/400 ... yes 127/401 ... yes 2/402 ... yes 89/404 ... yes 89/405 ... yes 94/406 ... yes 89/407 ... yes 89/408 ... yes 68/411 ... yes 68/412 ... yes 127/413 ... yes 68/415 ... yes 89/417 ... yes 89/419 ... yes 89/421 ... yes 36/422 ... yes 89/423 ... yes 131/425 ... yes 68/426 ... yes 94/427 ... yes 89/429 ... yes 89/430 ... yes 89/431 ... yes 89/432 ... yes 89/434 ... yes 89/435 ... yes 89/436 ... yes 89/437 ... yes 68/438 ... yes 128/439 ... yes 68/440 ... yes 127/442 ... yes 68/443 ... yes 127/444 ... yes 68/445 ... yes 68/446 ... yes 89/447 ... yes 131/448 ... yes 131/451 ... yes 133/452 ... yes 68/453 ... yes 89/454 ... yes 94/455 ... yes 89/456 ... yes 129/457 ... yes 99/459 ... yes 94/460 ... yes 79/461 ... yes 131/462 ... yes 79/463 ... yes 1662/464 ... yes 131/465 ... yes 89/466 ... yes 89/467 ... yes 2/501 ... yes 89/502 ... yes 68/503 ... yes 83/505 ... yes 89/506 ... yes 127/507 ... yes 89/508 ... yes 1735/509 ... yes 1735/510 ... yes 1735/511 ... yes 1735/512 ... yes 127/513 ... yes 68/514 ... yes 89/516 ... yes 127/517 ... yes 68/519 ... yes 13/521 ... yes 68/555 ... yes 127/556 ... yes 68/557 ... yes 89/558 ... yes 36/559 ... yes 128/560 ... yes 68/561 ... yes 1735/563 ... yes 89/564 ... yes 89/565 ... yes 74/566 ... yes 128/567 ... yes 68/568 ... yes 68/571 ... yes 135/572 ... yes 137/573 ... yes 94/574 ... yes 89/575 ... yes 37/576 ... yes 89/577 ... yes 127/578 ... yes 127/579 ... yes 128/580 ... yes 36/581 ... yes 89/582 ... yes 1735/583 ... yes 66/584 ... yes 1735/585 ... yes 1735/586 ... yes 137/587 ... yes 287/588 ... yes 138/590 ... yes 1823/592 ... yes 68/593 ... yes 89/595 ... yes 138/598 ... yes 138/599 ... yes 1823/601 ... yes 89/602 ... yes 141/603 ... yes 89/604 ... yes 89/605 ... yes 68/606 ... yes 140/607 ... yes 140/608 ... yes 140/609 ... yes 140/610 ... yes 140/611 ... yes 140/612 ... yes 89/613 ... yes 68/614 ... yes 89/615 ... yes 141/616 ... yes 141/617 ... yes 141/618 ... yes 141/619 ... yes 141/620 ... yes 2/621 ... yes 131/622 ... yes 47/623 ... yes 89/626 ... yes 1735/627 ... yes 1735/628 ... yes 141/629 ... yes 131/630 ... yes 68/631 ... yes 68/665 ... yes 68/666 ... yes 1735/667 ... yes 94/668 ... yes 68/669 ... yes 55/670 ... yes 68/671 ... yes 1735/672 ... yes 89/674 ... yes 68/676 ... yes 2/677 ... yes 131/710 ... yes 68/711 ... yes 68/712 ... yes 68/719 ... yes 127/720 ... yes 89/721 ... yes 133/722 ... yes 55/723 ... yes 94/724 ... yes 68/725 ... yes 131/726 ... yes 74/728 ... yes 89/729 ... yes 211/731 ... yes 211/732 ... yes 54/733 ... yes 322/734 ... yes 141/735 ... yes 83/736 ... yes 94/738 ... yes 1823/739 ... yes 214/741 ... yes 37/742 ... yes 89/743 ... yes 94/745 ... yes 68/746 ... yes 89/747 ... yes 89/748 ... yes 37/749 ... yes 8/750 ... yes 89/751 ... yes 89/752 ... yes 68/785 ... yes 68/818 ... yes 217/819 ... yes 137/852 ... yes 138/853 ... yes 127/953 ... yes 251/987 ... yes 30/988 ... yes 1735/989 ... yes 1823/990 ... yes 68/991 ... yes 1823/992 ... yes 89/993 ... yes 89/994 ... yes 89/995 ... yes 68/996 ... yes 68/1029 ... yes 89/1062 ... yes 89/1096 ... yes 89/1098 ... yes 89/1100 ... yes 89/1101 ... yes 94/1102 ... yes 89/1135 ... yes 141/1138 ... yes 127/1170 ... yes 287/1204 ... yes 127/1237 ... yes 68/1238 ... yes 89/1239 ... yes 94/1240 ... yes 68/1241 ... yes 33/1242 ... yes 89/1243 ... yes 89/1244 ... yes 89/1245 ... yes 89/1246 ... yes 287/1247 ... yes 89/1248 ... yes 89/1250 ... yes 89/1251 ... yes 1662/1252 ... yes 1735/1253 ... yes 89/1254 ... yes 321/1255 ... yes 89/1256 ... yes 127/1257 ... yes 68/1258 ... yes 322/1259 ... yes 8/1260 ... yes 131/1261 ... yes 322/1262 ... yes 2/1263 ... yes 68/1264 ... yes 74/1266 ... yes 287/1267 ... yes 131/1268 ... yes 322/1270 ... yes 29/1272 ... yes 321/1273 ... yes 321/1274 ... yes 94/1275 ... yes 211/1276 ... yes 322/1277 ... yes 322/1278 ... yes 287/1311 ... yes 127/1312 ... yes 322/1313 ... yes 287/1315 ... yes 89/1316 ... yes 322/1317 ... yes 89/1319 ... yes 89/1322 ... yes 1735/1323 ... yes 89/1324 ... yes 89/1325 ... yes 89/1327 ... yes 89/1360 ... yes 68/1362 ... yes 89/1363 ... yes 89/1364 ... yes 89/1365 ... yes 322/1366 ... yes 68/1367 ... yes 33/1368 ... yes 89/1401 ... yes 68/1402 ... yes 89/1403 ... yes 89/1404 ... yes 89/1405 ... yes 2/1406 ... yes 94/1407 ... yes 94/1408 ... yes 1735/1410 ... yes 89/1443 ... yes 89/1444 ... yes 68/1447 ... yes 1735/1448 ... yes 286/1449 ... yes 89/1450 ... yes 94/1451 ... yes 89/1452 ... yes 287/1453 ... yes 74/1454 ... yes 287/1456 ... yes 89/1457 ... yes 89/1458 ... yes 89/1459 ... yes 131/1493 ... yes 94/1494 ... yes 321/1495 ... yes 321/1496 ... yes 321/1497 ... yes 287/1499 ... yes 94/1500 ... yes 89/1502 ... yes 74/1535 ... yes 68/1536 ... yes 1823/1537 ... yes 68/1538 ... yes 286/1539 ... yes 1735/1540 ... yes 89/1541 ... yes 89/1542 ... yes 94/1544 ... yes 142/1545 ... yes 1191/1546 ... yes 1735/1548 ... yes 89/1550 ... yes 1195/1551 ... yes 94/1553 ... yes 324/1554 ... yes 324/1555 ... yes 324/1556 ... yes 1195/1557 ... yes 1218/1558 ... yes 89/1560 ... yes 321/1562 ... yes 1195/1563 ... yes 286/1564 ... yes 89/1565 ... yes 68/1566 ... yes 89/1567 ... yes 33/1568 ... yes 1195/1569 ... yes 68/1570 ... yes 17/1572 ... yes 94/1573 ... yes 131/1574 ... yes 68/1575 ... yes 286/1576 ... yes 324/1578 ... yes 68/1579 ... yes 68/1582 ... yes 8/1583 ... yes 287/1584 ... yes 116/1618 ... yes 68/1619 ... yes 1735/1620 ... yes 1212/1621 ... yes 68/1622 ... yes 1209/1623 ... yes 1195/1624 ... yes 1195/1625 ... yes 287/1658 ... yes 127/1659 ... yes 1310/1660 ... yes 68/1661 ... yes 79/1662 ... yes 1195/1664 ... yes 1195/1670 ... yes 68/1671 ... yes 68/1672 ... yes 68/1673 ... yes 127/1674 ... yes 1195/1675 ... yes 68/1676 ... yes 68/1677 ... yes 94/1710 ... yes 68/1711 ... yes 68/1712 ... yes 68/1745 ... yes 1310/1746 ... yes 127/1747 ... yes 1735/1748 ... yes 1195/1749 ... yes 287/1750 ... yes 89/1751 ... yes 94/1752 ... yes 324/1753 ... yes 1195/1755 ... yes 1195/1756 ... yes 1195/1757 ... yes 68/1758 ... yes 1735/1759 ... yes 1568/1762 ... yes 68/1763 ... yes 4/1764 ... yes 1195/1765 ... yes 8/1766 ... yes 94/1767 ... yes 1195/1768 ... yes 1195/1769 ... yes 68/1803 ... yes 321/1836 ... yes 37/1869 ... yes 89/1870 ... yes 1735/1903 ... yes 94/1904 ... yes 68/1905 ... yes 321/1906 ... yes 1195/1907 ... yes 1563/1908 ... yes 68/1911 ... yes 1195/1915 ... yes 68/1916 ... yes 1575/1917 ... yes 37/1918 ... yes 1579/1919 ... yes 1563/1920 ... yes 1563/1921 ... yes 1563/1922 ... yes 1563/1923 ... yes 1195/1924 ... yes 1563/1925 ... yes 89/1926 ... yes 1563/1927 ... yes 127/1960 ... yes 127/1961 ... yes 1563/1962 ... yes 1563/1963 ... yes 68/1996 ... yes 89/1997 ... yes 127/1998 ... yes 68/2000 ... yes 1662/2034 ... yes 1697/2035 ... yes 116/2068 ... yes 68/2069 ... yes 89/2070 ... yes 1697/2071 ... yes 1738/2072 ... yes 1697/2073 ... yes 1697/2074 ... yes 1662/2075 ... yes 89/2076 ... yes 1697/2077 ... yes 1697/2078 ... yes 89/2079 ... yes 89/2080 ... yes 89/2081 ... yes 89/2082 ... yes 1697/2115 ... yes 89/2116 ... yes 1697/2117 ... yes 89/2150 ... yes 89/2151 ... yes 89/2152 ... yes 1662/2153 ... yes 89/2154 ... yes 1735/2155 ... yes 89/2156 ... yes Redis version >= 6.0.0? ... yes Ruby version >= 2.7.2 ? ... yes (3.0.6) Git user has default SSH configuration? ... yes Active users: ... 37 Is authorized keys file accessible? ... skipped (authorized keys not enabled) GitLab configured to store new projects in hashed storage? ... yes All projects are in hashed storage? ... yes Elasticsearch version 7.x-8.x or OpenSearch version 1.x ... yes (elasticsearch 8.7.1) All migrations must be finished before doing a major upgrade ... yes
Checking GitLab App ... Finished
Checking GitLab subtasks ... Finished