OIDC access denied: no required group

[Domkra]

Hello everyone,

I have a question about OIDC.
We use Meshcentral with OIDC and use requierd groups. When someone tries to log in who is not part of this group we get the following error message

This message appears if the user does not have access authorization or is not part of one of the required groups.

Is it possible to display that access has been denied and not the error page?

Because our users are automatically redirected to this page if they are not part of a required group.enötigten gruppe sind.

Normal login and logout is possible without problems if the users are part of a required group.

Any ideas or a workaround for this problem?

[si458]

It should redirect anyways back to the login page and use the flash module to display the error so it must be something else that's wrong maybe?
Can u share ur config.json (Hide secrets info) also what oidc provider are u using?

[Domkra]

---

OIDC
We use Keycloak for OIDC

---

ours config
This is what our configuration looks like, of course, we have changed all sensitive data.

{
  "$schema": "https://raw.githubusercontent.com/Ylianst/MeshCentral/master/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are ignored. Edit a section and remove the _ in front of the name. Refer to the user's guide for details.",
  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "server.de",
    "MongoDb": "mongodb://127.0.0.1:27017",
    "MongoDbName": "meshcentral",
    "MongoDBBulkOperations": true,
    "WANonly": true,
    "_LANonly": true,
    "_maintenanceMode": true,
    "port": 443,
    "redirPort": 80,
    "agentpong": 60,
    "browserPong": 60,
    "agentPort": 8433,
    "nice404": true,
    "agentIdleTimeout": 90,
    "webPageLengthRandomization": true,
    "AgentWsCompression": true,
    "WsCompression": true,
    "compression": true,
    "amtScanner": false,
    "allowHighQualityDesktop": false,
    "_tlsOffload": "127.0.0.1,::1",
    "_trustedProxy": "127.0.0.1,::1",
    "AutoBackup": {
      "backupIntervalHours": 24,
      "keepLastDaysBackup": 30,
      "zipPassword": "*********",
      "backupPath": "/opt/meshcentral/meshcentral-backups"
      },

    "_redirects": {
      "meshcommander": "https://www.meshcommander.com/"
    },
    "__maxInvalidLogin": "Time in minutes, max amount of bad logins from a source IP in the time before logins are rejected.",
    "maxInvalidLogin": {
      "time": 10,
      "count": 5,
      "coolofftime": 15
    },
    "__maxInvalid2fa": "Time in minutes, max amount of bad two-factor authentication from a source IP in the time before 2FA's are rejected.",
    "maxInvalid2fa": {
      "time": 10,
      "count": 5,
      "coolofftime": 15
    },

    "__comment3__": "Bereich wo die Logs abgelegt werden",
    "authLog": "/opt/meshcentral/logs/meshcentral-logs/auth.log",
    "meshErrorLogPath": "/opt/meshcentral/logs/meshcentral-logs/",
    "_log": "main,web,webrequest,cert",
    "_debug": "main,web,webrequest,cert",
    "_syslog": "meshcentral",
    "_syslogauth": "meshcentral-auth",
    "_syslogjson": "meshcentral-json",

    "StrictTransportSecurity": true
  },
  "domains": {
    "": {
      "allowedOrigin": [ "meshcentral.server.de", "dns.server.de" ],
      "unknownUserRootRedirect": "https://meshcentral.server.de/auth-oidc",

      "title": "MeshCentral",
      "title2": "Company",
      "footer": "<a href='https://www.server.de/'target='_blank'>Bedienungsanleitung</a>",
      "loginfooter": "Das ist ein privater Server der <a href='https://www.server.de/'>Company</a>",
      "_newAccounts": false,
      "_userNameIsEmail": false,
      "mobileSite": true,
      "_maxDeviceView": 100,
      "nightMode": 2,
      "allowSavingDeviceCredentials": false,
      "guestDeviceSharing": true,
      "DeviceSearchBarServerAndClientName": true,
      "AutoRemoveInactiveDevices": 90,
      "myServer": {
        "Backup": true,
        "Restore": true,
        "Upgrade": true,
        "ErrorLog": true,
        "Console": true,
        "Trace": true
      },
      "geoLocation": false,
      "novnc": false,
      "mstsc": false,
      "ssh": false,
      

      "agentCustomization": {
        "displayName": "Company® Meshcentral™",
        "description": "agent for remote monitoring, management and assistance.",
        "companyName": "Meshcentral l",
        "serviceName": "Meshcentralagent",
        "__comment__": "_fileName setzt namen der .exe file",
        "_fileName": "Meshcentralagent",
        "image": "server.png",
        "_backgroundColor": "#006c72"
      },

      "agentFileInfo": {
        "_icon": "agent.ico",
        "filedescription": "Meshcnentral Background Service Agent",
        "internalname": "sample_internalname",
        "_legalcopyright": "sample_legalcopyright",
        "originalfilename": "sample_originalfilename",
        "productname": "MeshCentral Agent"
      },

      "_agentConfig": [ "webSocketMaskOverride=1", "coreDumpEnabled=1" ],
      "assistantConfig": [ "disableUpdate=0" ],
      "_sessionRecording": {
        "_onlySelectedUsers": true,
        "_onlySelectedUserGroups": true,
        "onlySelectedDeviceGroups": true,
        "filepath": "/opt/meshcentral/records/",
        "index": true,
        "maxRecordings": 10,
        "maxRecordingDays": 20,
        "maxRecordingSizeMegabytes": 30,
        "__protocols__": "Is an array: 1 = Terminal, 2 = Desktop, 5 = Files, 100 = Intel AMT WSMAN, 101 = Intel AMT Redirection, 200 = Messenger",
        "protocols": [ 1, 2, 5, 200 ]
      },

      "ipBlockedUserRedirect": "https://server.de/",
      "_userAllowedIP": "127.0.0.1,192.168.1.0/24",
      "_userBlockedIP": "127.0.0.1,::1,192.168.0.100",
      "_agentAllowedIP": "192.168.0.100/24",
      "_agentBlockedIP": "127.0.0.1,::1",
      "___userSessionIdleTimeout__": "Number of user idle minutes before auto-disconnect",
      "userSessionIdleTimeout": 30,
      "_urlSwitching": false,
      "desktopPrivacyBarText": "Verbunden mit: {0}",
      "_limits": {
        "_maxDevices": 100,
        "_maxUserAccounts": 100,
        "_maxUserSessions": 100,
        "_maxAgentSessions": 100,
        "maxSingleUserSessions": 10
      },

      "consentMessages": {
        "_Title": "MyRemoteAgent",
        "_Desktop": "IT Desk Admin {0} wants access, give it?",
        "_consentTimeout": 60,
        "_autoAcceptOnTimeout": true,
        "_oldStyle": true,
        "autoAcceptIfNoUser": true
      },

      "___passwordRequirements__": "Für den Root zugang",
      "passwordRequirements": {
        "min": 16,
        "max": 128,
        "upper": 1,
        "lower": 1,
        "numeric": 1,
        "nonalpha": 1,
        "reset": 90,
        "_force2factor": true,
        "oldPasswordBan": 3,
        "banCommonPasswords": false,
        "twoFactorTimeout": 300
      },

      "smtp": {
        "host": "smtp.server.de",
        "port": 25,
        "from": "[email protected]",
       
        "tls": false,
        "_tlscertcheck": false,
        "_tlsstrict": true,
        "_emailDelaySeconds": 300,
      
       "__Kommentarbereich__": "Informationen zu den TLS Pararmetern",
       "__tls__": "When 'tls' is set to true, TLS is used immidiatly when connecting. For SMTP servers that use TLSSTART, set this to 'false' and TLS will still be used.",
       "___tlscertcheck__": "When set to false, the TLS certificate of the SMTP server is not checked.",
       "__tlsstrict__": "When set to true, TLS cypher setup is more limited, SSLv2 and SSLv3 are not allowed."
      },

      "authStrategies": {
        "__comment__": "This section is used to allow users to login using other accounts. You will need to get an API key from the services and register callback URL's",
        "oidc": {
          "authorizationURL": "https://iam.server.de/auth/realms/company-admins/protocol/openid-connect/auth",
          "callbackURL": "https://meshcentral.server.de/oidc-callback",
          "clientid": "meshcentral",
          "clientsecret": "********",
          "issuer": "https://iam.server.de/auth/realms/company-admins",
          "tokenURL": "https://iam.server.de/auth/realms/company-admins/protocol/openid-connect/token",
          "userInfoURL": "https://iam.server.de/auth/realms/company-admins/protocol/openid-connect/userinfo",
          "logouturl": "https://iam.server.de/auth/realms/company-admins/protocol/openid-connect/logout",
          "newAccounts": true,
          "newAccountsRights": [
            "nonewgroups",
            "notools",
            "nonewdevices",
            "locksettings"
          ],
          "groups": {
            "required": [
              "/Meshcentral-Admins-App",
              "/Meshcentral-g1-steuern-App",
              "/Meshcentral-g2-steuern-App",
              "/Meshcentral-g3-steuern-ohne-Abfrage-App",
              "/Meshcentral-g4-steuern-App",
              "/Meshcentral-g5-steuern-App",
              "/Meshcentral-g6-steuern-App",
              "/Meshcentral-g7-steuern-App",
              "/Meshcentral-g8-steuern-App"
            ],
            "siteadmin": ["Meshcentral-Admins-App"],
            "sync": {
              "enabled": true,
              "filter": [
                "/Meshcentral-Admins-App",
                "/Meshcentral-g1-steuern-App",
                "/Meshcentral-g2-steuern-App",
                "/Meshcentral-g3-steuern-ohne-Abfrage-App",
                "/Meshcentral-g4-steuern-App",
                "/Meshcentral-g5-steuern-App",
                "/Meshcentral-g6-steuern-App",
                "/Meshcentral-g7-steuern-App",
                "/Meshcentral-g8-steuern-App"
              ]
            }
          }
        }
      }
    }
  }
}

[Domkra]

Hello,
I have found the cause of the behavior.

We are using the "unknownUserRootRedirect" function in our configuration. This directs users to the OIDC login page without showing the standard Meshcentral login page.

for this reason, when users are denied access, they are redirected back to the OIDC page, wich leads to the error message you saw. If we disable this function in the configuration, users are redirected to the standard Meshcentral login page and get a "Permission Denied" massage instead.

My question is: is it possible to adjust the configuration so that administrators can still log in via the normal login page, while all other users are automatically redirected to the OIDC page? In the event of access error, users should not see the technical error message but instead recive the message "Your acces has been denied. For further assistance, please contact your companys´s IT support."