Auth0 not working

[mforell]

Hi ,
Hey everyone,

I'm running a self-hosted instance of Langfuse in Docker, and I'm having trouble integrating Auth0. I followed the setup instructions, but when I try to authenticate, I get this error in my logs:

Unknown argument `refresh_expires_in`. Available options are marked with ?. PrismaClientValidationError:

langfuse-server-1  | Invalid `prisma.account.create()` invocation:
langfuse-server-1  | Unknown argument `refresh_expires_in`. Available options are marked with ?.
langfuse-server-1  |     at Tn (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:115:6855)
langfuse-server-1  |     at In.handleRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6510)
langfuse-server-1  |     at In.handleAndLogRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6188)
langfuse-server-1  |     at In.request (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:5896)
langfuse-server-1  |     at async l (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:127:11167) {
langfuse-server-1  |   name: 'LinkAccountError',
langfuse-server-1  |   code: undefined
langfuse-server-1  | }

Has anyone else encountered this issue? Any tips on how to resolve it would be greatly appreciated!

Thanks!

[marcklingen]

Does a user with the same email already exist in the db?

[marcklingen]

that's interesting. There are a couple of teams who I know that run on Auth0, can you grant additional permissions in Auth0 to try if this solves the problem?

[mforell]

I am not sure how to grant more permossions with docker-compose for Auth0

[marcklingen]

on the Auth0 side, are there any configuration options?

I am just guessing what could be the issue here, as I verified that Auth0 works when initially adding support for it and as I know some teams who use Auth0 SSO with Langfuse. If you find the solution to this issue, I'd love to add it to our FAQs: https://langfuse.com/faq

[mforell]

ah ok. Thank you very much. I'll have a look

yes, of course :)

[marcklingen]

thank you!

[damianradowiecki]

A similar issue here, when trying to use Keycloak as SSO:

Unknown argument `refresh_expires_in`. Available options are marked with ?.
2024-06-26T13:32:17.489408698Z     at Tn (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:115:6855)
2024-06-26T13:32:17.489448031Z     at In.handleRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6510)
2024-06-26T13:32:17.489464233Z     at In.handleAndLogRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6188)
2024-06-26T13:32:17.489500137Z     at In.request (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:5896)
2024-06-26T13:32:17.489553866Z     at async l (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:127:11167) {
2024-06-26T13:32:17.489565105Z   name: 'LinkAccountError',
2024-06-26T13:32:17.489589556Z   code: undefined
2024-06-26T13:32:17.489657037Z }

[damianradowiecki]

@damianradowiecki Can you solve this issue ? I facing same issue with you. I set Keycloak as SSO

Hey @RTae, not in the near future. If I find more time I will open a PR

[RTae]

@damianradowiecki Thank you. That's perfect. Currently, I'm working on it. I think we could share a PR

[RTae]

@damianradowiecki @bbartels @marcklingen Could you help me review this PR. I just made an update to support Keycloak.

#2866

[marcklingen]

thanks, added comments. also there is this additional PR: #2846

[marcklingen]

Native Keycloak support was released today: https://langfuse.com/changelog/2024-12-03-new-sso-providers-github-enterprise-and-keycloak

[maithilee25]

Hi,
I am facing a similar issue with a self-hosted instance of Langfuse with SSO integration with OAuth2 identity server.

Unknown argument `jti`. Did you mean `id`? Available options are marked with ?.
    at Tn (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:115:6855)
    at In.handleRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6510)
    at In.handleAndLogRequestError (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:6188)
    at In.request (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:122:5896)
    at async l (/app/node_modules/.pnpm/@[email protected][email protected]/node_modules/@prisma/client/runtime/library.js:127:11167) {
  name: 'LinkAccountError',
  code: undefined

[RTae]

Similarly, this is quite similar to the KeyCloak case. You need to find a way to not return JTI data from your authentication provider.

[maithilee25]

It won't be possible to update the response by the IdP.
Probably need to implement something like this to remove the additional fields.

Is there any plan for a generic solution since it looks like integration with other IdPs too are facing this issue?

[RTae]

Yeah, currently I'm working on Keycloak. I removed unnecessary variable from the payload before save data into a database ( #2866 ). I think if you would like to contribute, Langfuse will support your current system IdP, you can open a PR.

[marcklingen]

Thanks again for your contribution (and sorry for moving slow on the review, accidentally muted the email thread)!

Released today: https://langfuse.com/changelog/2024-12-03-new-sso-providers-github-enterprise-and-keycloak