Repository: DefGuard/defguard (language: rust)

Issue:
Cannot use new OpenID apps
**Describe the bug**
Since upgrading to 1.2.0, it is no longer possible to make an openid connection for a new service. 
For existing services, no problem, but the new service connection acceptance form does not appear (infinite loading).  
But no errors appear, either in the backend (server log) or in the frontend (browser log). 

If we modify the database directly to manually add service acceptance for the user (table public.oauth2authorizedapp ), all goes well. 

**To Reproduce**
Steps to reproduce the behavior:
1. Create a new oauth service (or remove authorization from an existing service)
2. Try to connect to this service with defguard

**Version information**
- Defguard Core version: v1.2.1
- Postgres v16



Discussion / hints:

Fix patch:
diff --git a/Cargo.lock b/Cargo.lock
index 4cd06061d..f65d3c8f9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1048,7 +1048,7 @@ dependencies = [
 
 [[package]]
 name = "defguard"
-version = "1.2.1"
+version = "1.2.2"
 dependencies = [
  "anyhow",
  "argon2",
diff --git a/Cargo.toml b/Cargo.toml
index ab341ff6c..e339fca50 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "defguard"
-version = "1.2.1"
+version = "1.2.2"
 edition = "2021"
 license-file = "LICENSE.md"
 homepage = "https://defguard.net/"
@@ -84,7 +84,7 @@ tokio = { version = "1", features = [
 ] }
 tokio-stream = "0.1"
 tokio-util = "0.7"
-tonic = { version = "0.12", features = ["gzip", "tls", "tls-roots"] }
+tonic = { version = "0.12", features = ["gzip", "tls", "tls-native-roots"] }
 tonic-health = "0.12"
 totp-lite = { version = "2.0" }
 tower-http = { version = "0.6", features = ["fs", "trace"] }
diff --git a/src/grpc/mod.rs b/src/grpc/mod.rs
index 8ae3d0529..2ecfc79ce 100644
--- a/src/grpc/mod.rs
+++ b/src/grpc/mod.rs
@@ -455,7 +455,7 @@ pub async fn run_grpc_bidi_stream(
         let tls = ClientTlsConfig::new().ca_certificate(Certificate::from_pem(ca));
         endpoint.tls_config(tls)?
     } else {
-        endpoint
+        endpoint.tls_config(ClientTlsConfig::new().with_enabled_roots())?
     };
 
     loop {
diff --git a/web/src/pages/allow/OpenidAllowPage.tsx b/web/src/pages/allow/OpenidAllowPage.tsx
index 4086a3529..04bdcee7d 100644
--- a/web/src/pages/allow/OpenidAllowPage.tsx
+++ b/web/src/pages/allow/OpenidAllowPage.tsx
@@ -27,7 +27,6 @@ export const OpenidAllowPage = () => {
   const [scope, setScope] = useState<string | null>('');
   const [responseType, setResponseType] = useState<string | null>('');
   const [clientId, setClientId] = useState<string | null>('');
-  const [nonce, setNonce] = useState<string | null>('');
   const [redirectUri, setRedirectUri] = useState<string | null>('');
   const [state, setState] = useState<string | null>('');
   const [name, setName] = useState<string | null>('');
@@ -42,7 +41,8 @@ export const OpenidAllowPage = () => {
   const { LL } = useI18nContext();
 
   const paramsValid = useMemo(() => {
-    const check = [scope, responseType, clientId, nonce, redirectUri, state];
+    // nonce is optional in the auth code flow, just pass it as is further if it's in the params
+    const check = [scope, responseType, clientId, redirectUri, state];
     for (const item of check) {
       if (typeof item === 'undefined' || item === null) {
         toaster.error('OpenID Params invalid.');
@@ -50,7 +50,7 @@ export const OpenidAllowPage = () => {
       }
     }
     return true;
-  }, [clientId, nonce, redirectUri, responseType, scope, state, toaster]);
+  }, [clientId, redirectUri, responseType, scope, state, toaster]);
 
   const handleSubmit = useCallback(
     (allow: boolean) => {
@@ -68,7 +68,6 @@ export const OpenidAllowPage = () => {
     setScope(params.get('scope'));
     setResponseType(params.get('response_type'));
     setClientId(params.get('client_id'));
-    setNonce(params.get('nonce'));
     setState(params.get('state'));
     setRedirectUri(params.get('redirect_uri'));
   }, [params]);


Test patch: