OpenID - "Oops - an error has occurred"
Asked by Daniel:

I'm trying to setup OID with Amazon Cognito. I setup everything as needed but when I open Confluence and login with the SSO details, I get the following error:

```
Cause

java.lang.NullPointerException
????at com.atlassian.plugins.authentication.impl.web.oidc.OidcConsumerServlet.doGet(OidcConsumerServlet.java:114)
```

Googling around I found some similar errors but their solutions didn't apply to my case, at least not as far as I know.

Any help would be appreciated :)


Answers:
author: Danny Rehelis
body: Hey [@Thiago Masutti](/t5/user/viewprofilepage/user-id/1209618)

Just wanted to drop-in and update we've managed to overcome this,
> What if you create the same user in the Confluence internal directory, disable JIT provisioning and try the authentication?

This definitely worked.

JIT user provisioning failed for us due to the fact the the local user Cognito pool we were testing with, users were not part of any group. Once a group was created and populated with users, JIT provisioning worked and we've managed to log-in!

Thanks a bunch for the help!

comments: author: Kourtney Barnes
body: Hey [@Danny Rehelis](/t5/user/viewprofilepage/user-id/4369383) , I'm having this exact same issue. For the group field what value are you putting there.

I'm getting

```
We can't log you in right now

Please contact your administrator.

Technical details
```

Could you tell me what values you are putting for the JIT fields? Below is what I have setup.

```
Display Name :: ${given_name} ${family_name}

Email :: ${email}

Groups :: cognito:groups

JIT Scopes :: profile email
```


author: Danny Rehelis
body: Hey [@Kourtney Barnes](/t5/user/viewprofilepage/user-id/4431072) , on our setup, \`JIT scopes\` is left empty.

I'd suggest enabling stack trace information in the error pages to understand what is behind that \`Technical details\` error.

<https://confluence.atlassian.com/enterprise/saml-single-sign-on-for-atlassian-data-center-applications-857050705.html#SAMLsinglesign-onforAtlassianDataCenterapplications-authenticationscreen>

(at the very bottom)


author: Thiago Masutti
body: Hi [@Daniel](/t5/user/viewprofilepage/user-id/4368238)   
Welcome to the Atlassian Community.

If you check the application logs you may have an error related to this issue, together with a stack trace.

Could you please paste that here?

Kind regards,  
Thiago Masutti

comments: author: Daniel
body: Thanks [@Thiago Masutti](/t5/user/viewprofilepage/user-id/1209618)

[Stack Trace:\[hide\]java.lang.NullPointerException at com.atlassian.plugins.au - Pastebin.com](https://pastebin.com/QeZ1Jbrj)


author: Thiago Masutti
body: Can you paste a screenshot of the OIDC configuration in Confluence?  
You may redact some information if needed.


author: Daniel
body: Sure thing [@Thiago Masutti](/t5/user/viewprofilepage/user-id/1209618)

![SBXgR9L](https://community.atlassian.com/t5/image/serverpage/image-id/140667i3518C370F05EB3C2/image-size/large?v=v2&px=999 "SBXgR9L")


author: Thiago Masutti
body: Thanks [@Daniel](/t5/user/viewprofilepage/user-id/4368238)

On **Username mapping** you need to use *${sub}* instead of just *sub* .  
See if that works.

Have you manually added any information on the **Additional settings** section?  
Have you faced any error when using the automatic configuration?

If so, check if you have access to to your Amazon Cognito tenant from the Confluence server.  
Maybe running the following command will help with ensuring network connection is possible from the server.

```
telnet <your-tenant>.amazoncognito.com 443
```

Let us know the results.

Kind regards,  
Thiago Masutti


author: Daniel
body: I tried ${sub} before I used sub, that didn't change anything .

I manually added the information in **additional settings** because it couldn't recognize those automatically. I opened a [thread](https://community.atlassian.com/t5/Confluence-questions/Error-quot-We-couldn-t-fetch-the-data-from-your-identity/qaq-p/1675591) about it earlier actually but thought it might be resolved thanks to editing everything manually.

443 port seems to be open:

```
[ec2-user@confluence ~]$ nc -zv URL.auth.eu-west-1.amazoncognito.com 443
Ncat: Version 7.50 ( https://nmap.org/ncat )
Ncat: Connected to IP:443.
Ncat: 0 bytes sent, 0 bytes received in 0.02 seconds.
```


author: Thiago Masutti
body: Just added a comment on the other thread and it should fix this problem as well


author: Daniel
body: [@Thiago Masutti](/t5/user/viewprofilepage/user-id/1209618) Thank you! Now it can fetch the info automatically, but I'm facing a new issue when I'm logging in.

I created a local user in my Cognito pool and when I login, I get the following error:

```
We can't log you in right now

Please contact your administrator.

Technical details
```

And here's a long list of errors: [com.atlassian.plugins.authentication.impl.web.usercontext.impl.jit.JitException - Pastebin.com](https://pastebin.com/KDyXs7EB)


author: Thiago Masutti
body: That's great, [@Daniel](/t5/user/viewprofilepage/user-id/4368238)

That issue is related to the JIT user provisioning feature.

What if you create the same user in the Confluence internal directory, disable JIT provisioning and try the authentication?

Note that you are using OIDC sub as the username mapping, so that should be the username in Confluence as well.

With this we will at least guarantee the authentication flow is working fine and then focus on JIT.

Kind regards,  
Thiago Masutti


Tags: cognito

confluence-server

openid

server

sso