latest v4 tag breaks OIDC

[mahngiel]

Describe the bug

The latest version of the action breaks OIDC. backporting to @v4.5.6 restores function

Current behavior

Run jfrog/setup-jfrog-cli@v4
Setup JFrog CLI
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  
  16:55:45 [Info] Trace ID for JFrog Platform logs: dc5ae0592ca87c28
  Error: 5 [Error] failed to exchange OIDC token: server response: 400 Bad Request
  {
    "errors": [
      {
        "code": "BAD_REQUEST",
        "message": "Invalid audience"
      }
    ]
  }
  
  Error: JFrog CLI exited with exit code 1

Reproduction steps

use this

  - uses: jfrog/setup-jfrog-cli@v4
      id: jfrog
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: <providerName>

Expected behavior

No response

Setup JFrog CLI version

v4

JFrog CLI version

2.74.1

Workflow operating system type and version

ubuntu-latest

JFrog Artifactory version (if relevant)

cloud

JFrog Xray version (if relevant)

No response

[mahngiel]

after additional version testing, v4.5.8 also functions as expected

    - uses: jfrog/setup-jfrog-cli@v4.5.6
      id: jfrog456
      if: always()
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: github

    - uses: jfrog/setup-jfrog-cli@v4.5.7
      id: jfrog457
      if: always()
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: github

    - uses: jfrog/setup-jfrog-cli@v4.5.8
      id: jfrog458
      if: always()
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: github

    - uses: jfrog/setup-jfrog-cli@v4.5.9
      id: jfrog459
      if: always()
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: github

    - uses: jfrog/setup-jfrog-cli@v4.5.10
      id: jfrog4510
      if: always()
      env:
          JF_URL: https://<myOrg>.jfrog.io
          JF_PROJECT: <myProject>
      with:
          oidc-provider-name: github

2s
Run jfrog/setup-jfrog-cli@v4.5.6
  
Setup JFrog CLI
  Obtaining an access token through OpenID Connect...
  Config file is empty or not found.
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.73.0/jfrog-cli-linux-amd64/jfrog
  /opt/hostedtoolcache/jf/2.73.0/x64/jf config add setup-jfrog-cli-server --url https://myproject.jfrog.io/ --interactive=false --overwrite=true --access-token ***
  18:24:36 [Warn] You are using JFrog CLI version 2.73.0, however version 2.75.0 is available.
  To install the latest version, visit: https://jfrog.com/getcli
  To see the release notes, visit: https://github.com/jfrog/jfrog-cli/releases
  To avoid this message, set the JFROG_CLI_AVOID_NEW_VERSION_WARNING variable to TRUE
  
1s
Run jfrog/setup-jfrog-cli@v4.5.7
  
Setup JFrog CLI
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  /opt/hostedtoolcache/jf/2.75.0/x64/jf config add setup-jfrog-cli-server --url https://myproject.jfrog.io/ --interactive=false --overwrite=true --oidc-provider-name=github --oidc-provider-type=Github --oidc-token-id=*** --oidc-audience=jfrog-github
  18:24:38 [Info] Trace ID for JFrog Platform logs: 5abe5e2520cf4610
  Error: 8 [Error] failed to exchange OIDC token: server response: 400 Bad Request
  {
    "errors": [
      {
        "code": "BAD_REQUEST",
        "message": "Invalid audience"
      }
    ]
  }
  Error: JFrog CLI exited with exit code: 1
  
1s
Run jfrog/setup-jfrog-cli@v4.5.8
Setup JFrog CLI
  Config file is empty or not found.
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.74.1/jfrog-cli-linux-amd64/jfrog
  /opt/hostedtoolcache/jf/2.74.1/x64/jf config add setup-jfrog-cli-server --url https://myproject.jfrog.io/ --interactive=false --overwrite=true --access-token ***
  
1s
Run jfrog/setup-jfrog-cli@v4.5.9
Setup JFrog CLI
  Found JFrog CLI in cache. No need to download
  18:24:40 [Info] Trace ID for JFrog Platform logs: edc739f66a4af12e
  Error: 0 [Error] failed to exchange OIDC token: server response: 400 Bad Request
  {
    "errors": [
      {
        "code": "BAD_REQUEST",
        "message": "Invalid audience"
      }
    ]
  }
  Error: JFrog CLI exited with exit code 1
  
0s
Run jfrog/setup-jfrog-cli@v4.5.10
Setup JFrog CLI
  Found JFrog CLI in cache. No need to download
  18:24:40 [Info] Trace ID for JFrog Platform logs: 0e06a71aa5f7262f
  Error: 0 [Error] failed to exchange OIDC token: server response: 400 Bad Request
  {
    "errors": [
      {
        "code": "BAD_REQUEST",
        "message": "Invalid audience"
      }
    ]
  }
  Error: JFrog CLI exited with exit code 1

[EyalDelarea]

Hey @mahngiel,

Thank you for reporting this issue.
Could you please share the following information in order to allow us better debugging:

1. Debug logs for the latest version: v4.5.10
2. Which Artifactory version are you using?

Also, when the audience input is not explicitly provided, it defaults to the OIDC provider's default audience.
Did you set a specific audience value when configuring the OIDC integration on the JFrog Platform?

[mahngiel]

@EyalDelarea we are using JFrog cloud/platform and the OIDC integration audience is set to our GH Organization: "https://github.com/$Org". here are the debug logs:

##[debug]Evaluating condition for step: 'Run jfrog/setup-jfrog-cli@v4.5.10'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Run jfrog/setup-jfrog-cli@v4.5.10
##[debug]Register post job cleanup for action: jfrog/setup-jfrog-cli@v4.5.10
##[debug]Loading inputs
##[debug]Loading env
Run jfrog/setup-jfrog-cli@v4.5.10
  
::group::Setup JFrog CLI
Setup JFrog CLI
  ##[debug]isExplicit: 2.75.0
  ##[debug]explicit? true
  ##[debug]checking cache: /opt/hostedtoolcache/jf/2.75.0/x64
  ##[debug]not found
  ##[debug]isExplicit: 2.75.0
  ##[debug]explicit? true
  ##[debug]checking cache: /opt/hostedtoolcache/jfrog/2.75.0/x64
  ##[debug]not found
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  ##[debug]Downloading https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  ##[debug]Destination /home/runner/work/_temp/2523719e-5480-46a2-8b1a-6c17b06ce61e
  ##[debug]download complete
  ##[debug]Caching tool jf 2.75.0 x64
  ##[debug]source file: /home/runner/work/_temp/2523719e-5480-46a2-8b1a-6c17b06ce61e
  ##[debug]destination /opt/hostedtoolcache/jf/2.75.0/x64
  ##[debug]destination file /opt/hostedtoolcache/jf/2.75.0/x64/jf
  ##[debug]finished caching tool
  ##[debug]Caching tool jfrog 2.75.0 x64
  ##[debug]source file: /home/runner/work/_temp/2523719e-5480-46a2-8b1a-6c17b06ce61e
  ##[debug]destination /opt/hostedtoolcache/jfrog/2.75.0/x64
  ##[debug]destination file /opt/hostedtoolcache/jfrog/2.75.0/x64/jfrog
  ##[debug]finished caching tool
  ##[debug]Attempting to fetch JSON Web Token (JWT) ID token...
  ##[debug]ID token url is https://pipelinesghubeus15.actions.githubusercontent.com/<snip>/00000000-0000-0000-0000-000000000000/_apis/distributedtask/hubs/Actions/plans/0606b120-2470-4cfc-8e23-ba0309aa5418/jobs/ca395085-040a-526b-2ce8-bdc85f692774/idtoken?api-version=2.0&audience=jfrog-github
  ::add-mask::***
  ##[debug]Using CLI exchange-oidc-token..
  12:02:57 [Info] Trace ID for JFrog Platform logs: 2ce273d8202dae2b
  Error: 7 [Error] failed to exchange OIDC token: server response: 400 Bad Request
  {
    "errors": [
      {
        "code": "BAD_REQUEST",
        "message": "Invalid audience"
      }
    ]
  }
  Error: JFrog CLI exited with exit code 1
  ::endgroup::
##[debug]Node Action run completed with exit code 1
##[debug]JFROG_CLI_ENV_EXCLUDE='*password*;*secret*;*key*;*token*;*auth*;JF_ARTIFACTORY_*;JF_ENV_*;JF_URL;JF_USER;JF_PASSWORD;JF_ACCESS_TOKEN'
##[debug]JFROG_CLI_OFFER_CONFIG='false'
##[debug]JFROG_CLI_SOURCECODE_REPOSITORY='$Org/guardrails-organization-tooling'
##[debug]JFROG_CLI_CI_JOB_ID='Publish to JFrog and ECR'
##[debug]JFROG_CLI_CI_RUN_ID='14730716676'
##[debug]JFROG_CLI_BUILD_NAME='Publish to JFrog and ECR'
##[debug]JFROG_CLI_BUILD_NUMBER='20'
##[debug]JFROG_CLI_BUILD_URL='https://github.com/$Org/guardrails-organization-tooling/actions/runs/14730716676'
##[debug]JFROG_CLI_USER_AGENT='setup-jfrog-cli-github-action/4.5.10'
##[debug]JFROG_CLI_BUILD_PROJECT='guardrails'
##[debug]JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR='/home/runner/work/_temp'
##[debug]JFROG_CLI_USAGE_GH_TOKEN_FOR_CODE_SCANNING_ALERTS_PROVIDED=''
##[debug]Finishing: Run jfrog/setup-jfrog-cli@v4.5.10

If i remove the integration audience, then I get the following debug output from the action:

##[debug]Evaluating condition for step: 'Run jfrog/setup-jfrog-cli@v4.5.10'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> true
##[debug]Result: true
##[debug]Starting: Run jfrog/setup-jfrog-cli@v4.5.10
##[debug]Register post job cleanup for action: jfrog/setup-jfrog-cli@v4.5.10
##[debug]Loading inputs
##[debug]Loading env
Run jfrog/setup-jfrog-cli@v4.5.10
  
::group::Setup JFrog CLI
Setup JFrog CLI
  ##[debug]isExplicit: 2.75.0
  ##[debug]explicit? true
  ##[debug]checking cache: /opt/hostedtoolcache/jf/2.75.0/x64
  ##[debug]not found
  ##[debug]isExplicit: 2.75.0
  ##[debug]explicit? true
  ##[debug]checking cache: /opt/hostedtoolcache/jfrog/2.75.0/x64
  ##[debug]not found
  Downloading JFrog CLI from https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  ##[debug]Downloading https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.75.0/jfrog-cli-linux-amd64/jfrog
  ##[debug]Destination /home/runner/work/_temp/c924af8b-e13b-44b6-a85e-3964af26acc3
  ##[debug]download complete
  ##[debug]Caching tool jf 2.75.0 x64
  ##[debug]source file: /home/runner/work/_temp/c924af8b-e13b-44b6-a85e-3964af26acc3
  ##[debug]destination /opt/hostedtoolcache/jf/2.75.0/x64
  ##[debug]destination file /opt/hostedtoolcache/jf/2.75.0/x64/jf
  ##[debug]finished caching tool
  ##[debug]Caching tool jfrog 2.75.0 x64
  ##[debug]source file: /home/runner/work/_temp/c924af8b-e13b-44b6-a85e-3964af26acc3
  ##[debug]destination /opt/hostedtoolcache/jfrog/2.75.0/x64
  ##[debug]destination file /opt/hostedtoolcache/jfrog/2.75.0/x64/jfrog
  ##[debug]finished caching tool
  ##[debug]Attempting to fetch JSON Web Token (JWT) ID token...
  ##[debug]ID token url is https://pipelinesghubeus15.actions.githubusercontent.com/<snip>/00000000-0000-0000-0000-000000000000/_apis/distributedtask/hubs/Actions/plans/48b01eed-8ef6-4284-94a5-b0f858cfac2a/jobs/ca395085-040a-526b-2ce8-bdc85f692774/idtoken?api-version=2.0&audience=jfrog-github
  ::add-mask::***
  ##[debug]Using CLI exchange-oidc-token..
  ##[debug]Failed to parse JSON from CLI output. Falling back to regex...
  ::add-mask::***
  ::add-mask::***
  /opt/hostedtoolcache/jf/2.75.0/x64/jf config add setup-jfrog-cli-server --url https://$org.jfrog.io/ --interactive=false --overwrite=true --access-token ***
  ::endgroup::
##[debug]Node Action run completed with exit code 0
##[debug]JFROG_CLI_ENV_EXCLUDE='*password*;*secret*;*key*;*token*;*auth*;JF_ARTIFACTORY_*;JF_ENV_*;JF_URL;JF_USER;JF_PASSWORD;JF_ACCESS_TOKEN'
##[debug]JFROG_CLI_OFFER_CONFIG='false'
##[debug]JFROG_CLI_SOURCECODE_REPOSITORY='$org/guardrails-organization-tooling'
##[debug]JFROG_CLI_CI_JOB_ID='Publish to JFrog and ECR'
##[debug]JFROG_CLI_CI_RUN_ID='14730716676'
##[debug]JFROG_CLI_BUILD_NAME='Publish to JFrog and ECR'
##[debug]JFROG_CLI_BUILD_NUMBER='20'
##[debug]JFROG_CLI_BUILD_URL='https://github.com/$org/guardrails-organization-tooling/actions/runs/14730716676'
##[debug]JFROG_CLI_USER_AGENT='setup-jfrog-cli-github-action/4.5.10'
##[debug]JFROG_CLI_BUILD_PROJECT='guardrails'
##[debug]JFROG_CLI_COMMAND_SUMMARY_OUTPUT_DIR='/home/runner/work/_temp'
##[debug]JFROG_CLI_USAGE_GH_TOKEN_FOR_CODE_SCANNING_ALERTS_PROVIDED=''
##[debug]SETUP_JFROG_CLI_SERVER_IDS='setup-jfrog-cli-server'
##[debug]Set output oidc-token = ***
##[debug]Set output oidc-user = ***
##[debug]Finishing: Run jfrog/setup-jfrog-cli@v4.5.10

[EyalDelarea]

Hey @mahngiel,

Thank you for the debug logs

It looks like the second example you provided is working — is that correct?

Also, have you tried providing the audience value in the action to match the audience defined in your integration?
For example:

- uses: jfrog/setup-jfrog-cli@v4
  env:
    JF_URL: https://<myOrg>.jfrog.io
    JF_PROJECT: <myProject>
  with:
    oidc-provider-name: github
    oidc-audience: my-audience

[mahngiel]

removing the audience from the integration does remove the hard failure, but i don't think that's an appropriate direction to go @EyalDelarea ? i understand that the default value is the same as i'm applying to the integration, but i'd be curious why the sudden change in functionality. also note this error in the second run:

##[debug]Failed to parse JSON from CLI output. Falling back to regex...

[tgharold]

Also, when the audience input is not explicitly provided, it defaults to the OIDC provider's default audience.

That feels like a breaking change. The default used to be the URL to the GitHub organization, e.g. "https://github.com/your-organization-url". Right?

That's how we've configured our OIDC Integration for GitHub for the Audience property.

ETA: I went back and looked at our notes, I have a note from Feb 2024 that the oidc-audience property defaults to the GitHub organization URL.

[tgharold]

I think the following diff is what caused the breakage.

v4.5.6...v4.5.7

Possibly this line: const audience: string = core.getInput(Utils.OIDC_AUDIENCE_ARG); or jsonWebToken = await core.getIDToken(audience);

I think that if you call core.getIDToken() with no value, you get back the default audience. That is how it worked before 4.5.7, unless you passed in something for the OIDC_AUDIENCE_ARG ('oidc-audience') parameter to the GitHub Action you got back the default audience (the URL of the repository owner).

https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/about-security-hardening-with-openid-connect

That means private static DEFAULT_OIDC_AUDIENCE: string = 'jfrog-github'; should be changed to default to null (or empty string?) if the user doesn't specify it when calling the GitHub action.

[EyalDelarea]

Thanks to everyone who participated in this thread — @mahngiel, @tim-goto, @MichaelOultram-pexip 🙏

We’ve just released version v4.5.11 of the setup-jfrog-cli action, which includes a fix for this issue.
We’ve also added test coverage to help ensure this won’t happen again going forward.

Please give it a try and let us know if everything works as expected!

[tim-goto]

we will look into an update start of next week, thanks for letting us know. will update my comment with how it goes

EDIT: I did update right now and everything still works, thanks for your support

[MichaelOultram-pexip]

@EyalDelarea we might have got some wires crossed here. I wasn't involved with this issue (mine was jfrog/jfrog-cli#2960)