DevOps/www
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dex error

Browse Source
This commit is contained in:
eric
2026-10-29 12:09:31 -04:00
parent e4be5bfdf4
commit 7ec64194e5
3 changed files with 68 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+26
View File
@@ -210,6 +210,32 @@ but membership no longer checks directory recreation during login. Preserve the
connector mapping for other services; migrating Dex to immutable user IDs is a
separate coordinated change, not an automatic part of this release.
### Database ProgrammingError during callback
`Dex callback rejected kind=ProgrammingError` in older images is a database
error, not a password rejection. Updated images log a redacted `sqlstate`:
`42703` means an undefined column, `42P01` an undefined table, and `42501`
insufficient privileges. Raw SQL/exception messages are deliberately omitted
because they may contain identity data.
For `42703` after the Dex-only release, check that `members.0004_dex_login_identity`
is applied to the **same database/schema used by web and worker**. Using the
release image and its production environment, inspect `showmigrations members`
and `migrate --plan`, then run `migrate --noinput` through the deployment's
migration service/Job. These are Django management commands. Do not use
`makemigrations` or `--fake` as a production repair, or delete database volumes.
Keep the original `DEX_ISSUER` while applying this migration.
On Kubernetes, publish a new immutable membership image tag/digest and rerun the
role so it completes a new migration Job before deploying web/worker. Reusing an
image tag can leave both an old cached migration image (`IfNotPresent`) and an
already-completed Job: a rollout restart alone does not rerun migrations. Use
`www_rollout_revision` to request a fresh Job when appropriate, but prefer a new
immutable image reference. If the migration is marked applied yet columns are
missing, investigate the database/schema and migration history before any manual
DDL. For other SQLSTATEs, investigate the indicated permissions/schema problem
rather than assuming an unapplied migration.
### LDAP service credentials still required for directory writes
LDAP is still needed for registration and worker group synchronization. Configure