Frequent (dex?) `invalid_client` error

[x6j8x]

Hi there!

After the switch to 4.0 we experience a lot of problem logging into Concourse using Github auth.

In > 80% of all cases we end up with

{"error":"invalid_client","error_description":"Invalid client credentials."}

after being re-redirected to .../sky/callback?code=...

Our configuration at least seems to be ok - we've configured:

github_auth.client_id & github_auth.secret
main_team.auth.github.teams (on team in org:team notation)

We've configured .../sky/issuer/callback as redirect url in Github.

• Concourse version: 4.0.0
• Deployment type (BOSH/Docker/binary): BOSH
• Infrastructure/IaaS: AWS
• Browser (if applicable): Safari

[cirocosta]

Hey @x6j8x ,

it seems to me that your issue might be related to #2425?

Maybe you're running multiple ATCs without session affinity in AWS like reported in the #2425 issue?

thx!

[x6j8x]

@cirocosta Yeah, we're running 2 ATCs behind an ELB (v1). I'll look into #2425

[Typositoire]

I do run into this with an ELB (v1) and 3 ATC. Had to scale back to 1.

We're using OIDC, so it's not only github, probably more a global issue with Dex.

[vito]

Folding this into #2425 (already in flight) as it's likely the same root cause. Thanks!