OIDC broken in v1.0.5

[ltwongaa]

Due to BaseSettings is moved from pydantic to pydantic_settings
oic 1.6.0 has issue on importing it from wrong package
and it is fixed in oic 1.6.1
https://github.com/CZ-NIC/pyoidc/releases/tag/1.6.1
CZ-NIC/pyoidc#862

The latest version Flask-pyoidc 3.14.0 used by GPM is using oic 1.6.0
so GPM has the issue as well
There is a related issue created in Flask-pyoidc with more detail
zamzterz/Flask-pyoidc#163

Apologize that I am not able to copy the error log here due to restriction

[ralgozino]

Hi @ltwongaa

Thanks for reaching out and for the detailed report! I'm sorry you are having issues with GPM.

Due to BaseSettings is moved from pydantic to pydantic_settings
oic 1.6.0 has issue on importing it from wrong package
and it is fixed in oic 1.6.1
https://github.com/CZ-NIC/pyoidc/releases/tag/1.6.1
CZ-NIC/pyoidc#862

This is true when using pydantic v2, but GPM v1.0.5 has pydantic v1.10.9 installed:

gpm@gatekeeper-policy-manager-66bd6c86df-tbwss:/app$ pip freeze | grep pydantic
WARNING: The directory '/home/gpm/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
pydantic==1.10.9

Are you sure you are using GPM v1.0.5 and not latest or some other tag?

We did not have pydantic pinned and there were some builds of latest that failed with that error.

I've just tested v1.0.5 with OIDC and it is working fine in my test cluster, but it is a rather simple configuration in my case, is there anything special in your setup?

Thanks!

[ltwongaa]

Hi @ralgozino ,

it make sense to my case.
I rebuild the image with tag v1.0.5 in my local to remove some pem files that triggers cyber alerts,
so I am using a different version of pydantic compare to the original v1.0.5 image.

Thanks!

[ralgozino]

Oh, I see.. just pin pydantic to 1.x adding it to the constraints.txt file like this:

756019b

And you should be good.

We'll bump the depencies and switch to pydantic v2 when upstream adopts it