Chronograf 1.11 - with generic Oauth2 config the GENERIC_DOMAINS envar can lead to infinite redirect loops

[karel-rehor]

I'm doing exploratory testing of authorizations in Chronograf based on documentation and other requests.

I've started chronograf with the following environment variables.

GENERIC_TOKEN_URL=http://localhost:8087/oauth/token
GENERIC_CLIENT_ID=whateverid
GENERIC_API_URL=http://localhost:8087/userinfo
GENERIC_DOMAINS=oauth2.mock
GENERIC_CLIENT_SECRET=whateversecret
GENERIC_AUTH_URL=http://localhost:8087/oauth/authorize
GENERIC_NAME=oauth-mock

Steps to reproduce:
List the minimal actions needed to reproduce the behavior.

1. Start logged in as an oauth user with the accepted oauth2.mock domain, e.g. arnost@oauth2.mock
2. Log out using Oauth2
3. Log in again but this time using a different domain e.g. mike@testdomain.mock
4. The login page gets stuck in an unending series of redirects.

Screencast

Screencast.from.2026-04-02.17-28-08.webm

Expected behavior:

After a maximum number of failed redirects, I would expect a message of some sort that the principle is invalid, as in the log message 'invalid principal'. Even an invalid user should not be redirected indefinitely.

Actual behavior:

Redirects in a loop back and forth between browser, oauth server and login page indefinitely.

Environment info:

Note this is on a local build of a PR currently being worked on, but I suspect this behavior applies to production builds.

• Chronograf version: Chronograf 1.11.0 (git: ea3e1c6)
• Other relevant environment details:
  • OS: Ubuntu linux 24.0.4
  • Browser: Opera 129

Config:

GENERIC_TOKEN_URL=http://localhost:8087/oauth/token
GENERIC_CLIENT_ID=whateverid
GENERIC_API_URL=http://localhost:8087/userinfo
GENERIC_DOMAINS=oauth2.mock
GENERIC_CLIENT_SECRET=whateversecret
GENERIC_AUTH_URL=http://localhost:8087/oauth/authorize
GENERIC_NAME=oauth-mock

Logs:

Console logs

ERRO[0084] Not a member of required domain              
ERRO[0084] Unable to get principal identifier Not a member of required domain  component=auth method=GET remote_addr="[::1]:35522" url="/oauth/oauth-mock/callback?code=http%3A%2F%2Flocalhost%3A8888%2Foauth%2Foauth-mock%2Fcallback2026-04-02T15%3A06%3A42.714Z&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzUxNDMwMDIsImlhdCI6MTc3NTE0MjQwMiwibmJmIjoxNzc1MTQyNDAyLCJzdWIiOiJzZmZ5bi10QWwzaUFKcGtRMS0teGhLRE1SZGpvbVo0azZPNUN2VHM5VDNOSXBXeThIMHZXREFHSGo0bGM1LXMxQk85eDhYaWtDX3BoRmZuayJ9.s_Hsancwd5E1kddd_mS1XWvwZqFAumP503UMYYPgHiA"
INFO[0084] Response: Temporary Redirect                  component=server method=GET remote_addr="[::1]:35522" response_time=4.391089ms status=307
...
ERRO[0085] Invalid principal                             component=token_auth method=GET remote_addr="[::1]:53640" url=/chronograf/v1/me
INFO[0085] Response: Forbidden                           component=server method=GET remote_addr="[::1]:53640" response_time="79.95µs" status=403
...
INFO[0085] Response: Temporary Redirect                  component=server method=GET remote_addr="[::1]:53640" response_time=2.194839ms status=307
...
ERRO[0085] Not a member of required domain              
ERRO[0085] Unable to get principal identifier Not a member of required domain  component=auth method=GET remote_addr="[::1]:35522" url="/oauth/oauth-mock/callback?code=http%3A%2F%2Flocalhost%3A8888%2Foauth%2Foauth-mock%2Fcallback2026-04-02T15%3A06%3A43.450Z&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzUxNDMwMDMsImlhdCI6MTc3NTE0MjQwMywibmJmIjoxNzc1MTQyNDAzLCJzdWIiOiJPaUxua2FJRHlfb0x0V2FlTWRrZVlURnFQSTBPNmtiZXc3cmFETF9JVDljM2xNblhsMEx2N0lBSU5PZUxGNURSaFduZFlnRnFkTzZPNVVNaSJ9.EBwqgZvAFbvSsyZohjslwx5KS_eGCPQhz1Dc6oRedTo"
INFO[0085] Response: Temporary Redirect                  component=server method=GET remote_addr="[::1]:35522" response_time=3.608394ms status=307
...
ERRO[0086] Invalid principal                             component=token_auth method=GET remote_addr="[::1]:53640" url=/chronograf/v1/me
INFO[0086] Response: Forbidden                           component=server method=GET remote_addr="[::1]:53640" response_time="108.434µs" status=403
...
ERRO[0086] Invalid principal                             component=token_auth method=GET remote_addr="[::1]:53640" url=/chronograf/v1/env
INFO[0086] Response: Forbidden                           component=server method=GET remote_addr="[::1]:53640" response_time="75.993µs" status=403
...
ERRO[0086] Not a member of required domain              
ERRO[0086] Unable to get principal identifier Not a member of required domain  component=auth method=GET remote_addr="[::1]:53658" url="/oauth/oauth-mock/callback?code=http%3A%2F%2Flocalhost%3A8888%2Foauth%2Foauth-mock%2Fcallback2026-04-02T15%3A06%3A44.186Z&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzUxNDMwMDQsImlhdCI6MTc3NTE0MjQwNCwibmJmIjoxNzc1MTQyNDA0LCJzdWIiOiJ0VGYtMUZiT0xTVnhFN1FfRXFjUnVTYV9yVFA1RnhiNmNCcTZIT3RoLU9LeWs2MGhOYkxOMUV5MTNNZ0JMQTVUeUVXYVR0UklES3pWaFFLcCJ9.2MCIV4pwLwAUgKyxODDXiizgXe5UWQrHuzLRdzWDc34"
INFO[0086] Response: Temporary Redirect                  component=server method=GET remote_addr="[::1]:53658" response_time=3.366837ms status=307
...
ERRO[0087] Invalid principal                             component=token_auth method=GET remote_addr="[::1]:53678" url=/chronograf/v1/me
INFO[0087] Response: Forbidden                           component=server method=GET remote_addr="[::1]:53678" response_time="112.492µs" status=403
...
ERRO[0087] Not a member of required domain              
ERRO[0087] Unable to get principal identifier Not a member of required domain  component=auth method=GET remote_addr="[::1]:35522" url="/oauth/oauth-mock/callback?code=http%3A%2F%2Flocalhost%3A8888%2Foauth%2Foauth-mock%2Fcallback2026-04-02T15%3A06%3A44.999Z&state=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE3NzUxNDMwMDQsImlhdCI6MTc3NTE0MjQwNCwibmJmIjoxNzc1MTQyNDA0LCJzdWIiOiJBUDJpYWVIbVNOdjFyZVVfMGQ1dnVGSmdRMEktZmZxM2g0Q0VCWGRLSjYybG1yTVJSdWdlSS1hSkhYYmJZU2dCZGhMUWtsbG41Uk9JRThteCJ9.zZUwEEVDpSL0Yaiih9h-4mnaSknLaaM_50bmXldp628"
INFO[0087] Response: Temporary Redirect                  component=server method=GET remote_addr="[::1]:35522" response_time=3.93049ms status=307
...