RocketChat / RocketChat/Rocket.Chat

Invalid Room name in OAuth Group Channel Map prevents logon

Open
#19,882 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

If there is an invalid room name in the list of rooms to match to a group within the "OAuth Group Channel Map" JSON it prevents ALL OAuth logins from being processed regardless of if the bad room applies to the user or not.

Steps to reproduce:
  1. Configure and confirm a valid OAuth setup
  2. Enable "Map Roles/Groups to channels"
  3. In the JSON, add the following entry:
    "JunkGroup": "All-TAM group conversation"
Expected behavior:

OAuth authenticated users can still log on, possibly with the error seen still displaying if they where directly assigned to that group.

Actual behavior:

image

Server Setup Information:
  • Version of Rocket.Chat Server: 3.9.0
  • Operating System: Ubuntu 20.04
  • Deployment Method: Docker
  • Number of Running Instances: 1
  • DB Replicaset Oplog: Enabled
  • NodeJS Version:
  • MongoDB Version:
Client Setup Information
  • Desktop App or Browser Version: Desktop App 3.0.7, Chrome 87.0.4280.88
  • Operating System: Windows 10
Additional context

The error here is valid, but I do not believe that it should be fatal to the login process, especially if the room mapping does not apply to the user logging in.

Relevant logs:
Exception while invoking method login Error: All-TAM group conversation is not a valid room name. [error-invalid-room-name]
     at getValidRoomName (app/utils/lib/getValidRoomName.js:37:9)
     at createRoom (app/lib/server/functions/createRoom.js:53:9)
     at mapSSOGroupsToChannels (app/custom-oauth/server/oauth_helpers.js:60:14)
     at AccountsServer.<anonymous> (app/custom-oauth/server/custom_oauth_server.js:347:6)
     at AccountsServer.Accounts.updateOrCreateUserFromExternalService (app/custom-oauth/server/custom_oauth_server.js:441:8)
     at AccountsServer.Accounts.updateOrCreateUserFromExternalService (server/configuration/accounts_meld.js:51:52)
     at MethodInvocation.<anonymous> (packages/accounts-oauth/oauth_server.js:55:21)
     at packages/accounts-base/accounts_server.js:475:31
     at tryLoginMethod (packages/accounts-base/accounts_server.js:1309:14)
     at AccountsServer._runLoginHandlers (packages/accounts-base/accounts_server.js:473:22)
     at AccountsServer.Accounts._runLoginHandlers (app/lib/server/lib/loginErrorMessageOverride.js:7:35)
     at MethodInvocation.methods.login (packages/accounts-base/accounts_server.js:533:31)
     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)
     at packages/ddp-server/livedata_server.js:1689:15
     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
     at packages/ddp-server/livedata_server.js:1687:36
     at new Promise (<anonymous>)
     at Server.applyAsync (packages/ddp-server/livedata_server.js:1686:12)
     at Server.apply (packages/ddp-server/livedata_server.js:1625:26)
     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
     at Object.post (app/api/server/v1/misc.js:262:26)
     at app/api/server/api.js:394:82
     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
     at packages/nimble_restivus/lib/route.coffee:59:33
     at packages/simple_json-routes.js:98:9
	 => awaited here:
     at Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)
     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
     at Object.post (app/api/server/v1/misc.js:262:26)
     at app/api/server/api.js:394:82
     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
     at packages/nimble_restivus/lib/route.coffee:59:33
     at packages/simple_json-routes.js:98:9 

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at app/custom-oauth/server/oauth_helpers.js, following the login path from custom-oauth/server/custom_oauth_server.js and the getValidRoomName call in app/utils/lib/getValidRoomName.js. Reproduce the invalid room mapping during OAuth login and verify that an unrelated invalid room no longer prevents authentication, while the directly affected mapping still reports its error.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.