apache / apache/answer-plugins

Basic OAuth2 plugin fails to connect to Shibboleth IDP

Abierto
#12 1 comentario 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
Go
Estrellas
131
Forks
75
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

I'm trying to connect an Answer instance to my institution's IDP (Shibboleth), but I consistently get a 50x error in browser accompanied by the following entry in the application log:
```
ERROR /go/src/github.com/answerdev/answer/answer_build422575497/vendor/github.com/answerdev/answer/internal/controller/connector_controller.go:111 connector received failed, error info: code exchange failed: oauth2: cannot fetch token: 400
Response: {"error":"invalid_request","error_description":"InvalidEvent"}, response data is:
```

(The "response data is:" part is left intentionally blank, nothing is printed there)

The IDP log shows the following contemporaneous error:
```
Profile Action ValidateClientAuthenticationType: Client '[redacted]' registered client_secret_basic but attempted client_secret_post
A non-proceed event occurred while processing the request: InvalidEvent
Profile Action BuildTokenErrorResponseFromEvent: No mapped event found for InvalidEvent, creating general invalid_request
Profile Action BuildTokenErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
```

Some searching of the IDP configuration confirms that it advertises `token_endpoint_auth_methods_supported` as `[ "client_secret_basic", "client_secret_post", "client_secret_jwt", ... ]` when communicating with OIDC clients, but according to the upstream [mailing lists](http://shibboleth.net/pipermail/users/2019-May/044292.html), the client is expected to identify which supported `token_endpoint_auth_method` it intends to use. I don't believe that the OAuth2 client does that automatically, and there doesn't seem to be a configuration parameter to specify it manually either.

EDIT for version info:
I'm using Answer v1.1.1 pulled from Docker

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Línea de trabajo

Comienza en internal/controller/connector_controller.go:111 y sigue el intercambio de código OAuth2 utilizado por el plugin Basic OAuth2. Reproduce la conexión con un Shibboleth IDP y compara el método de autenticación del endpoint de tokens del cliente con los logs del IDP. Se considera terminado cuando el plugin se conecta sin el error 50x reportado ni el fallo en el intercambio de tokens.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
go
Área
authentication, backend
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Necesita aclaración
Aptitud para principiantes
30/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.