apache / apache/answer-plugins
Basic OAuth2 plugin fails to connect to Shibboleth IDP
- Lenguaje dominante
- Go
- Estrellas
- 131
- Forks
- 75
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Descripción
I'm trying to connect an Answer instance to my institution's IDP (Shibboleth), but I consistently get a 50x error in browser accompanied by the following entry in the application log:
```
ERROR /go/src/github.com/answerdev/answer/answer_build422575497/vendor/github.com/answerdev/answer/internal/controller/connector_controller.go:111 connector received failed, error info: code exchange failed: oauth2: cannot fetch token: 400
Response: {"error":"invalid_request","error_description":"InvalidEvent"}, response data is:
```
(The "response data is:" part is left intentionally blank, nothing is printed there)
The IDP log shows the following contemporaneous error:
```
Profile Action ValidateClientAuthenticationType: Client '[redacted]' registered client_secret_basic but attempted client_secret_post
A non-proceed event occurred while processing the request: InvalidEvent
Profile Action BuildTokenErrorResponseFromEvent: No mapped event found for InvalidEvent, creating general invalid_request
Profile Action BuildTokenErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
```
Some searching of the IDP configuration confirms that it advertises `token_endpoint_auth_methods_supported` as `[ "client_secret_basic", "client_secret_post", "client_secret_jwt", ... ]` when communicating with OIDC clients, but according to the upstream [mailing lists](http://shibboleth.net/pipermail/users/2019-May/044292.html), the client is expected to identify which supported `token_endpoint_auth_method` it intends to use. I don't believe that the OAuth2 client does that automatically, and there doesn't seem to be a configuration parameter to specify it manually either.
EDIT for version info:
I'm using Answer v1.1.1 pulled from Docker
Guía de contribución
No hay ninguna guía de contribución indexada para este repositorio
Línea de trabajo
Comienza en internal/controller/connector_controller.go:111 y sigue el intercambio de código OAuth2 utilizado por el plugin Basic OAuth2. Reproduce la conexión con un Shibboleth IDP y compara el método de autenticación del endpoint de tokens del cliente con los logs del IDP. Se considera terminado cuando el plugin se conecta sin el error 50x reportado ni el fallo en el intercambio de tokens.
Escrito por el modelo de indexación a partir del texto del issue.
Evaluación
- Stack tecnológico
- go
- Área
- authentication, backend
- Tipo de issue
- Error
- Dificultad
- 4/5
- Tiempo estimado
- 3-5 días
- Estado de actividad
- Estancado
- Claridad
- Necesita aclaración
- Aptitud para principiantes
- 30/100