apache / apache/answer-plugins

Basic OAuth2 plugin fails to connect to Shibboleth IDP

Aperta
#12 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
question
Lingua principale
Go
Stelle
131
Fork
75
Metriche di merge delle PR
Nessuna PR unita negli ultimi 30g

Descrizione

I'm trying to connect an Answer instance to my institution's IDP (Shibboleth), but I consistently get a 50x error in browser accompanied by the following entry in the application log:
```
ERROR /go/src/github.com/answerdev/answer/answer_build422575497/vendor/github.com/answerdev/answer/internal/controller/connector_controller.go:111 connector received failed, error info: code exchange failed: oauth2: cannot fetch token: 400
Response: {"error":"invalid_request","error_description":"InvalidEvent"}, response data is:
```

(The "response data is:" part is left intentionally blank, nothing is printed there)

The IDP log shows the following contemporaneous error:
```
Profile Action ValidateClientAuthenticationType: Client '[redacted]' registered client_secret_basic but attempted client_secret_post
A non-proceed event occurred while processing the request: InvalidEvent
Profile Action BuildTokenErrorResponseFromEvent: No mapped event found for InvalidEvent, creating general invalid_request
Profile Action BuildTokenErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
```

Some searching of the IDP configuration confirms that it advertises `token_endpoint_auth_methods_supported` as `[ "client_secret_basic", "client_secret_post", "client_secret_jwt", ... ]` when communicating with OIDC clients, but according to the upstream [mailing lists](http://shibboleth.net/pipermail/users/2019-May/044292.html), the client is expected to identify which supported `token_endpoint_auth_method` it intends to use. I don't believe that the OAuth2 client does that automatically, and there doesn't seem to be a configuration parameter to specify it manually either.

EDIT for version info:
I'm using Answer v1.1.1 pulled from Docker

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Start at internal/controller/connector_controller.go:111 and trace the OAuth2 code exchange used by the Basic OAuth2 plugin. Reproduce the connection against a Shibboleth IDP and compare the client's token endpoint authentication method with the IDP logs. Done means the plugin connects without the reported 50x error and token exchange failure.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
go
Ambito
authentication, backend
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
30/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.