apache / apache/answer-plugins
Basic OAuth2 plugin fails to connect to Shibboleth IDP
- Lingua principale
- Go
- Stelle
- 131
- Fork
- 75
- Metriche di merge delle PR
- Nessuna PR unita negli ultimi 30g
Descrizione
I'm trying to connect an Answer instance to my institution's IDP (Shibboleth), but I consistently get a 50x error in browser accompanied by the following entry in the application log:
```
ERROR /go/src/github.com/answerdev/answer/answer_build422575497/vendor/github.com/answerdev/answer/internal/controller/connector_controller.go:111 connector received failed, error info: code exchange failed: oauth2: cannot fetch token: 400
Response: {"error":"invalid_request","error_description":"InvalidEvent"}, response data is:
```
(The "response data is:" part is left intentionally blank, nothing is printed there)
The IDP log shows the following contemporaneous error:
```
Profile Action ValidateClientAuthenticationType: Client '[redacted]' registered client_secret_basic but attempted client_secret_post
A non-proceed event occurred while processing the request: InvalidEvent
Profile Action BuildTokenErrorResponseFromEvent: No mapped event found for InvalidEvent, creating general invalid_request
Profile Action BuildTokenErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
```
Some searching of the IDP configuration confirms that it advertises `token_endpoint_auth_methods_supported` as `[ "client_secret_basic", "client_secret_post", "client_secret_jwt", ... ]` when communicating with OIDC clients, but according to the upstream [mailing lists](http://shibboleth.net/pipermail/users/2019-May/044292.html), the client is expected to identify which supported `token_endpoint_auth_method` it intends to use. I don't believe that the OAuth2 client does that automatically, and there doesn't seem to be a configuration parameter to specify it manually either.
EDIT for version info:
I'm using Answer v1.1.1 pulled from Docker
Guida per i contributori
Nessuna guida per i contributori indicizzata per questo repository
Direzione di ricerca
Start at internal/controller/connector_controller.go:111 and trace the OAuth2 code exchange used by the Basic OAuth2 plugin. Reproduce the connection against a Shibboleth IDP and compare the client's token endpoint authentication method with the IDP logs. Done means the plugin connects without the reported 50x error and token exchange failure.
Scritto dal modello di indicizzazione a partire dal testo della issue.
Valutazione
- Stack tecnologico
- go
- Ambito
- authentication, backend
- Tipo di issue
- Bug
- Difficoltà
- 4/5
- Tempo stimato
- 3-5 giorni
- Stato di attività
- Ferma
- Chiarezza
- Da chiarire
- Idoneità per principianti
- 30/100