apache / apache/answer-plugins

Basic OAuth2 plugin fails to connect to Shibboleth IDP

未关闭
#12 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
question
主要语言
Go
星标
131
派生
75
PR 合并指标
30 天内没有已合并 PR

描述

I'm trying to connect an Answer instance to my institution's IDP (Shibboleth), but I consistently get a 50x error in browser accompanied by the following entry in the application log:
```
ERROR /go/src/github.com/answerdev/answer/answer_build422575497/vendor/github.com/answerdev/answer/internal/controller/connector_controller.go:111 connector received failed, error info: code exchange failed: oauth2: cannot fetch token: 400
Response: {"error":"invalid_request","error_description":"InvalidEvent"}, response data is:
```

(The "response data is:" part is left intentionally blank, nothing is printed there)

The IDP log shows the following contemporaneous error:
```
Profile Action ValidateClientAuthenticationType: Client '[redacted]' registered client_secret_basic but attempted client_secret_post
A non-proceed event occurred while processing the request: InvalidEvent
Profile Action BuildTokenErrorResponseFromEvent: No mapped event found for InvalidEvent, creating general invalid_request
Profile Action BuildTokenErrorResponseFromEvent: ErrorResponse successfully set as the outbound message
```

Some searching of the IDP configuration confirms that it advertises `token_endpoint_auth_methods_supported` as `[ "client_secret_basic", "client_secret_post", "client_secret_jwt", ... ]` when communicating with OIDC clients, but according to the upstream [mailing lists](http://shibboleth.net/pipermail/users/2019-May/044292.html), the client is expected to identify which supported `token_endpoint_auth_method` it intends to use. I don't believe that the OAuth2 client does that automatically, and there doesn't seem to be a configuration parameter to specify it manually either.

EDIT for version info:
I'm using Answer v1.1.1 pulled from Docker

贡献指南

这个仓库没有索引到贡献指南

调研方向

从 internal/controller/connector_controller.go:111 开始,跟踪 Basic OAuth2 插件使用的 OAuth2 代码交换流程。复现与 Shibboleth IDP 的连接,并将客户端的 token endpoint 身份验证方法与 IDP 日志进行比较。当插件能够连接且不再出现报告的 50x 错误和 token 交换失败时,即表示完成。

由索引模型根据 Issue 内容生成。

评估

技术栈
go
领域
authentication, backend
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
停滞
描述清晰度
需要澄清
新手友好度
30/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。