cryptpad / cryptpad/sso

SSO failed to login via keycloak oidc

Open
#11 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
27
Forks
7
PR merge metrics
No merged PRs in 30d

Description

Hi there.

First of all, thanks so much for this wonderful plugin.

We managed to install the SSO plugin and `sso.js` in our testing environment of cryptpad (version-2024.6.1)

Our `sso.js` is as follows.

```
module.exports = {
// Enable SSO login on this instance
enabled: true,
// Block registration for non-SSO users on this instance
enforced: false,
// Allow users to add an additional CryptPad password to their SSO account
cpPassword: false,
// You can also force your SSO users to add a CryptPad password
forceCpPassword: false,
// List of SSO providers
list: [
{
name: "AD account",
type: "oidc",
url: "https:///realms/",
client_id: "cryptpad",
client_secret: "",
jwt_alg: "RS256",
// jwt_alg: 'RS256',
username_scope: 'profile',
username_claim: 'name',
}
]
};
```
We used oidc type provided by our self-hosted `keycloak` server and we saw the `SSO` login button after clicking the login in our testing cryptpad site; however, upon clicking the `SSO` login button, it gets stuck in a loading page and we found the error from the log as below:

```
["ERROR","2024-09-28T11:30:10.124Z","CHALLENGE_RESPONSE_ACTION_ERROR",{"error":{"stack":"Error: secretOrPrivateKey must have a value\n at module.exports [as sign] (/cryptpad/node_modules/jsonwebtoken/sign.js:111:20)\n at SSOUtils.createJWT (/cryptpad/lib/plugins/sso/sso-utils.js:179:9)\n at next (/cryptpad/lib/plugins/sso/challenge.js:87:26)\n at /cryptpad/lib/plugins/sso/challenge.js:104:29\n at /cryptpad/lib/plugins/sso/sso-utils.js:94:9\n at /cryptpad/lib/storage/basic.js:41:9\n at FSReqCallback.readFileAfterClose [as oncomplete] (node:internal/fs/read/context:68:3)","message":"secretOrPrivateKey must have a value"}}]
```

The keycloak setting for this client is basically the same as other no problem clients. For your information, the backend of the OIDC is provided by our self-hosted AD FS server. Upon reading the transaction log of the AD FS, we found that it complained `"P3P": ADFS doesn't have P3P policy, please contact your site's admin for more details`. Not sure what is our problem.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.