influxdata / influxdata/chronograf

OAuth with self signed certificate not working

Open
#6,014 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
1.6k
Forks
250
Avg merge
1d 3h
Merged PRs (30d)
9

Description

Using the docker container `chronograf:1.10`

Chronograf fails when using an OAuth provider which has a self signed certificate, even when the environment `GENERIC_INSECURE` is set to true (#5491).

docker-compose snippet containing the environment settings
```
GENERIC_NAME: generic
GENERIC_INSECURE: "true"
GENERIC_AUTH_URL: https://192.168.56.1/oauth/v2/authorize
GENERIC_TOKEN_URL: https://192.168.56.1/oauth/v2/token
GENERIC_API_URL: https://192.168.56.1/oauth/v2/userinfo
JWKS_URL: https://192.168.56.1/oauth/v2/keys
GENERIC_SCOPES: "openid,profile,email"
USE_ID_TOKEN: "true"
... other env config
```

Error message shown once the authentication happened on the OAuth provider:
```
level=error msg="parsing extra id_token failed:failed to fetch \"https://192.168.56.1/oauth/v2/keys\": Get \"https://192.168.56.1/oauth/v2/keys\": x509: certificate signed by unknown authority" component=auth method=GET remote_addr="172.21.0.4:45840" url="/oauth/generic/callback?code=...
```

The same happens when using the CLI option `--generic-insecure` in the `command` section of the docker-compose

Contributor guide

Open the contributing guide

Research direction

Start with the docker-compose environment and the OAuth callback flow, especially the JWKS_URL request that reports the certificate error. Compare GENERIC_INSECURE and --generic-insecure behavior, then verify that authentication completes successfully with the self-signed provider certificate.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.