influxdata / influxdata/chronograf
OAuth with self signed certificate not working
- Dominant language
- TypeScript
- Stars
- 1.6k
- Forks
- 250
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 9
Description
Using the docker container `chronograf:1.10`
Chronograf fails when using an OAuth provider which has a self signed certificate, even when the environment `GENERIC_INSECURE` is set to true (#5491).
docker-compose snippet containing the environment settings
```
GENERIC_NAME: generic
GENERIC_INSECURE: "true"
GENERIC_AUTH_URL: https://192.168.56.1/oauth/v2/authorize
GENERIC_TOKEN_URL: https://192.168.56.1/oauth/v2/token
GENERIC_API_URL: https://192.168.56.1/oauth/v2/userinfo
JWKS_URL: https://192.168.56.1/oauth/v2/keys
GENERIC_SCOPES: "openid,profile,email"
USE_ID_TOKEN: "true"
... other env config
```
Error message shown once the authentication happened on the OAuth provider:
```
level=error msg="parsing extra id_token failed:failed to fetch \"https://192.168.56.1/oauth/v2/keys\": Get \"https://192.168.56.1/oauth/v2/keys\": x509: certificate signed by unknown authority" component=auth method=GET remote_addr="172.21.0.4:45840" url="/oauth/generic/callback?code=...
```
The same happens when using the CLI option `--generic-insecure` in the `command` section of the docker-compose
Contributor guide
Research direction
Start with the docker-compose environment and the OAuth callback flow, especially the JWKS_URL request that reports the certificate error. Compare GENERIC_INSECURE and --generic-insecure behavior, then verify that authentication completes successfully with the self-signed provider certificate.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100