[Issue] openID Connect plugin cannot load 'JWKS to use' #199

New issue

Closed

opened 2022-04-29 19:03:34 +02:00 by trefzer · 3 comments

trefzer commented

2022-04-29 19:03:34 +02:00

(Migrated from github.com)

Describe the issue
I try to configure openID connect plugin. On the Interface I try to add a JWKS but it gets two errors in the web frontend: Error while updating the module ; and Error in glewlwyd api.
I generated the keys like stated in https://babelouest.github.io/glewlwyd/docs/OIDC.html.

I tried the example 1 to generate: rnbyc -j -g ec256 -k key-1 -a ES256 -p /dev/null
The private keys are generated, but it cannot added in the api
tried example 2 to generate: rnbyc -j -g ecdsa256 -k key-1 -p /dev/null -g rsa2048 -k key-2 -p /dev/null
This fails with '--generate: Invalid argument' (I think this is a wrong command in the documentation)
tried example 2 with option from example 1 :): rnbyc -j -g ec256 -k key-1 -p /dev/null -g rsa2048 -k key-2 -p /dev/null
keys are generated but cannot added in the api

rnbcy is at version 1.1.4
glewlwyd is at version 2.6.2
System is a debian bullseye (I made a backport package for glewlwyd and the needed libraries)

Any hint is appreciated ! I would also appreciate if I could figure out howto make glewlwyd a bit more chatty for debuging errors like that !

I tried before with PEM format keys but without success, firefox did not succed to redirect to login page, chromium did redirect, but the state_cookie could not be found.

Probably a simple quickstart-simple-oidc-working example would help as starting point. Documentation is good as it states what every parameter is for (if you know how oidc is working). But having a simple working example with the parameters needed and the probably a best-practice value to add would really help (even better if that would be suggested on adding of the pluggin, so I can make changes off a working configuration).

Well I'd like to end this report with a big THANK YOU for your'e work (although it's not working yet for me ;))

**Describe the issue** I try to configure openID connect plugin. On the Interface I try to add a JWKS but it gets two errors in the web frontend: Error while updating the module ; and Error in glewlwyd api. I generated the keys like stated in https://babelouest.github.io/glewlwyd/docs/OIDC.html. * I tried the example 1 to generate: rnbyc -j -g ec256 -k key-1 -a ES256 -p /dev/null The private keys are generated, but it cannot added in the api * tried example 2 to generate: rnbyc -j -g ecdsa256 -k key-1 -p /dev/null -g rsa2048 -k key-2 -p /dev/null This fails with '--generate: Invalid argument' (I think this is a wrong command in the documentation) * tried example 2 with option from example 1 :): rnbyc -j -g ec256 -k key-1 -p /dev/null -g rsa2048 -k key-2 -p /dev/null keys are generated but cannot added in the api rnbcy is at version 1.1.4 glewlwyd is at version 2.6.2 System is a debian bullseye (I made a backport package for glewlwyd and the needed libraries) Any hint is appreciated ! I would also appreciate if I could figure out howto make glewlwyd a bit more chatty for debuging errors like that ! I tried before with PEM format keys but without success, firefox did not succed to redirect to login page, chromium did redirect, but the state_cookie could not be found. Probably a simple quickstart-simple-oidc-working example would help as starting point. Documentation is good as it states what every parameter is for (if you know how oidc is working). But having a simple working example with the parameters needed and the probably a best-practice value to add would really help (even better if that would be suggested on adding of the pluggin, so I can make changes off a working configuration). Well I'd like to end this report with a big THANK YOU for your'e work (although it's not working yet for me ;))

babelouest commented

2022-04-29 20:34:08 +02:00

(Migrated from github.com)

Hello @trefzer ,

Thanks for noticing, there is 2 problems raised:

The documentation is incorrect for the second example, it must have an alg property for each key, the alg value corresponds to the JWA parameter. The second example should be something like that:

$ rnbyc -j -g ec256 -k key-1 -a ES256 -g rsa2048 -k key-2 -a PS256 -p /dev/null

The front-end doesn't validates that each key has an alg value, but the backend does. I'll fix that soon.

What's weird is that I can't reproduce the problem with the first example, because it has an alg value in the key generated.

Also, when you have a cryptic error message in the front-end, you may look at the backend log file (set logs in debug mode), which might have a more verbose error, if your error is still not understandable, you're welcome to open an issue or a discussion :)

Let me know if that helps

Hello @trefzer , Thanks for noticing, there is 2 problems raised: - The documentation is incorrect for the second example, it must have an `alg` property for each key, the `alg` value corresponds to the [JWA parameter](https://datatracker.ietf.org/doc/html/rfc7518#section-3.1). The second example should be something like that: ```shell $ rnbyc -j -g ec256 -k key-1 -a ES256 -g rsa2048 -k key-2 -a PS256 -p /dev/null ``` - The front-end doesn't validates that each key has an `alg` value, but the backend does. I'll fix that soon. What's weird is that I can't reproduce the problem with the first example, because it has an `alg` value in the key generated. Also, when you have a cryptic error message in the front-end, you may look at the backend log file (set logs in debug mode), which might have a more verbose error, if your error is still not understandable, you're welcome to open an issue or a discussion :) Let me know if that helps

trefzer commented

2022-04-30 10:51:07 +02:00

(Migrated from github.com)

Hi
This was fast. I can confirm, first example works (no idea, why it did not work before !).
Second one is now also working as expected.

So adding the keys is working, so I have some new errors to investigate ! but know when trying to authenticate a user.

generate_credential_fake_list - Error generate_credential_fake_from_seed
user_auth_scheme_module_trigger webauthn - Error generate_credential_fake
auth_trigger_user_scheme - Error user_auth_scheme_module_trigger
callback_glewlwyd_user_auth_trigger - Error auth_trigger_user_scheme

Well I will try to find the error, if I'm stock, I open a new ticket ;) feel free to close this one.

Hi This was fast. I can confirm, first example works (no idea, why it did not work before !). Second one is now also working as expected. So adding the keys is working, so I have some new errors to investigate ! but know when trying to authenticate a user. - generate_credential_fake_list - Error generate_credential_fake_from_seed - user_auth_scheme_module_trigger webauthn - Error generate_credential_fake - auth_trigger_user_scheme - Error user_auth_scheme_module_trigger - callback_glewlwyd_user_auth_trigger - Error auth_trigger_user_scheme Well I will try to find the error, if I'm stock, I open a new ticket ;) feel free to close this one.

babelouest commented

2022-04-30 12:32:32 +02:00

(Migrated from github.com)

I fixed the UI in this commit github.com/babelouest/glewlwyd@de674c07d4 and the documentation is fixed here github.com/babelouest/glewlwyd@318d9701b2

I will close this issue and I suggest you open another one for your new issue then. You should describe it using the template, and add screenshots if possible.

Thanks @trefzer !

I fixed the UI in this commit https://github.com/babelouest/glewlwyd/commit/de674c07d428c1cd4162801f2b744efbafd2094c and the documentation is fixed here https://github.com/babelouest/glewlwyd/commit/318d9701b2efaff06820a8c8b7e84a05ab168303 I will close this issue and I suggest you open another one for your new issue then. You should describe it using the template, and add screenshots if possible. Thanks @trefzer !

This discussion has been locked. Commenting is limited to contributors.