HTTP Auth backend

diver-ua commented

2019-11-26 18:44:33 +01:00

(Migrated from github.com)

When I try to authenticate user from http-backend, everything goes well, until login.js requesting /api/profile_list
It getting response - 401, and authentication does not proceed (for some reason, correct http-backend user not authorized for profile_list.

Maybe I'm doing something wrong...

Request:
GET /api/profile_list HTTP/1.0
X-Real-IP: 10.4.250.1
X-Forwarded-For: 10.4.250.1
Host: auth.itstep.kiev.ua
Connection: close
accept: */*
x-requested-with: XMLHttpRequest
user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36
sec-fetch-mode: cors
sec-fetch-site: same-origin
referer: https://auth.itstep.kiev.ua/login.html?client_id=1c_QAZNMBVCDE%2311&scope=profile&callback_url=https%3a%2f%2fauth.itstep.kiev.ua%2fapi%2foidc%2fauth%3fclient_id%3d1c_QAZNMBVCDE%252311%26redirect_uri%3dhttps%253a%252f%252f172.18.0.2%252fOid%252fauthform.html%26response_type%3did_token%2btoken%26scope%3dprofile%26state%3d13c68c998a844bf395047fa497a865d9%26nonce%3df4baf524bd56428199a2e10a0373cc55
accept-encoding: gzip, deflate, br
accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7
cookie: GLEWLWYD2_SESSION_ID=4JZGljqyHp5wzVWwo7wntnFaLcAFYqeNkEzWM6vBJlujPU5zKyB3deU2cXzYVSw6ZCk0C7Y8dwlNeO4dICNBGRyvgstoyNezV74MuqIPlDlPmTJNLminK8E2ah5gZFsz


Response:
HTTP/1.0 401 Unauthorized
Connection: close
Content-Length: 0
Pragma: no-cache
Cache-Control: no-store
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Date: Tue, 26 Nov 2019 17:48:06 GM

Maybe there is some not obvious way to linkt openid-connect with http-backend?

When I try to authenticate user from http-backend, everything goes well, until login.js requesting /api/profile_list It getting response - 401, and authentication does not proceed (for some reason, correct http-backend user not authorized for profile_list. Maybe I'm doing something wrong... ``` Request: GET /api/profile_list HTTP/1.0 X-Real-IP: 10.4.250.1 X-Forwarded-For: 10.4.250.1 Host: auth.itstep.kiev.ua Connection: close accept: */* x-requested-with: XMLHttpRequest user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36 sec-fetch-mode: cors sec-fetch-site: same-origin referer: https://auth.itstep.kiev.ua/login.html?client_id=1c_QAZNMBVCDE%2311&scope=profile&callback_url=https%3a%2f%2fauth.itstep.kiev.ua%2fapi%2foidc%2fauth%3fclient_id%3d1c_QAZNMBVCDE%252311%26redirect_uri%3dhttps%253a%252f%252f172.18.0.2%252fOid%252fauthform.html%26response_type%3did_token%2btoken%26scope%3dprofile%26state%3d13c68c998a844bf395047fa497a865d9%26nonce%3df4baf524bd56428199a2e10a0373cc55 accept-encoding: gzip, deflate, br accept-language: ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7 cookie: GLEWLWYD2_SESSION_ID=4JZGljqyHp5wzVWwo7wntnFaLcAFYqeNkEzWM6vBJlujPU5zKyB3deU2cXzYVSw6ZCk0C7Y8dwlNeO4dICNBGRyvgstoyNezV74MuqIPlDlPmTJNLminK8E2ah5gZFsz Response: HTTP/1.0 401 Unauthorized Connection: close Content-Length: 0 Pragma: no-cache Cache-Control: no-store Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: * Date: Tue, 26 Nov 2019 17:48:06 GM ``` Maybe there is some not obvious way to linkt openid-connect with http-backend?

babelouest commented

2019-11-26 19:37:04 +01:00

(Migrated from github.com)

Hello @diver-ua ,

Thanks for reporting the issue. Indeed there's a bug in the user http backend I didn't see before...

I think I know why, this commit should do the trick: 41e7ec1

Hello @diver-ua , Thanks for reporting the issue. Indeed there's a bug in the user http backend I didn't see before... I think I know why, this commit should do the trick: 41e7ec1

diver-ua commented

2019-11-27 16:16:49 +01:00

(Migrated from github.com)

Ok. that works now.
Thank you!
But, unfortunately, there is one more catch:
Is it possible to add some 'template domain' to http backend settings (email generation - username@template.domain) - some services (including the one, I have to configure) are authenticating by e-mail, and there is no email in http user profile...

BTW, if in the client_id present hash sign (#), no updates/deletes are possible with this client from the web interface (hash sign is not escaped, and remaining part of client_id is missing from request uri)

Ok. that works now. Thank you! But, unfortunately, there is one more catch: Is it possible to add some 'template domain' to http backend settings (email generation - username@template.domain) - some services (including the one, I have to configure) are authenticating by e-mail, and there is no email in http user profile... BTW, if in the client_id present hash sign (`#`), no updates/deletes are possible with this client from the web interface (hash sign is not escaped, and remaining part of client_id is missing from request uri)

babelouest commented

2019-11-27 17:59:01 +01:00

(Migrated from github.com)

Concerning the template domain, you already can use the full e-mail address as login value if you want to.

But that's a good idea so I'll add this as a new feature probably in the next release.

Concerning the client_id bug, I'll fix that soon, thanks. Since the original bug is fixed now, I'm closing this issue. You can still open a new issue if you need to.

Thanks!

Concerning the template domain, you already can use the full e-mail address as login value if you want to. But that's a good idea so I'll add this as a new feature probably in the next release. Concerning the client_id bug, I'll fix that soon, thanks. Since the original bug is fixed now, I'm closing this issue. You can still open a new issue if you need to. Thanks!

babelouest commented

2019-11-28 04:41:47 +01:00

(Migrated from github.com)

The client_id bug has been fixed in 52c5e11

The template domain has been implemented in dce8050

For this new feature, in the backend configuration, you must set a username format like {USERNAME}@template.domain

The client_id bug has been fixed in 52c5e11 The template domain has been implemented in dce8050 For this new feature, in the backend configuration, you must set a `username format` like `{USERNAME}@template.domain`

Rows
Columns

HTTP Auth backend #67