OAuth2 Log-in does not work against League's Oauth2-Server

[SimonBin]

OAuth2 Log-in does not work against League's Oauth2-Server

[nook24]

Hi @SimonBin,
the login code needs a bit love and refactoring. We have an issue in our backlog, which is addressing this issue.
I guess for now, you should go with LDAP, and wait until we have some time to refactor SSO.

[SimonBin]

hi @nook24 , thanks for answer. If I fix this part of the code the SSO seems to work. The attribute mapping might need to be more flexible though.

here is the patch I made to oauth2client so it works with our install of simplesamlphp:

mail is an array of mails ->
optionally forward other attributes returned by simpleSamlPHP in the attributes dictionary ->
(the exact data you get depends on the oauth endpoint... I would prefer to match by useraccount instead of mail, since mail can be changed in our ldap)

diff --git a/app/Model/Oauth2client.php b/app/Model/Oauth2client.php
index 2dcde9e..7d96dfd 100644
--- a/app/Model/Oauth2client.php
+++ b/app/Model/Oauth2client.php
@@ -75,7 +75,7 @@ class Oauth2client
                 return ['success' => false, 'message' => 'Can not get user data: '.(ENVIRONMENT === 'production' ? '' : $userDataArr[1])];
             }
             $userArray = $userDataArr[1]->toArray();
-            return ['success' => true, 'email' => $userArray['mail']];
+            return ['success' => true, 'email' => $userArray['mail'][0], 'attributes' => $userArray['attributes']];
         }
     }
 

and here the main fix, as I said above I have no idea what the code is supposed to do but simply commenting the offending rewrite it works:

diff --git a/app/Vendor/Oauth2/league/oauth2-client/src/Provider/AbstractProvider.php b/app/Vendor/Oauth2/league/oauth2-client/src/Provider/AbstractProvider.php
index 27d8c87..b3181fd 100644
--- a/app/Vendor/Oauth2/league/oauth2-client/src/Provider/AbstractProvider.php
+++ b/app/Vendor/Oauth2/league/oauth2-client/src/Provider/AbstractProvider.php
@@ -632,18 +632,18 @@ abstract class AbstractProvider
     protected function sendRequest(RequestInterface $request)
     {
         try {
-            if(!empty($this->code) && empty($this->accessToken)){
-                $response = $this->getHttpClient()->request('POST', $this->tokenEndpoint.'?grant_type=authorization_code&code='.$this->code.
-                    '&redirect_uri='.$this->redirectUri.
-                    '&client_id='.$this->clientId.
-                    '&client_secret='.$this->clientSecret);
-            }elseif(!empty($this->accessToken)){
-                $response = $this->getHttpClient()->request('POST', $this->userEndpoint.'?client_id='.$this->clientId.
-                    '&client_secret='.$this->clientSecret.
-                    '&access_token='.$this->accessToken);
-            }else{
+#            if(!empty($this->code) && empty($this->accessToken)){
+#                $response = $this->getHttpClient()->request('POST', $this->tokenEndpoint.'?grant_type=authorization_code&code='.$this->code.
+#                    '&redirect_uri='.$this->redirectUri.
+#                    '&client_id='.$this->clientId.
+#                    '&client_secret='.$this->clientSecret);
+#            }elseif(!empty($this->accessToken)){
+#                $response = $this->getHttpClient()->request('POST', $this->userEndpoint.'?client_id='.$this->clientId.
+#                    '&client_secret='.$this->clientSecret.
+#                    '&access_token='.$this->accessToken);
+#            }else{
                 $response = $this->getHttpClient()->send($request);
-            }
+#            }
         } catch (BadResponseException $e) {
             $errorMessage = str_replace($this->clientId, '***', $e->getMessage());
             $errorMessage = str_replace($this->clientSecret, '***', $errorMessage);

[nook24]

Hi @SimonBin,
the SSO implementation got rewritten from scratch with openITCOCKPIT 4. Had you already a chance to test this out?