[help] Split-domain 不能登录 phanpy.social 和 neodb.social

[rebron1900]

[help] Split-domain 不能登录 phanpy.social 和 neodb.social

[tsmethurst]

Hiya, you should always log in using the host domain value, not the account domain value, so it's normal that with phanpy you can't log in using the account-domain. I'm afraid I don't know neodb.social, is that a client that works with Mastodon etc?

[daenney]

A number of clients have heuristics to detect the split-domain setup themselves and then initiate login and API calls based on the host domain. However, not everyone does, and sometimes the heuristics are a bit wobbly.

It's usually best to initiate login directly from the host domain. That ensures the authentication headers and cookies match the exact domain for the API calls.

[rebron1900]

@daenney @tsmethurst But I can't log in to neodb.social even using host domain

[tsmethurst]

Hmm, did you at any point remove any applications from your database? For example, did you create an instance, sign in successfully to neodb.social, and then wipe your database file and start again? Just trying to narrow things down a bit.

[daenney]

With the UI being in Simplified Chinese I'm afraid I'm having a rather hard time figuring anything out. The sources for it seem to be https://github.com/neodb-social/neodb which in turn is using https://github.com/jointakahe/takahe for the federation bits.

This makes it a bit of a faff to set up, the compose file has 2 database, a Redis, Typesense and multiple daemons. I don't have the energy to dive into that one right now.

[daenney]

Phanpy is a lot easier to deal with, and I have no issue logging in there. Both a local version of it as well as phanpy.social work fine for me, and I have a split domain setup.

When I initiate a login on Phanpy using the account domain, the UI immediately errors. This is expected. When I initiate the login from the host domain, everything works and I login successfully.

[daenney]

Best I can tell, there's no issue with Phanpy. It just doesn't have the heuristics to detect the split-account setup that some clients have, but GtS can't do anything about that.

Which leaves NeoDB. Given the oauth error, there's probably two queries worth running using the sqlite3 CLI:

select * from applications where id = '01D5AV31Q3H05XJ2R39WET6B4X';

That should tell you if the application NeoDB is looking for actually exists. If that returns nothing, you could also try:

select * from applications where name like '%neo%';

That may end up matching a different client ID. If that returns nothing, then it seems the signup flow never completed successfully.

In both cases, clearing the cookies for neodb.social (or trying it in a Private Browsing tab) should resolve the issue. Once you've done that, make sure you initiate the login using the host domain, not the account domain.

[rebron1900]

Best I can tell, there's no issue with Phanpy. It just doesn't have the heuristics to detect the split-account setup that some clients have, but GtS can't do anything about that.

Which leaves NeoDB. Given the oauth error, there's probably two queries worth running using the sqlite3 CLI:

select * from applications where id = '01D5AV31Q3H05XJ2R39WET6B4X';

That should tell you if the application NeoDB is looking for actually exists. If that returns nothing, you could also try:

select * from applications where name like '%neo%';

That may end up matching a different client ID. If that returns nothing, then it seems the signup flow never completed successfully.

In both cases, clearing the cookies for neodb.social (or trying it in a Private Browsing tab) should resolve the issue. Once you've done that, make sure you initiate the login using the host domain, not the account domain.

I tried to do a query based on your tips and there are two data about neodb in the database, do I need to delete them and start over?

sqlite> select * from applications where name like '%neo%'
   ...> ;
019VV28ZJ90Y59TZ76WCH2HTCT|2024-04-15 05:21:34|2024-04-15 05:21:34|NeoDB|https://neodb.social|https://neodb.social/account/login/oauth|01E09RTY8EGAT5EPQZ9A801SYY|ddde0df2-4b9e-4221-a971-17358a6f1d48|read:accounts read:follows read:search read:blocks read:mutes write:statuses write:media
01WNHFYJ3KAXH903N2BDS1E8DP|2024-04-15 05:21:35|2024-04-15 05:21:35|NeoDB|https://neodb.social|https://neodb.social/account/login/oauth|01N5XBFMEKHJEXGWBGZ4DCD4NC|630fdc13-b30b-4600-805f-2d6dc38b5a23|read:accounts read:follows read:search read:blocks read:mutes write:statuses write:media

Also, if I log in to Phanpy using the host domain it works fine, based on your reply it looks like there's no way to log in using the account domain (I was kinda hoping to be able to log in through the account domain, that way the account would look a bit cleaner)

[daenney]

It's odd to see two applications having been created within a second of each other. Would suggest something did go wrong.

You shouldn't need to delete those two applications, but you can since they're probably not working at all.

The usual query for that is

DELETE FROM applications WHERE id = '019VV28ZJ90Y59TZ76WCH2HTCT';

Or alternatively:

DELETE FROM applications WHERE name LIKE '%neo%';

I would suggest to wait for @tsmethurst to chime in with anything else before modifying the database though.

[tsmethurst]

You should be wary when deleting applications because there are cases where the remote software stores + reuses the application, rather than creating a new one every login. Elk does this, for example, so that if you delete the application in your GtS database that Elk created, next time you try to log into your instance with Elk, the login will fail because Elk reuses the application it's got stored on its own side.

Before doing any manual tinkering in your database, it would be a good idea to ask the maintainers of NeoDB if they store + reuse applications per instance, and if there's any method of wiping applications from their side so that you can try fresh.

Relevant Elk issues: elk-zone/elk#2562, elk-zone/elk#2422, elk-zone/elk#2279

[tsmethurst]

^^ The above is why I was asking if you'd logged in to NeoDB from that domain before and possibly already deleted the app by resetting your database or something.

[rebron1900]

@daenney @tsmethurst Thank you, after redeployment yesterday, I can log in now. It seems that I can only log in using the host domain at the moment。

[daenney]

Cool. The host domain thing is expected. Clients need to do a bit of work to detect a split domain setup. We've got all the bits and pieces for that in place the same way that Mastodon does and it works correctly for a number of clients that implement those checks. There's nothing more we can do there, beyond individual clients implementing those checks so they always initiate login from the host domain.