Bug 36219 - State parameter broken for OIDC/Oauth
Summary: State parameter broken for OIDC/Oauth
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low blocker
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 34478
Blocks: 36192
  Show dependency tree / graph
 
Reported: 2024-03-04 03:55 UTC by David Cook
Modified: 2024-04-17 08:42 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Circulation function:

Attachments
Bug 36219: Re-add missing state param for Oauth/OIDC client (1.12 KB, patch)
2024-03-04 04:01 UTC, David Cook 		Details | Diff | Splinter Review
Bug 36219: Re-add missing state param for Oauth/OIDC client (1.20 KB, patch)
2024-03-04 12:16 UTC, Jonathan Druart 		Details | Diff | Splinter Review
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-03-04 03:55:24 UTC 
Bug 34478 accidentally removed the csrf token that functions as the state parameter in Koha/REST/V1/OAuth/Client.pm, which has broken the OIDC/Oauth SSO. 

Easy fix though, and should only be relevant for master at this point.
Comment 1 David Cook 2024-03-04 04:01:06 UTC 
Created attachment 162709 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide
Comment 2 Jonathan Druart 2024-03-04 12:11:09 UTC 
I confirm that the changes made to Koha/REST/V1/OAuth/Client.pm in the following commit were not expected!

  commit 7e7159bf58f2dd1172737d0abe4bcfa15237c88e
  Bug 34478: Remove generate_csrf from pl
Comment 3 Jonathan Druart 2024-03-04 12:16:05 UTC 
Created attachment 162711 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2024-03-04 13:51:10 UTC 
Pushed to master for 24.05.00
Comment 5 Fridolin Somers 2024-04-17 08:42:20 UTC 
Depends on Bug 34478 not in 23.11.x