Bugzilla – Attachment 161784 Details for
Bug 34755
Error authenticating to external OpenID Connect (OIDC) identity provider : wrong_csrf_token
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 34755: Resets the userenv when calling OAuth api endpoints
Bug-34755-Resets-the-userenv-when-calling-OAuth-ap.patch (text/plain), 1.86 KB, created by
Maryse Simard
on 2024-02-06 14:37:49 UTC
(
hide
)
Description:
Bug 34755: Resets the userenv when calling OAuth api endpoints
Filename:
MIME Type:
Creator:
Maryse Simard
Created:
2024-02-06 14:37:49 UTC
Size:
1.86 KB
patch
obsolete
>From 8df8cbb51cb306aadb4c64d0324dd34047de47f4 Mon Sep 17 00:00:00 2001 >From: Maryse Simard <maryse.simard@inlibro.com> >Date: Mon, 5 Feb 2024 20:34:17 -0500 >Subject: [PATCH] Bug 34755: Resets the userenv when calling OAuth api > endpoints > >When using OIDC authentication, the error "wrong_csrf_token" can happen >if another user's userenv is loaded during login. This is because the >wrong userenv is used to compare the tokens. This patch explicitly >resets userenv when using OAuth endpoints of the Koha api. > >Steps to reproduce: >0. On a Koha with SSO configured >1. Open the OPAC >2. Log in with a regular Koha user, not using SSO. >3. In a private browser window, open the OPAC >4. log in using SSO with a different user account. >5. Notice that you get the error message "There was an error >authenticating to external identity provider wrong_csrf_token" >6. Click on the "Log in with [...]" button again. >7. Notice that the user is immediately logged in. > >To test: >- Apply the tests patch >- prove t/db_dependent/api/v1/idp.t > => FAIL: wrong_csrf_token >- Apply patch >- prove t/db_dependent/api/v1/idp.t > => SUCCESS >- Run other OAuth endpoints tests to make sure nothing broke: > prove t/db_dependent/api/v1/auth_authenticate_api_request.t > prove t/db_dependent/api/v1/oauth.t >--- > Koha/REST/V1/Auth.pm | 1 + > 1 file changed, 1 insertion(+) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 948bed689b..5ef64da0d6 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -84,6 +84,7 @@ sub under { > > if ( $c->req->url->to_abs->path =~ m#^/api/v1/oauth/# || $c->req->url->to_abs->path =~ m#^/api/v1/public/oauth/#) { > # Requesting OAuth endpoints shouldn't go through the API authentication chain >+ C4::Context->set_userenv( undef, q{} ); > $status = 1; > } > elsif ( $namespace eq '' or $namespace eq '.html' ) { >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 34755
:
161783
|
161784
|
162710
|
162748
|
162977