Bugzilla – Attachment 90801 Details for
Bug 23146
Add support for Basic auth on the OAuth2 token endpoint
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 23146: (QA follow-up) Make sure we use the absolute path
Bug-23146-QA-follow-up-Make-sure-we-use-the-absolu.patch (text/plain), 2.09 KB, created by
Tomás Cohen Arazi (tcohen)
on 2019-06-19 15:43:48 UTC
(
hide
)
Description:
Bug 23146: (QA follow-up) Make sure we use the absolute path
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2019-06-19 15:43:48 UTC
Size:
2.09 KB
patch
obsolete
>From 9b99834acc915e4baaed25a7256a414adff92196 Mon Sep 17 00:00:00 2001 >From: Tomas Cohen Arazi <tomascohen@theke.io> >Date: Wed, 19 Jun 2019 12:30:28 -0300 >Subject: [PATCH] Bug 23146: (QA follow-up) Make sure we use the absolute path > >When making a request using any tool (like cUrl or Postman) you get a >'Basic authentication disabled' error (if it is actually disabled) or an >'invalid password' error if it is disabled. This is because the >comparisson of the path we do passes on oauth.t but fails on external >tools. This is probably related to our stack including Apache URL >mappings and then in the plack.psgi file. The safest way is to just ask >Mojo::URL the absolute path to be sure. > >To test: >- Having the rest of the patches applied and plack restarted, run: [1] > $ curl -X POST -H 'Authorization: Basic ZGQ2NjlmNGUtZmI1NS00Y2YzLWE4ZmYtYmFiYzJiNDIwNWY1OmM0ZDJmYmYzLWYwOWMtNGJkZi1iNWE4LTgxMDJmNjcwYTI1Mw' -i 'http://kohadev.myDNSname.org:8081/api/v1/oauth/token' --data grant_type=client_credentials >=> FAIL: It fails saying Basic auth is disabled >- Run: > $ kshell > k$ prove t/db_dependent/api/v1/oauth.t >=> SUCCESS: Tests pass >- Apply this patch >- Replicate your curl/postman test >=> SUCCESS: It now works as expected >- Run: > k$ prove t/db_dependent/api/v1/oauth.t >=> SUCCESS: Tests still pass! >- Sign off :-D > >[1] You need to generate a client_id and client_secret, and encode them >using: encode_base64url( "$client_id:$client_secret" ); > >Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> >--- > Koha/REST/V1/Auth.pm | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > >diff --git a/Koha/REST/V1/Auth.pm b/Koha/REST/V1/Auth.pm >index 8daa1adce4..88b78dcb12 100644 >--- a/Koha/REST/V1/Auth.pm >+++ b/Koha/REST/V1/Auth.pm >@@ -71,7 +71,7 @@ sub under { > "Configuration prevents the usage of this endpoint by unprivileged users"); > } > >- if ( $c->req->url->to_string eq '/api/v1/oauth/token' ) { >+ if ( $c->req->url->to_abs->path eq '/api/v1/oauth/token' ) { > # Requesting a token shouldn't go through the API authenticaction chain > $status = 1; > } >-- >2.22.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 23146
:
90757
|
90758
|
90777
|
90778
|
90779
|
90780
| 90801 |
91558