Bug 34163

Summary: CSRF error if try OAuth2/OIDC after logout
Product: Koha Reporter: David Cook <dcook>
Component: AuthenticationAssignee: David Cook <dcook>
Status: CLOSED FIXED QA Contact: Testopia <testopia>
Severity: critical    
Priority: P5 - low CC: clemens.tubach, dpavlin, fridolin.somers, lukasz.koszyk, michaela.sieber, tomascohen
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34755
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10
Circulation function:
Bug Depends on: 27849, 33675    
Bug Blocks:    
Attachments: Bug 34163: Handle both anonymous userenv when generating CSRF tokens
Bug 34163: Handle both anonymous userenv when generating CSRF tokens

Description David Cook 2023-06-30 02:06:12 UTC
If you do a local log into Koha, then logout, then try to do a OAuth2/OIDC log in, you'll get a CSRF error.

The reason is that Koha is generating the CSRF token using an id like "anonymous_58d273f40cb20ff0aacab829aaf935fc" but checking it with an id of "_58d273f40cb20ff0aacab829aaf935fc".

This is because we're not properly checking the C4::Context->userenv and/or it seems like it's not getting properly set after a logout.
Comment 1 David Cook 2023-06-30 02:07:37 UTC
Note that if you do a OIDC login, then a Koha logout, then a OIDC login - it will probably work because you still have a session with your IDP. 

This appears to be an edge case, although I'll check with the person originally talking about it on the listserv...
Comment 2 David Cook 2023-06-30 02:52:39 UTC
Created attachment 152880 [details] [review]
Bug 34163: Handle both anonymous userenv when generating CSRF tokens

An anonymous session might have a userenv which is undef or which is
a hashref of undef/empty values.

This patch generates the "anonymous" prefix for undef/empty 'id'
values, which prevents CSRF errors when logging in via OAuth2/OIDC
following a Koha logout.

Test plan:
Before applying patch:
1. Go to https://wiki.koha-community.org/wiki/Testing_SSO
2. Set up OpenID Connect realm, user, client, and Koha
integration to Keycloak for koha-testing-docker as noted in the wiki

3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
4. Click on OIDC "Log in with XXXX" button and log into IDP
5. Note that you're not logged in and you instead see an error message like:
"There was an error authenticating to external identity provider wrong_csrf_token"

6. Apply patch
7. Go to "Sessions" section of the test realm in Keycloak
e.g. http://sso:8082/auth/admin/master/console/#/test/sessions
8. Click "Action" on the far right side of the screen
9. Choose "Sign out all active sessions"

After applying patch:
10. koha-plack --restart kohadev
11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
12. Click on OIDC "Log in with XXXX" button and log into IDP
13. Note that you're logged in

14. prove t/Token.t
15. Note all tests pass
Comment 3 Tomás Cohen Arazi (tcohen) 2023-09-12 10:57:40 UTC
You can no longer login after a logout. I wouldn't consider it an edge case it minor.
Comment 4 Tomás Cohen Arazi (tcohen) 2023-09-12 11:30:05 UTC
Created attachment 155548 [details] [review]
Bug 34163: Handle both anonymous userenv when generating CSRF tokens

An anonymous session might have a userenv which is undef or which is
a hashref of undef/empty values.

This patch generates the "anonymous" prefix for undef/empty 'id'
values, which prevents CSRF errors when logging in via OAuth2/OIDC
following a Koha logout.

Test plan:
Before applying patch:
1. Go to https://wiki.koha-community.org/wiki/Testing_SSO
2. Set up OpenID Connect realm, user, client, and Koha
integration to Keycloak for koha-testing-docker as noted in the wiki

3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
4. Click on OIDC "Log in with XXXX" button and log into IDP
5. Note that you're not logged in and you instead see an error message like:
"There was an error authenticating to external identity provider wrong_csrf_token"

6. Apply patch
7. Go to "Sessions" section of the test realm in Keycloak
e.g. http://sso:8082/auth/admin/master/console/#/test/sessions
8. Click "Action" on the far right side of the screen
9. Choose "Sign out all active sessions"

After applying patch:
10. koha-plack --restart kohadev
11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
12. Click on OIDC "Log in with XXXX" button and log into IDP
13. Note that you're logged in

14. prove t/Token.t
15. Note all tests pass

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Tomás Cohen Arazi (tcohen) 2023-09-12 11:31:50 UTC
*** Bug 34755 has been marked as a duplicate of this bug. ***
Comment 6 Tomás Cohen Arazi (tcohen) 2023-09-12 11:35:05 UTC
Caused by 27849, highlighted by 34163
Comment 7 Tomás Cohen Arazi (tcohen) 2023-09-12 12:43:27 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-09-14 17:59:54 UTC
Pushed to 23.05.x for 23.05.04
Comment 9 Matt Blenkinsop 2023-09-15 10:21:51 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x