Summary: | CSRF error if try OAuth2/OIDC after logout | ||
---|---|---|---|
Product: | Koha | Reporter: | David Cook <dcook> |
Component: | Authentication | Assignee: | David Cook <dcook> |
Status: | CLOSED FIXED | QA Contact: | Testopia <testopia> |
Severity: | critical | ||
Priority: | P5 - low | CC: | clemens.tubach, dpavlin, fridolin.somers, lukasz.koszyk, michaela.sieber, tomascohen |
Version: | Main | ||
Hardware: | All | ||
OS: | All | ||
See Also: | https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34755 | ||
Change sponsored?: | --- | Patch complexity: | --- |
Documentation contact: | Documentation submission: | ||
Text to go in the release notes: | Version(s) released in: |
23.11.00,23.05.04,22.11.10
|
|
Circulation function: | |||
Bug Depends on: | 27849, 33675 | ||
Bug Blocks: | |||
Attachments: |
Bug 34163: Handle both anonymous userenv when generating CSRF tokens
Bug 34163: Handle both anonymous userenv when generating CSRF tokens |
Description
David Cook
2023-06-30 02:06:12 UTC
Note that if you do a OIDC login, then a Koha logout, then a OIDC login - it will probably work because you still have a session with your IDP. This appears to be an edge case, although I'll check with the person originally talking about it on the listserv... Created attachment 152880 [details] [review] Bug 34163: Handle both anonymous userenv when generating CSRF tokens An anonymous session might have a userenv which is undef or which is a hashref of undef/empty values. This patch generates the "anonymous" prefix for undef/empty 'id' values, which prevents CSRF errors when logging in via OAuth2/OIDC following a Koha logout. Test plan: Before applying patch: 1. Go to https://wiki.koha-community.org/wiki/Testing_SSO 2. Set up OpenID Connect realm, user, client, and Koha integration to Keycloak for koha-testing-docker as noted in the wiki 3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1 4. Click on OIDC "Log in with XXXX" button and log into IDP 5. Note that you're not logged in and you instead see an error message like: "There was an error authenticating to external identity provider wrong_csrf_token" 6. Apply patch 7. Go to "Sessions" section of the test realm in Keycloak e.g. http://sso:8082/auth/admin/master/console/#/test/sessions 8. Click "Action" on the far right side of the screen 9. Choose "Sign out all active sessions" After applying patch: 10. koha-plack --restart kohadev 11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1 12. Click on OIDC "Log in with XXXX" button and log into IDP 13. Note that you're logged in 14. prove t/Token.t 15. Note all tests pass You can no longer login after a logout. I wouldn't consider it an edge case it minor. Created attachment 155548 [details] [review] Bug 34163: Handle both anonymous userenv when generating CSRF tokens An anonymous session might have a userenv which is undef or which is a hashref of undef/empty values. This patch generates the "anonymous" prefix for undef/empty 'id' values, which prevents CSRF errors when logging in via OAuth2/OIDC following a Koha logout. Test plan: Before applying patch: 1. Go to https://wiki.koha-community.org/wiki/Testing_SSO 2. Set up OpenID Connect realm, user, client, and Koha integration to Keycloak for koha-testing-docker as noted in the wiki 3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1 4. Click on OIDC "Log in with XXXX" button and log into IDP 5. Note that you're not logged in and you instead see an error message like: "There was an error authenticating to external identity provider wrong_csrf_token" 6. Apply patch 7. Go to "Sessions" section of the test realm in Keycloak e.g. http://sso:8082/auth/admin/master/console/#/test/sessions 8. Click "Action" on the far right side of the screen 9. Choose "Sign out all active sessions" After applying patch: 10. koha-plack --restart kohadev 11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1 12. Click on OIDC "Log in with XXXX" button and log into IDP 13. Note that you're logged in 14. prove t/Token.t 15. Note all tests pass Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io> *** Bug 34755 has been marked as a duplicate of this bug. *** Caused by 27849, highlighted by 34163 Pushed to master for 23.11. Nice work everyone, thanks! Pushed to 23.05.x for 23.05.04 Nice work everyone! Pushed to oldstable for 22.11.x |