Bug 36219

Summary: State parameter broken for OIDC/Oauth
Product: Koha Reporter: David Cook <dcook>
Component: AuthenticationAssignee: David Cook <dcook>
Status: RESOLVED FIXED QA Contact: Testopia <testopia>
Severity: blocker    
Priority: P5 - low CC: dpavlin, fridolin.somers, jonathan.druart
Version: Main   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=34755
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00
Bug Depends on: 34478    
Bug Blocks: 36192    
Attachments: Bug 36219: Re-add missing state param for Oauth/OIDC client
Bug 36219: Re-add missing state param for Oauth/OIDC client

Description David Cook 2024-03-04 03:55:24 UTC
Bug 34478 accidentally removed the csrf token that functions as the state parameter in Koha/REST/V1/OAuth/Client.pm, which has broken the OIDC/Oauth SSO. 

Easy fix though, and should only be relevant for master at this point.
Comment 1 David Cook 2024-03-04 04:01:06 UTC
Created attachment 162709 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide
Comment 2 Jonathan Druart 2024-03-04 12:11:09 UTC
I confirm that the changes made to Koha/REST/V1/OAuth/Client.pm in the following commit were not expected!

  commit 7e7159bf58f2dd1172737d0abe4bcfa15237c88e
  Bug 34478: Remove generate_csrf from pl
Comment 3 Jonathan Druart 2024-03-04 12:16:05 UTC
Created attachment 162711 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2024-03-04 13:51:10 UTC
Pushed to master for 24.05.00
Comment 5 Fridolin Somers 2024-04-17 08:42:20 UTC
Depends on Bug 34478 not in 23.11.x