Bug 34163 - CSRF error if try OAuth2/OIDC after logout
Summary: CSRF error if try OAuth2/OIDC after logout
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low critical
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 27849 33675
Blocks:
  Show dependency treegraph
 
Reported: 2023-06-30 02:06 UTC by David Cook
Modified: 2024-12-23 08:06 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.04,22.11.10
Circulation function:


Attachments
Bug 34163: Handle both anonymous userenv when generating CSRF tokens (3.46 KB, patch)
2023-06-30 02:52 UTC, David Cook
Details | Diff | Splinter Review
Bug 34163: Handle both anonymous userenv when generating CSRF tokens (3.52 KB, patch)
2023-09-12 11:30 UTC, Tomás Cohen Arazi (tcohen)
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2023-06-30 02:06:12 UTC
If you do a local log into Koha, then logout, then try to do a OAuth2/OIDC log in, you'll get a CSRF error.

The reason is that Koha is generating the CSRF token using an id like "anonymous_58d273f40cb20ff0aacab829aaf935fc" but checking it with an id of "_58d273f40cb20ff0aacab829aaf935fc".

This is because we're not properly checking the C4::Context->userenv and/or it seems like it's not getting properly set after a logout.
Comment 1 David Cook 2023-06-30 02:07:37 UTC
Note that if you do a OIDC login, then a Koha logout, then a OIDC login - it will probably work because you still have a session with your IDP. 

This appears to be an edge case, although I'll check with the person originally talking about it on the listserv...
Comment 2 David Cook 2023-06-30 02:52:39 UTC
Created attachment 152880 [details] [review]
Bug 34163: Handle both anonymous userenv when generating CSRF tokens

An anonymous session might have a userenv which is undef or which is
a hashref of undef/empty values.

This patch generates the "anonymous" prefix for undef/empty 'id'
values, which prevents CSRF errors when logging in via OAuth2/OIDC
following a Koha logout.

Test plan:
Before applying patch:
1. Go to https://wiki.koha-community.org/wiki/Testing_SSO
2. Set up OpenID Connect realm, user, client, and Koha
integration to Keycloak for koha-testing-docker as noted in the wiki

3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
4. Click on OIDC "Log in with XXXX" button and log into IDP
5. Note that you're not logged in and you instead see an error message like:
"There was an error authenticating to external identity provider wrong_csrf_token"

6. Apply patch
7. Go to "Sessions" section of the test realm in Keycloak
e.g. http://sso:8082/auth/admin/master/console/#/test/sessions
8. Click "Action" on the far right side of the screen
9. Choose "Sign out all active sessions"

After applying patch:
10. koha-plack --restart kohadev
11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
12. Click on OIDC "Log in with XXXX" button and log into IDP
13. Note that you're logged in

14. prove t/Token.t
15. Note all tests pass
Comment 3 Tomás Cohen Arazi (tcohen) 2023-09-12 10:57:40 UTC
You can no longer login after a logout. I wouldn't consider it an edge case it minor.
Comment 4 Tomás Cohen Arazi (tcohen) 2023-09-12 11:30:05 UTC
Created attachment 155548 [details] [review]
Bug 34163: Handle both anonymous userenv when generating CSRF tokens

An anonymous session might have a userenv which is undef or which is
a hashref of undef/empty values.

This patch generates the "anonymous" prefix for undef/empty 'id'
values, which prevents CSRF errors when logging in via OAuth2/OIDC
following a Koha logout.

Test plan:
Before applying patch:
1. Go to https://wiki.koha-community.org/wiki/Testing_SSO
2. Set up OpenID Connect realm, user, client, and Koha
integration to Keycloak for koha-testing-docker as noted in the wiki

3. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
4. Click on OIDC "Log in with XXXX" button and log into IDP
5. Note that you're not logged in and you instead see an error message like:
"There was an error authenticating to external identity provider wrong_csrf_token"

6. Apply patch
7. Go to "Sessions" section of the test realm in Keycloak
e.g. http://sso:8082/auth/admin/master/console/#/test/sessions
8. Click "Action" on the far right side of the screen
9. Choose "Sign out all active sessions"

After applying patch:
10. koha-plack --restart kohadev
11. Go to http://localhost:8080/cgi-bin/koha/opac-main.pl?logout.x=1
12. Click on OIDC "Log in with XXXX" button and log into IDP
13. Note that you're logged in

14. prove t/Token.t
15. Note all tests pass

Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 5 Tomás Cohen Arazi (tcohen) 2023-09-12 11:31:50 UTC
*** Bug 34755 has been marked as a duplicate of this bug. ***
Comment 6 Tomás Cohen Arazi (tcohen) 2023-09-12 11:35:05 UTC
Caused by 27849, highlighted by 34163
Comment 7 Tomás Cohen Arazi (tcohen) 2023-09-12 12:43:27 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 8 Fridolin Somers 2023-09-14 17:59:54 UTC
Pushed to 23.05.x for 23.05.04
Comment 9 Matt Blenkinsop 2023-09-15 10:21:51 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x