Bug 36219 - State parameter broken for OIDC/Oauth
Summary: State parameter broken for OIDC/Oauth
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Authentication (show other bugs)
Version: Main
Hardware: All All
: P5 - low blocker (vote)
Assignee: David Cook
QA Contact: Testopia
URL:
Keywords:
Depends on: 34478
Blocks: 36192
  Show dependency treegraph
 
Reported: 2024-03-04 03:55 UTC by David Cook
Modified: 2024-04-17 08:42 UTC (History)
3 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
24.05.00


Attachments
Bug 36219: Re-add missing state param for Oauth/OIDC client (1.12 KB, patch)
2024-03-04 04:01 UTC, David Cook
Details | Diff | Splinter Review
Bug 36219: Re-add missing state param for Oauth/OIDC client (1.20 KB, patch)
2024-03-04 12:16 UTC, Jonathan Druart
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description David Cook 2024-03-04 03:55:24 UTC
Bug 34478 accidentally removed the csrf token that functions as the state parameter in Koha/REST/V1/OAuth/Client.pm, which has broken the OIDC/Oauth SSO. 

Easy fix though, and should only be relevant for master at this point.
Comment 1 David Cook 2024-03-04 04:01:06 UTC
Created attachment 162709 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide
Comment 2 Jonathan Druart 2024-03-04 12:11:09 UTC
I confirm that the changes made to Koha/REST/V1/OAuth/Client.pm in the following commit were not expected!

  commit 7e7159bf58f2dd1172737d0abe4bcfa15237c88e
  Bug 34478: Remove generate_csrf from pl
Comment 3 Jonathan Druart 2024-03-04 12:16:05 UTC
Created attachment 162711 [details] [review]
Bug 36219: Re-add missing state param for Oauth/OIDC client

This change restores the csrf token added as the state param for
the OAuth/OIDC client.

Test plan:
0. Apply the patch and restart Starman
1. Test the SSO using the wiki guide

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>
Comment 4 Jonathan Druart 2024-03-04 13:51:10 UTC
Pushed to master for 24.05.00
Comment 5 Fridolin Somers 2024-04-17 08:42:20 UTC
Depends on Bug 34478 not in 23.11.x