satosa-users April 2020

satosa-users@lists.sunet.se

3 participants
2 discussions

by kristo.jorgenson＠gmail.com

Hi all, I am a developer working on an open source project called SimplyE which is an eBook platform originally developed by the New York Public Library, but now being used by many public libraries across the US. The company I work for (Lyrasis) is currently adding support for university libraries, and with that comes supporting SAML. We are looking for someone experienced in federated authentication to assist us in this, and I thought I would reach out here to see if anyone is looking for contract work. If you are interested, or know anyone who might be, please be in touch with me via this email. Thanks so much, Kristo

4 years

InvalidAuthorizationCode

by peter.schober＠univie.ac.at

Since I've been able to answer my own question about manual client registration (w/o MongoDB) in another thread (now resolved) https://lists.sunet.se/pipermail/satosa-users/2020-March/000120.html I'm starting a new thread about the latter (unrelated) issue: Starting at the oidc-enabled app I'm sent to satosa with an auth request, the client is now known/found (client_db details shared at the above URL), the saml backend is involked, SAML WebSSO happens, attributes are mapped and I am back "Routing to frontend: oidc". Then satosa raises an InvalidAuthorizationCode exception: [pyop.authz_state.create_authorization_code] creating authz code for scope=openid email profile [pyop.authz_state.create_authorization_code] new authz_code=eff...cd79 to client_id=someClientId for sub=someid at example.org valid_until=1585612419 ... [satosa.proxy_server.unpack_request] read request data: {'grant_type': 'authorization_code', 'code': 'eff...cd79', 'redirect_uri': 'https://some.example.org/auth/callback'} ... [pyop.client_authentication.verify_client_authentication] client authentication in Authorization header Basic base64-encoded-client_id_colon_client_secret [satosa.frontends.openid_connect.token_endpoint] invalid request: eff...cd79 unknown Traceback (most recent call last): File "/usr/local/venv/SATOSA/lib/python3.7/site-packages/satosa/frontends/openid_connect.py", line 363, in token_endpoint response = self.provider.handle_token_request(urlencode(context.request), headers) File "/usr/local/venv/SATOSA/lib/python3.7/site-packages/pyop/provider.py", line 324, in handle_token_request return self._do_code_exchange(token_request, extra_id_token_claims) File "/usr/local/venv/SATOSA/lib/python3.7/site-packages/pyop/provider.py", line 352, in _do_code_exchange authentication_request = self.authz_state.get_authorization_request_for_code(token_request['code']) File "/usr/local/venv/SATOSA/lib/python3.7/site-packages/pyop/authz_state.py", line 320, in get_authorization_request_for_code raise InvalidAuthorizationCode('{} unknown'.format(authorization_code)) pyop.exceptions.InvalidAuthorizationCode: eff...cd79 unknown So the authz code created above (first line) is now unkown (last line). Why would that happen and what can I do to avoid it? On the RP side (seemingly using https://www.npmjs.com/package/openid-client) I currently only see the same thing as RP is merely relaying the OP error, it seems. And this being an OP error I probably don't have to dig into the RP side to get more/better logging: OPError: invalid_grant (eff...cd79 unknown) at processResponse (/opt/edumeet/mm/server/node_modules/openid-client/lib/helpers/process_response.js:45:13) at Client.grant (/opt/edumeet/mm/server/node_modules/openid-client/lib/client.js:1235:26) at process._tickCallback (internal/process/next_tick.js:68:7) I'd appreciate suggestions on what I could have done wrong following the satosa documentation where available, or how to further debug this issue. If other/more information (config details, logs, etc.) are needed or my obscuring of details above is unclear I'm happy to provide those. -peter

4 years, 1 month

2024

2023

2022

2021

2020

2019

2018

2017

satosa-users April 2020