search

AdamLantos / redmine_http_auth

HTTP Authentication plugin for redmine
MIT License
37 stars 47 forks source link

Invalid form authenticity token for some users #1

Open Norwan opened 14 years ago

Norwan commented 14 years ago

Hi, We are not sure but it seems that since we installed this plugin some users got "Invalid form authenticity token" when they perform any action linked with a form : new demand, new project etc. How do you rate it? Thank you for your help Stéphane

AdamLantos commented 14 years ago

Hi Stéphane,

first of all, please specify which version are you using (redmine and http_auth). Also please try to update if you're not using the latest version. Also can you reliable reproduce these types of problems, or does it occur to be random, only with some users? Is it a browser-specific or user-specific issue?

thanks, Adam

Norwan commented 14 years ago

Hi Adam We are using Redmine 0.9.4 and and the lastest version of http_auth. We tryed but did not success to reproduce the problem, but once a user got the problem, it got it for ever... An other information which is perhaps linked, when we call the application by https://server_name/account/login we got "Internal Error" and the log contains:

Processing AccountController#login (for x.x.x.x at 2010-07-21 15:42:52) [GET] Parameters: {"action"=>"login", "controller"=>"account"} Rendering template within layouts/base Rendering account/login ActionView::TemplateError (undefined method `signin_path' for #ActionView::Base:0x2b120b3fff00) on line #25 of app/views/layouts/base.rhtml: 22:

23:
24:
25: <%= render_menu :account_menu -%> 26:
27: <%= content_tag('div', "#{l(:label_logged_as)} #{link_to_user(User.current, :format => :username)}", :id => 'loggedas') if User.current.logged? %> 28: <%= render_menu :top_menu -%>

lib/redmine/menu_manager.rb:269:in `send'
lib/redmine/menu_manager.rb:269:in `extract_node_details'    lib/redmine/menu_manager.rb:186:in `render_menu_node'    lib/redmine/menu_manager.rb:177:in `render_menu'    lib/redmine/menu_manager.rb:254:in `menu_items_for'    lib/redmine/menu_manager.rb:251:in `each'    lib/redmine/menu_manager.rb:251:in `menu_items_for'    lib/redmine/menu_manager.rb:176:in `render_menu'    app/views/layouts/base.rhtml:25:in `_run_rhtml_app47views47layouts47base46rhtml'    public/dispatch.fcgi:23

Rendering /opt/redmine-0.9.4/public/500.html (500 Internal Server Error)

Thank you Stéphane

AdamLantos commented 14 years ago

Hi,

this latter issue don't seem to be related to the http_auth plugin, and it should persist if you uninstall the plugin itself (you can try to move the vendor/plugins/redmine_http_auth directory out of the path and restart the container to see if this is the case).

The form_authenticity_token issue is probably related to http://www.redmine.org/issues/5230, unfortunately I can not reproduce it in my installation :(

thanks, Adam

AdamLantos commented 14 years ago

also see http://www.redmine.org/issues/3968, maybe that helps

Norwan commented 14 years ago

Hi Adam We found out the initial cause of our problem! For a user the authentification is not case-sensitive but if you have a difference between the login entered and the login declared you got systematically the message "Invalid form authenticity token". Regards Stéphane

AdamLantos commented 14 years ago

Hi Stéphane,

I'm not sure I'm following you here... Could you please elaborate the followings?

  • username in the database
  • username from the HTTP container authentication
  • was the login by the http_auth plugin successful or did you try to login on the redmine form (/account/login)?
  • which url did you access after that

I know of one small issue: when the plugin is activated, the /account/login form doesn't work (instead it gives 'invalid form authenticity token'). Is your issue basically the same?

Are you using redmine>=r3807 (http://www.redmine.org/issues/2473)?

thanks, Adam

Norwan commented 14 years ago

Hi Adam I'm going to explain better: For exemple I have a user declared by the admin StephaneBalme When I log as stephanebalme it works but I got the error message "Invalid Token" each time I use a form Thanks Stéphane

Norwan commented 14 years ago

Hi Adam I precise that we have two versions of Redmine, one with the plugin http_auth, one without, and that this problem occurs only with the first version. Regards Stéphane

SergeST commented 13 years ago

agree with Norwan. the problem is the case sensitive thing.

this is my apache config:

balbalbal ... SSPIUsernameCase lowe ... bablablab

If the user is: OzzyOsbourne -> it produces: ozzyosbourne

and now, if i try to log in as OssyOsbourne, redmine shows the error. if i try to log in as ozzyosburne it does successfully

AdamLantos commented 13 years ago

Could you please retest with aaf7eb01f1ca6be21f03b748273f21e2e689d154 applied? That should fix the case sensitivity issue.

SergeST commented 13 years ago

the problem was the web client and the apache config

chrome no problem IE does not authenticate at all FF no problem

  • © Githubissues.
  • Githubissues is a development platform for aggregating issues.