search

KorAP / Kustvakt

:speedboat: User and policy management component for KorAP, capable of rewriting queries for policy based document restrictions.
BSD 2-Clause "Simplified" License
4 stars 3 forks source link

OAuth2 - Wrong Signin Redirect #773

Closed notesjor closed 1 month ago

notesjor commented 1 month ago

The following error is critical - I ask for quick response. The function has already worked - it is already in use in several productive applications.

For some time now, the previous OAuth2 authentication has no longer worked.

The following used to work:

  1. an OAuth2 application APP was created by user DEV.
  2. when user USER was asked to register for the APP, this user was shown the login screen (user / password) and could then confirm access to the APP application.

Now:

  1. still works.
  2. if the USER now gets the login screen and signs in, he does NOT get the confirmation prompt for APP-access - but: the normal KorAP search is displayed. When the window is reloaded, the user is also offered to register a new application (normal users don't register APPs).

Therefore: Something in the routing seems to be wrong.

margaretha commented 1 month ago

Hi Jan, sorry it took a while to response. There is no new changes in the API regarding the OAuth2 authorization flow. I have just checked the authorization flow using my client and cannot reproduce the issue. Did you get any error message?

margaretha commented 1 month ago

We have investigated the problem. The issue is caused by recent changes (i.e., access restriction to owner and admin only) in the client info API that is used by Kalamar in the authorization process.

@notesjor I have rolled out a quick fix on the test instance. Could you please check?

notesjor commented 1 month ago

09-10-2024_11-35-27 The error has not yet been fixed in the current KorAP instance. However, the “Client not found” error no longer appears. But you still don't get to the page with the accesses, you're forwarded directly to the KorAP search. This means that OAuth2 still does not work from my side (as before).

hebasta commented 1 month ago

Were you using the test instance? It looks like you were testing it on the main instance. As I understood margaretha she rolled it out on the test instance.

margaretha commented 1 month ago

Yes, please check on https://korap.ids-mannheim.de/instance/test. If it is fine, I will deploy it on the main instance.

notesjor commented 1 month ago

Ah ok, that explains it. Thank you. I can't test it to 100% - but it seems to work.

margaretha commented 1 month ago

The main instance has been updated with the hot fix.

notesjor commented 1 month ago

tested - works again as expected - thanks alot 👍