search

Luzifer / nginx-sso

SSO authentication provider for the auth_request nginx module
Apache License 2.0
286 stars 41 forks source link

auth/oidc - Error 400 on fetching user info #50

Closed bbigras closed 4 years ago

bbigras commented 4 years ago

nginx-sso-0.22.0

I got this error:

déc 09 14:05:20 vm-nginx nginx-sso[8258]: time="2019-12-09T14:05:20-05:00" level=error msg="Error while handling auth request" error="Unable to fetch user info: Unable to fetch user info: 400 Bad Request: {\"error\":\"invalid_request\",\"error_description\":\"Invalid token\",\"error_uri\":\"https:\\/\\/tools.ietf.org\\/html\\/draft-ietf-oauth-v2-31#section-7.2\"}"

I deleted my cookies and it was working again. It's possible that the problem is caused by the bad oauth server I use but would it be possible to make the user log in again if that error happens?

EDIT: I forgot to say that when this error happens, the user only gets a 500 error page. That's why I wanted the login to try again. But maybe that could cause an infinite loop.

Luzifer commented 4 years ago

This issue occurs when the OIDC (oAuth2) token is expired while the nginx-sso cookie is still valid. Then the old token is sent to the server and the server does not respond with HTTP 401 but HTTP 400 (in v0.22.0 a fix was added for HTTP 401 not being handled).

Which provider are you using the OIDC module with?

bbigras commented 4 years ago

Which provider are you using the OIDC module with?

One of the worst one ever. https://wordpress.org/plugins/oauth2-provider/

There's only 2 plugins to make wordpress act as an oauth server...

Luzifer commented 4 years ago

I've drafted a PR (#52) for this and updated the luzifer/nginx-sso:experimental docker image with that PR. Please have a look whether this solves the issue you are experiencing?

bbigras commented 4 years ago

Sorry for the late reply, I was waiting to get back to work to test.

I'm currently running 69c7f91be221168c4d892fa014a68f3a1e37dcde but I don't know how long it takes for the tokens to expire.

I'll set a reminder to test every day.

Thanks for you time.

bbigras commented 4 years ago

I think the problem is gone with your fix.

The wp plugin's token expire very fast so I think I was able to test it every time I tried.

Luzifer commented 4 years ago

In that case v0.24.0 including this patch is out now! Thanks for testing out the patch! :slightly_smiling_face: