SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.35k stars 159 forks source link

Broken SSO when using OpenID #178

Closed 0x00-0x00 closed 2 years ago

0x00-0x00 commented 2 years ago

Describe the bug Creating a OpenID IDP in version 8.3.2 with correct configuration leads to 404 error when clicking to login with SSO in login page.

If you downgrade Vectr to 8.0.4, solves the problem and the SSO login works flawlessly.

If you upgrade back from 8.0.4 to 8.3.2, the SSO login now works in 8.3.2.

TLDR; there is something wrong when creating identity providers in 8.3.2 while downgrading it to 8.0.4 solves the problem, even retroactively. Also, I was able to create identity providers in 8.0.4 and it does not gives me 404 errors and works as expected.

To Reproduce Steps to reproduce the behavior:

  1. Go to 'Administration' -> Access Management -> Identity Providers
  2. Click on 'Add Provider' and click on OpenID
  3. Insert configurations for a IDP
  4. Logout and try to login using the OpenID IDP
  5. Error 404
  6. Downgrade Vectr-Tomcat container editing docker-compose.yml and setting the version to 8.0.4
  7. Run docker-compose up -d to recreate vectr-tomcat with version 8.0.4
  8. Try to login using the same SSO provider you registered while in version 8.3.2, it works now.
  9. Edit docker-compose.yml again and switch vectr-tomcat to 8.3.2
  10. Run docker-compose up -d to recreate vectr-tomcat in order to switch to version 8.3.2;
  11. Now SSO login works in 8.3.2!

Expected behavior Instead of error 404, it is expected to login using SSO to the vectr application.

Screenshots 404 Error when trying to login with version 8.3.2, before the downgrade. Pasted image 20220518165359

Apache Tomcat error logs when the error 404 pops-up: Pasted image 20220518165636

It seems that Vectr cant find the Identity provider ID, and returns 404. But somehow downgrading vectr version solves this issue.

Desktop (please complete the following information):

doodleincode commented 2 years ago

Thanks for reporting this! This will be addressed in our next release.

pr0b3r7 commented 2 years ago

I can confirm this fix worked on 8.3.2 + Az AD SSO via app registration @0x00-0x00

doodleincode commented 2 years ago

Fixed in 8.4.3.