search

ccrockett / omniauth-keycloak

Keycloak Strategy for OmniAuth.
MIT License
52 stars 43 forks source link

Scope setting gets overwritten causing ID token not to be returned from Keycloak #39

Open Kazhuu opened 1 year ago

Kazhuu commented 1 year ago

I noticed the version 1.5.1 of this gem added this https://github.com/ccrockett/omniauth-keycloak/pull/24 change. This change added request_phase method here. However what this is doing for me is that it's overwriting scope that I have set when configuring the provider like this:

    provider(:keycloak_openid,
             "client_id",
             "client_secret",
             name: "keycloak",
             scope: "openid", # <-- this line here!!!
             client_options: {
                 # Base url as empty, defaults to "/auth/..." base url.
                 base_url: "", site: "keycloak_url_here", realm: "test_realm"
             })

What is basically happening is the request_phase method is overwriting my scope with nil instead of "openid". This in turn causes Keycloak not to return ID token for me anymore.

I could provide a fix for this but not sure if I'm setting the scope correctly. Or could this be fixed in the gem to conditionally set value from request.params if it's nil? Maybe something along these lines:

def request_phase
  options.authorize_options.each do |key|
    options[key] = request.params[key.to_s] if options[key].nil?
  end
  super
end
a-gradina commented 1 year ago

@ccrockett is it possible to merge #40 by Kazhuu? The problem is just as he described and we rely on his fork now.

luisfagottani commented 6 months ago

Hey guys, we heave the same problem here! @ccrockett .

Happy birthday, btw 🥳

whoisdan commented 3 months ago

Same issue here. Would be great if we can have it sorted out. Thanks! @ccrockett