Plugin not setting up acr_values, scope, and nonce parameters

ibcajt01 commented 6 years ago

Hello.

I am having a problem with the Liferay OpenID Connect plugin (for Liferay DXP 7.0). I am trying to integrate my portal with login.gov as identity provider. The configurations I am using for the plugin and login.gov are included below. When I click on a Sign In link (https://localhost:8443/c/portal/login?p_l_id=111111) in my local environment, I encounter the following behaviors...

In Google Chrome: This page isnâ€™t working idp.int.identitysandbox.gov redirected you too many times.

In Firefox: The page isnâ€™t redirecting properly https://localhost:8443/c/portal/login?error=invalid_request&error_description=Acr+values+Please+fill+in+this+field.+Acr+values+No+acceptable+acr_values+found+Scope+Please+fill+in+this+field.+Scope+No+valid+scope+values+found+Nonce+Please+fill+in+this+field.+Nonce+is+too+short+%28minimum+is+32+characters%29&state=8d............................8a

In Internet Explorer: An infinite loop is apparently created. (The address bar appears to keep redirecting back and forth between two URLs.)

From the Firefox info, it seems as though the plugin is not setting up the acr_values, scope, and nonce parameters. I tried this in one of our shared portal environments using both friendly and machine URLs and observed the same behavior.

Can you please advise about this problem?

Here are my Liferay OpenID Connect plugin parameters:

Enabled: Checked

Location of the authorization service (example: https://accounts.google.com/o/oauth2/v2/auth) https://idp.int.identitysandbox.gov/openid_connect/authorize

Location of the token service (example: https://www.googleapis.com/oauth2/v4/token) https://idp.int.identitysandbox.gov/api/openid_connect/token

UserInfo endpoint (example: https://www.googleapis.com/plus/v1/people/me/openIdConnect) https://idp.int.identitysandbox.gov/api/openid_connect/userinfo

Issuer urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_issuer_name

Scope(s) of the access token Blank (to default to "openid profile email")

OAuth client ID urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_issuer_name (same as Issuer above)

OAuth client secret Blank (login.gov does not use this)

OpenID Provider type Generic

SSO logout endpoint (optional) Blank

Parameter name supplied to SSO logout endpoint (optional) Blank

Parameter value supplied to SSO logout endpoint (optional) Blank

Here are my login.gov app registration parameters:

Identity protocol openid_connect

Issuer urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_issuer_name

Public key
-----BEGIN CERTIFICATE----- ... -----END CERTIFICATE-----

Return to App UR https://localhost:8443/web/local-tmp-site-01

Redirect URIs https://localhost:8443/c/portal/login https://localhost:8443/c/portal/login?p_l_id=111111

Attribute bundle email

Active Y

(Please see https://developers.login.gov/oidc/ for login.gov OIDC parameter documentation.)

gvanderploeg commented 6 years ago

From the Firefox info, it seems as though the plugin is not setting up the acr_values, scope, and nonce parameters. I tried this in one of our shared portal environments using both friendly and machine URLs and observed the same behavior.

According to the spec (https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest), those parameters are optional, so I'd suppose they should be treated as such by the IDP. I've never encountered those parameters before as being mandatory by an IDP.

ibcajt01 commented 6 years ago

Hello, Geert.

Thank you for your reply. I do see in that spec that the acr_values and nonce are listed as optional parameters, and I will ask our IdP (login.gov) about them. However, that spec does indicate scope as being a required parameter.

Tony

gvanderploeg commented 6 years ago

Sure, scope is required, with 'openid profile email' as the wool-dyed value.

On Mon, 5 Nov 2018 at 15:54, ibcajt01 notifications@github.com wrote:

Hello, Geert.

Thank you for your reply. I do see in that spec that the acr_values and nonce are listed as optional parameters, and I will ask our IdP (login.gov) about them. However, that spec does indicate scope as being a required parameter.

Tony

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/finalist/liferay-oidc-plugin/issues/35#issuecomment-435903618, or mute the thread https://github.com/notifications/unsubscribe-auth/ABG69u141ms_oe6_ADNfoRPxdVMKnhjCks5usFEkgaJpZM4YCI6f .

-- http://www.finalist.nl

ibcajt01 commented 6 years ago

Then that message "Scope+Please+fill+in+this+field.+Scope+No+valid+scope+values+found" suggests to me that one of two things is happening: either (1) the plugin is not setting the default or (2) the plugin is setting it but the IdP is not correctly processing it.

In the plugin parameters in the UI, I tried 3 approaches. I left the scope blank to let it default and then I explicitly set the scope to "openid profile email" and to "openid email". Below are the requests I observed in the network traffic. In the case where I left scope blank, I did not see the scope value showing up in the /authorize call at all. In the second and third cases, I am seeing the given scope parameter in the URLs, suggesting to me that the problem with these lies on the IdP side.

By the way, can you please confirm that I am not supposed to have to restart the Liferay server after modifying the plugin parameters in the UI. (Or am I?)

Scope left blank with assumed default of "openid profile email"...

302 POST https://mysite.gov/c/portal/login?p_l_id=111111&windowState=exclusive

200 OPTIONS https://idp.int.identitysandbox.gov/openid_connect/authorize?response_type=code&redirect_uri=https://mysite.gov/c/portal/login&state=8d............................ce&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_profile_name

302 GET https://mysite.gov/c/portal/login?p_l_id=111111

302 GET https://idp.int.identitysandbox.gov/openid_connect/authorize?response_type=code&redirect_uri=https://mysite.gov/c/portal/login&state=8d............................ce&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_profile_name

302 GET https://mysite.gov/c/portal/login?error=invalid_request&error_description=Acr+values+Please+fill+in+this+field.+Acr+values+No+acceptable+acr_values+found+Scope+Please+fill+in+this+field.+Scope+No+valid+scope+values+found+Nonce+Please+fill+in+this+field.+Nonce+is+too+short+(minimum+is+32+characters)&state=8d............................ce

The last two repeat several times, and the page ultimately says "The page isn't redirecting properly".

Scope explicitly set to "openid profile email"...

302 POST https://mysite.gov/c/portal/login?p_l_id=111111&windowState=exclusive

200 OPTIONS https://idp.int.identitysandbox.gov/openid_connect/authorize?scope=openid+profile+email&response_type=code&redirect_uri=https://mysite.gov/c/portal/login&state=8d............................ce&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_profile_name

302 GET https://mysite.gov/c/portal/login?p_l_id=111111

302 GET https://idp.int.identitysandbox.gov/openid_connect/authorize?scope=openid+profile+email&response_type=code&redirect_uri=https://mysite.gov/c/portal/login&state=8d............................ce&client_id=urn:gov:gsa:openidconnect.profiles:sp:sso:doi_ibc:my_profile_name