david4096
commented
7 years ago Thanks @Welliton309 for putting together such a detailed set of instructions! Auth0 was in the process of testing the API based non-interactive clients features and I haven't tried them out.
The AUTH0_AUTHORIZED_EMAILS are email addresses that you have authorized to access data in the server. You can set up Google OIDC, but you don't want any Google user to be able to log in, so you add only the authorized emails to that list.
It sounds a bit like that is what is going wrong, the callback code does looks well formed, but you're being redirected to the /login with a code. If the request is authorized the callback session gets redirected to printing out the login code. https://github.com/ga4gh/server/blob/master/ga4gh/server/auth/__init__.py#L156
Are you trying to log in using an email in the authorized users list? The returned information about the email used to perform the login attempt has to match what is in the local configuration.
wdesouza
I am trying to figure out how to configure a working example of GA4GH server with Auth0 authentication service. I am using the latest release version (0.3.5). Because Auth0 service should be configured via web browser, I created a step-by-step tutorial with my progress. I think the following pictures and text may help others. The problem I found is at the end of this text.
Follow the Deployment on Apache instructions to install the reference implementation server.
At Apache configuration, you should use the root path instead of
/ga4ghbecause the server is using absolute path when redirecting web address.Configuring Auth0 service
First login or sign up in Auth0 website: https://auth0.com/
Creating Client
On tab
Clientclick inCreate Client. Give a name for your Client and choose theNon Interactive Clientsclient type. ClickCreate.In
Settingstab copy theDomain,Client IDandClient Secretdata.These data will be used to set the following server configuration values (reference):
AUTH0_HOSTwithDomain;AUTH0_CLIENT_IDwithClient ID;AUTH0_CLIENT_SECRETwithClient Secret.Fill
Allowed Callback URLs,Allowed Logout URLsandAllowed Origins (CORS)with the web address of server endpoint plus the related path.Creating API
Go to
APIstab and click inCreate API. TheIdentifiershould be the URL of server endpoint (the landing page). For this example I am using root path and TCP port 80.On
Scopestab, create two scopes:openidandemail.On
Non Interactive Clientstab, authorize the previous created Client. Select both scopesopenidandemail. ClickUpdatethenContinue.Creating Database Connections
Go to
Connections-Databasetab and clickCreate DB Connection. I disabled sign ups because I want to have control over user creation allowing only certain people/software to have access on server.In
Clientstab, activate the connection between the Client and the Database.Creating Users
Go to
Userstab and clickCreate User. Fill the fields.Connectionshould be same one previously created. An email will be send requesting to verify. I recommend creating your own user for testing purposes.Setting up GA4GH server with authentication
Append the following server configuration values to
config.pyfile (reference). Remember to update the fields correctly. Create a SECRET_KEY. I didn’t understand the fieldAUTH0_AUTHORIZED_EMAILS. I just used the same email I used to login into Auth0 website.Restart the server.
Testing
Finally access server landing page. It will show an error and a link to login. At login page, use the same email and password used to create a user. Note that it does not have an option to create a user (it can be changed).
After login you will see the token page.
Issues
It seems that Auth0 returned access token to
/callbackbut it redirected to/loginagain. It happens sometimes requiring to restart Apache server.Using
ga4gh_clienttool:Using
--keyargument does not work.Using Python library (reference):
Error: