search

jbbarth / redmine_omniauth_cas

CAS authentication plugin for Redmine through OmniAuth
MIT License
19 stars 14 forks source link

GitHub authentication fails #11

Closed timdp closed 10 years ago

timdp commented 10 years ago

I'm trying to set up login using a GitHub Enterprise account on Redmine 2.3.3. Here's what I did so far:

  1. Registered a new app at my GitHub Enterprise installation, using /auth/github/callback as the callback URL.
  2. Cloned redmine_omniauth_cas into the plugins folder.
  3. Edited init.rb to reflect omniauth-github's boilerplate code for GitHub Enterprise.
  4. Added omniauth-github to Gemfile.local.
  5. bundle update
  6. Created an account with the same login as my GitHub Enterprise account.
  7. Manually browsed to /auth/github, which threw me to GitHub's authorization page, as expected.
  8. Authorized the app.

Unfortunately, this kicked me back to the (standard) login page, with the error message translation missing: en.error_cas_invalid_credentials. Digging into the logs, I found redirects to /auth/github/callback?error=redirect_uri_mismatch&state=....

I subsequently found that I can override the redirect URI using the origin HTTP parameter, so I browsed to /auth/github?origin=http://.... I take it there's a better way to access this URL?

Anyway, after authorization, I ended up at the Redmine login page again, but with a different error: Invalid user or password. In the logs, I found Failed login for '673'. I have no idea where that 673 comes from. It's not the numeric ID of my Redmine account. I guess it might be my ID at the GitHub Enterprise installation, which uses LDAP logins, but why would GitHub resort to the numeric version rather than my user name?

So now, I'm pretty much stuck. Any help is appreciated. I apologize if this is an omniauth-github issue instead.

jbbarth commented 10 years ago

In case there's any confusion for future readers, this plugin only handles the CAS protocol, not Github flavored OAuth.

I guess the "Failed login for" message you observe comes from the AccountController patch, esp. those lines : https://github.com/jbbarth/redmine_omniauth_cas/blob/master/lib/redmine_omniauth_cas/account_controller_patch.rb#L30-37

I may be interested in making this work too but for github main website, do you know if github and github enterprise share the same authentication mecanisms ?

timdp commented 10 years ago

Indeed, I got confused about OmniAuth. Sorry for the invalid bug report.

If anyone is interested in achieving the behavior I described, there is redmine_omniauth_github, which I forked and patched to work the way I needed. The original plugin only supports github.com, but can be easily modified to support GitHub Enterprise, as they indeed share the same API.

jbbarth commented 10 years ago

No problem, I'll take a look at your plugin for my own needs. Happy you managed to make it work !