search

micronaut-projects / micronaut-servlet

Servlet support in Micronaut
Apache License 2.0
29 stars 19 forks source link

OIDC authentication via Google fails on Tomcat #728

Open tfield opened 5 months ago

tfield commented 5 months ago

Expected Behavior

When using OIDC authentication with Google and Tomcat, I expect to be able to log in successfully.

The Micronaut Guide SECURE A MICRONAUT APPLICATION WITH GOOGLE was followed, and the server was changed from netty to tomcat, and this fails.

This seems similar to https://github.com/micronaut-projects/micronaut-servlet/issues/239 which includes links to https://github.com/micronaut-projects/micronaut-servlet/pull/256 https://github.com/micronaut-projects/micronaut-servlet/pull/275

Actual Behaviour

The callback URL fails with the following exception

ERROR i.m.http.server.RouteExecutor - Unexpected error occurred: Error instantiating bean of type [io.micronaut.security.oauth2.endpoint.authorization.response.DefaultOpenIdAuthorizationResponse]: Error decoding request body: Stream closed

This works fine with Netty.

mn-tomcat-google-error.txt

Steps To Reproduce

  1. download the java/gradle micronaut guide sample from here.
  2. configure google client id/secret per your google console
  3. start and test the app to authenticate
  4. observe success
  5. edit build.gradle and change micronaut.runtime from 'netty' to 'tomcat', and add implementation("io.micronaut.servlet:micronaut-http-server-tomcat")
  6. restart the app and test to authenticate
  7. observe the stack trace

Environment Information

Example Application

Download the java/gradle micronaut guide sample from here.

Version

4.4.0

graemerocher commented 5 months ago

Seems it doesn't like async being enabled by default, will take a look. You could try and use the latest 4.9.0 version and disable async. See https://micronaut-projects.github.io/micronaut-servlet/latest/guide/configurationreference.html#io.micronaut.servlet.engine.MicronautServletConfiguration

tfield commented 5 months ago

Thank you - that worked! I set

    implementation 'io.micronaut.servlet:micronaut-servlet-engine:4.9.0'
    implementation 'io.micronaut.servlet:micronaut-http-server-tomcat:4.9.0'

and

micronaut:
  servlet:
    async-supported: false
    test-async-supported: false
    async-file-serving-enabled: false

and this was successful.

tfield commented 8 hours ago

Update: I have updated my app to 4.6.3 and doing so allows me to remove the servlet 4.9 dependencies, so that's great. However, when I bump to 4.7.0, OIDC authentication no longer works. Is it possible to track down what has changed that broke this?