search

owncloud / openidconnect

OpenId Connect (OIDC) Integration for ownCloud
GNU General Public License v2.0
6 stars 2 forks source link

PKCE issue. #221

Closed tbs575 closed 2 years ago

tbs575 commented 2 years ago

Guys, I setup openid auth by keycloak, met strange thing, in http protocol, all working find with login auth, but in https protocol, met PKCE error in first login time (can see more detail, https://github.com/owncloud/openidconnect/issues/219).

I capture network package, the package is same method except protocol

http
GET /auth/realms/icep/protocol/openid-connect/auth?response_type=code&redirect_uri=http%3A%2F%2F10.200.101.18%3A8087%2Fapps%2Fopenidconnect%2Fredirect&client_id=owncloud&state=df3c9888b501290a2600cabc9ac20211&scope=openid+profile+email+openid&nonce=8447a8023c316e36c869de449b2cf806&code_challenge=LdTb7Rld1fVr4OxpsFmbKSHS2Nzm0VzMrhNGL0ELUto&code_challenge_method=S256 HTTP/1.1

https
GET /auth/realms/icep/protocol/openid-connect/auth?response_type=code&redirect_uri=http%3A%2F%2F10.200.101.18%3A8087%2Fapps%2Fopenidconnect%2Fredirect&client_id=owncloud&state=a5b54668051669b1d324897fcda363bf&scope=openid+profile+email+openid&nonce=c0b79172818d3a581f5af4ff59c1300f&code_challenge=D4-vaR0NRQ3XI96CxtVq1vH7Q2EIp-7Rt3rFU_qJVO8&code_challenge_method=S256 HTTP/2

found code_challenge_method=S256, it is made PKCE issue?

and I checked [/.well-known/openid-configuration](http://my-owncloud-ip:8087/.well-known/openid-configuration) saw "code_challenge_methods_supported":["plain","S256"], if this setting made issue? days, spend on this issue, but no any wokring, need help, thanks

tbs575 commented 2 years ago

Did more testing, found root cause. owncloud and keycloak keeped same protocal, like http or https. otherwise , will met strange problem. My owncloud enviroment, using openid auth by keycloak. if using different protocol, like owncloud using http, keycloak using https, then met strange issue (PKCE). likewise, keycloak using http, owncloud using https still met issue.