Closed
Description
What is the issue or idea you have?
STF does not appear to be passing the state token to the Oauth2 provider (IBM Security Access Manager) when running "local" with a public IP
Please provide the steps to reproduce the issue.
Running an instance of STF local with a remote Nginx server doing HTTPS (configured per deployment guide)
- Launch STF:
export STF_AUTH_OAUTH2_OAUTH_CLIENT_SECRET=XXXXXXX export STF_AUTH_OAUTH2_OAUTH_CALLBACK_URL=https://XXXXXXX/auth/oauth/callback export STF_AUTH_OAUTH2_OAUTH_USERINFO_URL=https://XXXXXXX/mga/sps/oauth/oauth20/introspect export STF_AUTH_OAUTH2_OAUTH_SCOPE=openid email export STF_AUTH_OAUTH2_OAUTH_CLIENT_ID=XXXXXXX export STF_AUTH_OAUTH2_OAUTH_AUTHORIZATION_URL=https://XXXXXXX/mga/sps/oauth/oauth20/authorize export STF_AUTH_OAUTH2_OAUTH_TOKEN_URL=https://XXXXXXX/mga/sps/oauth/oauth20/token stf local --public-ip XXXXXXX --lock-rotation --auth-type oauth2
What is the expected behavior?
I'd expect the state token to be sent to the authentication provider
Do you see errors or warnings in the stf local
output? If so, please paste them or the full log here.
AuthorizationError: FBTOAU202E The required parameter: [state] was not found in the request. at Strategy.OAuth2Strategy.authenticate (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/passport-oauth2/lib/strategy.js:131:25) at attempt (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/passport/lib/middleware/authenticate.js:348:16) at authenticate (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/passport/lib/middleware/authenticate.js:349:7) at Layer.handle [as handle_request] (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/layer.js:95:5) at trim_prefix (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:317:13) at /home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:284:7 at Function.process_params (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:335:12) at next (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:275:10) at initialize (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/passport/lib/middleware/initialize.js:53:5) at Layer.handle [as handle_request] (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/layer.js:95:5) at trim_prefix (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:317:13) at /home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:284:7 at Function.process_params (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:335:12) at next (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/index.js:275:10) at expressInit (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/middleware/init.js:40:5) at Layer.handle [as handle_request] (/home/stfuser/npm/build/lib/node_modules/stf/node_modules/express/lib/router/layer.js:95:5)
Please run stf doctor
and paste the output here.
2018-07-03T15:41:08.920Z INF/cli:doctor 40144 [*] OS Arch: x64 2018-07-03T15:41:08.921Z INF/cli:doctor 40144 [*] OS Platform: linux 2018-07-03T15:41:08.922Z INF/cli:doctor 40144 [*] OS Platform: 4.4.0-128-generic 2018-07-03T15:41:08.922Z INF/cli:doctor 40144 [*] Using Node 8.11.1 2018-07-03T15:41:08.951Z INF/cli:doctor 40144 [*] Using ZeroMQ 4.2.3 2018-07-03T15:41:08.985Z INF/cli:doctor 40144 [*] Using ADB 1.0.39 2018-07-03T15:41:08.987Z INF/cli:doctor 40144 [*] Using RethinkDB 2.3.6~0xenial 2018-07-03T15:41:09.147Z INF/cli:doctor 40144 [*] Using ProtoBuf 3.5.1 2018-07-03T15:41:09.313Z INF/cli:doctor 40144 [*] Using GraphicsMagick 1.3.23
Activity
sorccu commentedon Jul 4, 2018
Seems like it's an undocumented option: jaredhanson/passport-oauth2#28
The
state: true
value should be added tooption.oauth
which is used here: https://github.com/openstf/stf/blob/master/lib/units/auth/oauth2/index.js#L23Easiest way would be to add a new boolean flag, defaulting to true, here: https://github.com/openstf/stf/blob/master/lib/cli/auth-oauth2/index.js
How about you create a patch and send us a PR? :)
sorccu commentedon Jul 14, 2018
This should be fixed and enabled by default in master now. Give it a go and see whether it works for you.
quangola commentedon Jul 17, 2018
Yep, that fixed it. Thanks! Maybe next time I'll send a patch. You know, once I learn a thing or two about NodeJS