Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Login fails when groups used and access token is not a JWT #87

Open
Corfus opened this issue Sep 17, 2023 · 0 comments
Open

Login fails when groups used and access token is not a JWT #87

Corfus opened this issue Sep 17, 2023 · 0 comments

Comments

@Corfus
Copy link

Corfus commented Sep 17, 2023

When you use groups in the Plugin Configuration and the receiving access_token is not a JWT the login fails, see logs and screenshot.

2023-09-17T21:05:17.307320691Z I, [2023-09-17T21:05:17.307178 #1]  INFO -- : Completed 500 Internal Server Error in 554ms (ActiveRecord: 6.9ms | Allocations: 4660)
2023-09-17T21:05:17.308166091Z F, [2023-09-17T21:05:17.308094 #1] FATAL -- :   
2023-09-17T21:05:17.308183781Z NoMethodError (undefined method `unpack1' for nil:NilClass
2023-09-17T21:05:17.308189501Z 
2023-09-17T21:05:17.308194071Z     str.unpack1("m")
2023-09-17T21:05:17.308198681Z        ^^^^^^^^):
2023-09-17T21:05:17.308202961Z   
2023-09-17T21:05:17.308207061Z plugins/redmine_openid_connect/app/models/oic_session.rb:178:in `user'
2023-09-17T21:05:17.308211231Z plugins/redmine_openid_connect/app/models/oic_session.rb:163:in `admin?'
2023-09-17T21:05:17.308215311Z plugins/redmine_openid_connect/lib/redmine_openid_connect/account_controller_patch.rb:143:in `oic_local_login'

image

When you don't use the groups, everything works.

I think the reason is written here: oic_session.rb

Here will be tried to decode the access_token when it exists.
This only works when the access_token is a JWT like in Keycloak, but the format of the access_token is not defined in the RFC and can be everything also a random alphanumeric string and then it fails.

When I remove the special code for Keycloak, it works like expected

Normally I don't work with Ruby, so perhaps I didn't understand the code correct and the real reason is on another location, but for me it looks very logical.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant