Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update for "oidc", "oauth2" in https://github.com/OpenLiberty/open-liberty-operator/blob/master/doc/user-guide.adoc #160

Open
meiaus opened this issue May 17, 2020 · 0 comments

Comments

@meiaus
Copy link

meiaus commented May 17, 2020

In previous run (April/2020) with Open Liberty Operator and SSO providers, the oidc and oauth2 clients were configured with the redirect URI respectively as follows:

image

image

Recently re-running the same configuration, the respective failure appeared:

  • oauth2:
[ERROR ] CWWKS5434E: The social login feature encountered an error while processing the redirect request. CWWKS5433E: The request directed to [https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/oauth2Login] does not have a social login configuration with which it can be associated. 
  • oidc: (didn't have the same error msg as in above oauth2, but the browser displayed msg pointing to invalid parm in redirect URI)
    image

After comparing the sso-oauth.xml vs. sso-oauth2.xml, and sso-oidc.xml (earlier vs. recent), it's realized the "id" has been changed without using 'Login' string (e.g, oidcLogin, oauth2Login):

<oidcLogin
		id="oidc"
<oauth2Login
		id="oauth2"		
        clientId="${SEC_SSO_OAUTH2_CLIENTID}"

old:

	<oidcLogin
		id="oidcLogin"	
        clientId="${sec_sso_oidc_clientId}"

<oauth2Login
		id="oauth2Login"		
        clientId="${sec_sso_oauth2_clientId}"

After updating the new id in the client apps' redirect URI, the problem went away.

But would like to know why "oidc" and "oauth2" do not use the id format as rest of the sso providers:,
e.g.
https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/facebookLogin
https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/googleLogin
https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/githubLogin
https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/linkedinLogin
https://acme-ola-test.apps.hemmers.os.fyre.ibm.com/ibm/api/social-login/redirect/twitterLogin

If there is a reason "odic" and "oauth2" have to use the current id format, then hope the doc can give a little explanation or reminder to prevent the regression as seen here:

https://github.com/OpenLiberty/open-liberty-operator/blob/master/doc/user-guide.adoc

image

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants