Using OIDC server for user management #939

Closed
opened 2019-05-29 14:09:24 +00:00 by Pako · 13 comments
Member

Hello!

Is it possible to use an existing OpenID Connect server as source for the users on a pleroma instance?

Hello! Is it possible to use an existing OpenID Connect server as source for the users on a pleroma instance?
Owner
Does OpenID Connect provide OAuth? If so, I think it can work. https://www.oauth.com/oauth2-servers/openid-connect/ https://docs-develop.pleroma.social/config.html#oauth-consumer-mode
Author
Member

Ohh, that looks interesting! I'll try that out immediately. Thanks a lot!

Ohh, that looks interesting! I'll try that out immediately. Thanks a lot!
Author
Member

I don't think I get how this works. I added the keycloak strategy, added that config section, but I'm still presented with pleroma's username/password prompt.

I don't think I get how this works. I added the keycloak strategy, added that config section, but I'm still presented with pleroma's username/password prompt.
Author
Member

Navigating to https://instance.tld/oauth/keycloak has me go through the login process but 500 internal error's me when hitting the callback.

Here's Pleroma's log:

server_1  | 13:54:54.469 request_id=2mhnkqj5esnlkcup9800b7lh [error] Internal server error: %FunctionClauseError{args: nil, arity: 1, clauses: nil, function: :callback_params, kind: nil, module: Pleroma.Web.OAuth.OAuthController}
server_1  | 13:54:54.522 [error] #PID<0.2167.0> running Pleroma.Web.Endpoint (connection #PID<0.2166.0>, stream id 1) terminated
server_1  | Server: social.stride.press:80 (http)
server_1  | Request: GET /oauth/keycloak/callback?session_state=b996199f-f2bb-4df6-a76c-424e0b5bda51&code=dccfaf1f-deb2-4e66-bcee-3f0ffa3388c9.b996199f-f2bb-4df6-a76c-424e0b5bda51.283d6f73-6015-444e-8f9e-a0353d58bb0d
server_1  | ** (exit) an exception was raised:
server_1  |     ** (Protocol.UndefinedError) protocol Phoenix.HTML.Safe not implemented for %{errors: %{detail: "Internal server error"}}. This protocol is implemented for: Atom, BitString, Date, DateTime, Decimal, Float, Integer, List, NaiveDateTime, Phoenix.HTML.Form, Time, Tuple
server_1  |         (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:1: Phoenix.HTML.Safe.impl_for!/1
server_1  |         (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:15: Phoenix.HTML.Safe.to_iodata/1
server_1  |         (phoenix) lib/phoenix/controller.ex:729: Phoenix.Controller.__put_render__/5
server_1  |         (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4
server_1  |         (phoenix) lib/phoenix/endpoint/render_errors.ex:75: Phoenix.Endpoint.RenderErrors.instrument_render_and_send/5
server_1  |         (phoenix) lib/phoenix/endpoint/render_errors.ex:62: Phoenix.Endpoint.RenderErrors.__catch__/5
server_1  |         (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:33: Phoenix.Endpoint.Cowboy2Handler.init/2
server_1  |         (cowboy) /home/pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2
Navigating to `https://instance.tld/oauth/keycloak` has me go through the login process but 500 internal error's me when hitting the callback. Here's Pleroma's log: ``` server_1 | 13:54:54.469 request_id=2mhnkqj5esnlkcup9800b7lh [error] Internal server error: %FunctionClauseError{args: nil, arity: 1, clauses: nil, function: :callback_params, kind: nil, module: Pleroma.Web.OAuth.OAuthController} server_1 | 13:54:54.522 [error] #PID<0.2167.0> running Pleroma.Web.Endpoint (connection #PID<0.2166.0>, stream id 1) terminated server_1 | Server: social.stride.press:80 (http) server_1 | Request: GET /oauth/keycloak/callback?session_state=b996199f-f2bb-4df6-a76c-424e0b5bda51&code=dccfaf1f-deb2-4e66-bcee-3f0ffa3388c9.b996199f-f2bb-4df6-a76c-424e0b5bda51.283d6f73-6015-444e-8f9e-a0353d58bb0d server_1 | ** (exit) an exception was raised: server_1 | ** (Protocol.UndefinedError) protocol Phoenix.HTML.Safe not implemented for %{errors: %{detail: "Internal server error"}}. This protocol is implemented for: Atom, BitString, Date, DateTime, Decimal, Float, Integer, List, NaiveDateTime, Phoenix.HTML.Form, Time, Tuple server_1 | (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:1: Phoenix.HTML.Safe.impl_for!/1 server_1 | (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:15: Phoenix.HTML.Safe.to_iodata/1 server_1 | (phoenix) lib/phoenix/controller.ex:729: Phoenix.Controller.__put_render__/5 server_1 | (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4 server_1 | (phoenix) lib/phoenix/endpoint/render_errors.ex:75: Phoenix.Endpoint.RenderErrors.instrument_render_and_send/5 server_1 | (phoenix) lib/phoenix/endpoint/render_errors.ex:62: Phoenix.Endpoint.RenderErrors.__catch__/5 server_1 | (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:33: Phoenix.Endpoint.Cowboy2Handler.init/2 server_1 | (cowboy) /home/pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2 ```
Author
Member

It looks like going through the mastodon FE gives me a button to log in through keycloak. Clicking that redirects me to

https://social.stride.press/oauth/keycloak_strategy?state={"client_id":"r9hIxy1NBP0j48E4sbRPN5jzHAL7ZdAnIDFEmPuNR6Q","redirect_uri":".","scope":"read write follow push","state":""}

and I'm getting this error

server_1  | 14:07:22.036 request_id=2mhnm65co4ld28ii1800bb0h [error] Internal server error: %UndefinedFunctionError{arity: 1, function: :handle_request!, message: nil, module: Ueberauth.Strategy.Keycloak_strategy, reason: nil}
server_1  | 14:07:22.091 [error] #PID<0.2808.0> running Pleroma.Web.Endpoint (connection #PID<0.2807.0>, stream id 1) terminated
server_1  | Server: social.stride.press:80 (http)
server_1  | Request: GET /oauth/keycloak_strategy?state=%7B%22client_id%22%3A%22r9hIxy1NBP0j48E4sbRPN5jzHAL7ZdAnIDFEmPuNR6Q%22%2C%22redirect_uri%22%3A%22.%22%2C%22scope%22%3A%22read+write+follow+push%22%2C%22state%22%3A%22%22%7D
server_1  | ** (exit) an exception was raised:
server_1  |     ** (Protocol.UndefinedError) protocol Phoenix.HTML.Safe not implemented for %{errors: %{detail: "Internal server error"}}. This protocol is implemented for: Atom, BitString, Date, DateTime, Decimal, Float, Integer, List, NaiveDateTime, Phoenix.HTML.Form, Time, Tuple
server_1  |         (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:1: Phoenix.HTML.Safe.impl_for!/1
server_1  |         (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:15: Phoenix.HTML.Safe.to_iodata/1
server_1  |         (phoenix) lib/phoenix/controller.ex:729: Phoenix.Controller.__put_render__/5
server_1  |         (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4
server_1  |         (phoenix) lib/phoenix/endpoint/render_errors.ex:75: Phoenix.Endpoint.RenderErrors.instrument_render_and_send/5
server_1  |         (phoenix) lib/phoenix/endpoint/render_errors.ex:62: Phoenix.Endpoint.RenderErrors.__catch__/5
server_1  |         (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:33: Phoenix.Endpoint.Cowboy2Handler.init/2
server_1  |         (cowboy) /home/pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2
It looks like going through the mastodon FE gives me a button to log in through keycloak. Clicking that redirects me to `https://social.stride.press/oauth/keycloak_strategy?state={"client_id":"r9hIxy1NBP0j48E4sbRPN5jzHAL7ZdAnIDFEmPuNR6Q","redirect_uri":".","scope":"read write follow push","state":""}` and I'm getting this error ``` server_1 | 14:07:22.036 request_id=2mhnm65co4ld28ii1800bb0h [error] Internal server error: %UndefinedFunctionError{arity: 1, function: :handle_request!, message: nil, module: Ueberauth.Strategy.Keycloak_strategy, reason: nil} server_1 | 14:07:22.091 [error] #PID<0.2808.0> running Pleroma.Web.Endpoint (connection #PID<0.2807.0>, stream id 1) terminated server_1 | Server: social.stride.press:80 (http) server_1 | Request: GET /oauth/keycloak_strategy?state=%7B%22client_id%22%3A%22r9hIxy1NBP0j48E4sbRPN5jzHAL7ZdAnIDFEmPuNR6Q%22%2C%22redirect_uri%22%3A%22.%22%2C%22scope%22%3A%22read+write+follow+push%22%2C%22state%22%3A%22%22%7D server_1 | ** (exit) an exception was raised: server_1 | ** (Protocol.UndefinedError) protocol Phoenix.HTML.Safe not implemented for %{errors: %{detail: "Internal server error"}}. This protocol is implemented for: Atom, BitString, Date, DateTime, Decimal, Float, Integer, List, NaiveDateTime, Phoenix.HTML.Form, Time, Tuple server_1 | (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:1: Phoenix.HTML.Safe.impl_for!/1 server_1 | (phoenix_html) deps/phoenix_html/lib/phoenix_html/safe.ex:15: Phoenix.HTML.Safe.to_iodata/1 server_1 | (phoenix) lib/phoenix/controller.ex:729: Phoenix.Controller.__put_render__/5 server_1 | (pleroma) lib/pleroma/web/endpoint.ex:5: Pleroma.Web.Endpoint.instrument/4 server_1 | (phoenix) lib/phoenix/endpoint/render_errors.ex:75: Phoenix.Endpoint.RenderErrors.instrument_render_and_send/5 server_1 | (phoenix) lib/phoenix/endpoint/render_errors.ex:62: Phoenix.Endpoint.RenderErrors.__catch__/5 server_1 | (phoenix) lib/phoenix/endpoint/cowboy2_handler.ex:33: Phoenix.Endpoint.Cowboy2Handler.init/2 server_1 | (cowboy) /home/pleroma/pleroma/deps/cowboy/src/cowboy_handler.erl:41: :cowboy_handler.execute/2 ```
Owner

I am not an expert in this area but @i1t did a lot of the OAuth work for us. He's been away but will return soon. I will assign this to him for his review so he can guide you and perhaps we can document this configuration for others.

I am not an expert in this area but @i1t did a lot of the OAuth work for us. He's been away but will return soon. I will assign this to him for his review so he can guide you and perhaps we can document this configuration for others.
Member

Isn't it related to this issue #400 ?

Isn't it related to this issue https://git.pleroma.social/pleroma/pleroma/issues/400 ?
Author
Member

@succfemboi No. #400 is related to using Pleroma itself as identity provider. I'm trying to use an existing OIDC server (keycloak) to authenticate against so I can use the accounts I already use for other things on Pleroma.

@succfemboi No. #400 is related to using Pleroma itself as identity provider. I'm trying to use an existing OIDC server (keycloak) to authenticate against so I can use the accounts I already use for other things on Pleroma.
Member

@Pako see #4619. This code is required to properly configure https://github.com/Rukenshia/ueberauth_keycloak.

In OAUTH_CONSUMER_STRATEGIES environment variable, use keycloak:ueberauth_keycloak_strategy entry.

Then add the following code to config/dev.secret.exs (making adjustments upon your Keycloak config):

keycloak_url = "https://your-keycloak-instance.org:8080"

config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth,
  client_id: System.get_env("KEYCLOAK_CLIENT_ID"),
  client_secret: System.get_env("KEYCLOAK_CLIENT_SECRET"),
  site: keycloak_url,
  authorize_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/auth",
  token_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/token",
  userinfo_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/userinfo",
  token_method: :post

The above code is theoretically correct and based on the code of https://github.com/Rukenshia/ueberauth_keycloak. With it, local Ueberauth successfully prepares a request to Keycloak (use Mastodon FE since Pleroma FE doesn't yet have OAuth consumer login form):

https://your-keycloak-instance.org:8080/auth/realms/master/protocol/openid-connect/auth?client_id=TESTME&redirect_uri=https%3A%2F%2Fi1t-pleroma.random.systems%2Foauth%2Fkeycloak%2Fcallback%3Fstate%3D%257B%2522client_id%2522%253A%2522iJvTI3hL3m3ZAw3nNvpyciQCDoLVGzqCYYhbDRMmOQI%2522%252C%2522redirect_uri%2522%253A%2522.%2522%252C%2522scope%2522%253A%2522read%2Bwrite%2Bfollow%2Bpush%2522%252C%2522state%2522%253A%2522%2522%257D&response_type=code&scope=api+read_user+read_registry&state=%7B%22client_id%22%3A%22iJvTI3hL3m3ZAw3nNvpyciQCDoLVGzqCYYhbDRMmOQI%22%2C%22redirect_uri%22%3A%22.%22%2C%22scope%22%3A%22read+write+follow+push%22%2C%22state%22%3A%22%22%7D

Note: I couldn't find a publicly reachable Keycloak server for testing so I couldn't yet test the full login sequence (with callback).

https://social.stride.press:8080/auth is unreachable — see https://stackoverflow.com/questions/34410707/enabling-remote-access-to-keycloak to open outside world access to it (since request is performed from user's browser).

If further assistance is required, pl. provide the URL of your publicly available Keycloak instance and a user / login we can use to test the full sequence.

CC @feld

@Pako see https://git.pleroma.social/pleroma/pleroma/pulls/4619. This code is required to properly configure https://github.com/Rukenshia/ueberauth_keycloak. In `OAUTH_CONSUMER_STRATEGIES` environment variable, use `keycloak:ueberauth_keycloak_strategy` entry. Then add the following code to `config/dev.secret.exs` (making adjustments upon your Keycloak config): ``` keycloak_url = "https://your-keycloak-instance.org:8080" config :ueberauth, Ueberauth.Strategy.Keycloak.OAuth, client_id: System.get_env("KEYCLOAK_CLIENT_ID"), client_secret: System.get_env("KEYCLOAK_CLIENT_SECRET"), site: keycloak_url, authorize_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/auth", token_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/token", userinfo_url: "#{keycloak_url}/auth/realms/master/protocol/openid-connect/userinfo", token_method: :post ``` The above code is theoretically correct and based on the code of https://github.com/Rukenshia/ueberauth_keycloak. With it, local Ueberauth successfully prepares a request to Keycloak (use Mastodon FE since Pleroma FE doesn't yet have OAuth consumer login form): `https://your-keycloak-instance.org:8080/auth/realms/master/protocol/openid-connect/auth?client_id=TESTME&redirect_uri=https%3A%2F%2Fi1t-pleroma.random.systems%2Foauth%2Fkeycloak%2Fcallback%3Fstate%3D%257B%2522client_id%2522%253A%2522iJvTI3hL3m3ZAw3nNvpyciQCDoLVGzqCYYhbDRMmOQI%2522%252C%2522redirect_uri%2522%253A%2522.%2522%252C%2522scope%2522%253A%2522read%2Bwrite%2Bfollow%2Bpush%2522%252C%2522state%2522%253A%2522%2522%257D&response_type=code&scope=api+read_user+read_registry&state=%7B%22client_id%22%3A%22iJvTI3hL3m3ZAw3nNvpyciQCDoLVGzqCYYhbDRMmOQI%22%2C%22redirect_uri%22%3A%22.%22%2C%22scope%22%3A%22read+write+follow+push%22%2C%22state%22%3A%22%22%7D` Note: I couldn't find a publicly reachable Keycloak server for testing so I couldn't yet test the full login sequence (with callback). https://social.stride.press:8080/auth is unreachable — see https://stackoverflow.com/questions/34410707/enabling-remote-access-to-keycloak to open outside world access to it (since request is performed from user's browser). If further assistance is required, pl. provide the URL of your publicly available Keycloak instance and a user / login we can use to test the full sequence. CC @feld
Author
Member

@i1t Thanks for the quick response!

The keycloak instance is publicly accessible at https://cloak.stride.press.

This almost works. I get redirected to pleroma after logging in but then I am greeted by this screen

@i1t Thanks for the quick response! The keycloak instance is publicly accessible at https://cloak.stride.press. This _almost_ works. I get redirected to pleroma after logging in but then I am greeted by this screen ![](https://0x0.st/zM0r.png)
Member

@Pako, I guess it's rather early to say it almost works. :-) https://github.com/Rukenshia/ueberauth_keycloak is an unofficial strategy (not authored by Ueberauth team) and might need debugging. It could also be caused by some incorrect settings.

Could you create a test user at https://cloak.stride.press and provide credentials (including client_id and client_secret for Keycloak instance)? You could email me at ivantashkinov [at] gmail.com.

P.S. Also, could you try other OAuth providers like Twitter to see if they work for your config? I guess they should, just to make sure there's no general OAuth consumer setup error.

CC @feld

@Pako, I guess it's rather early to say it _almost_ works. :-) https://github.com/Rukenshia/ueberauth_keycloak is an unofficial strategy (not authored by Ueberauth team) and might need debugging. It could also be caused by some incorrect settings. Could you create a test user at https://cloak.stride.press and provide credentials (including `client_id` and `client_secret` for Keycloak instance)? You could email me at ivantashkinov [at] gmail.com. P.S. Also, could you try other OAuth providers like Twitter to see if they work for your config? I guess they should, just to make sure there's no general OAuth consumer setup error. CC @feld
Member

@Pako, debugged the issue, sign-in and registration via Keycloak works for me now, with adjusted settings from #4633/diffs, specifically this:

config :ueberauth, Ueberauth,
  providers: [
    keycloak: {Ueberauth.Strategy.Keycloak, [uid_field: :email]}
  ]
@Pako, debugged the issue, sign-in and registration via Keycloak works for me now, with adjusted settings from https://git.pleroma.social/pleroma/pleroma/pulls/4633/diffs, specifically this: ``` config :ueberauth, Ueberauth, providers: [ keycloak: {Ueberauth.Strategy.Keycloak, [uid_field: :email]} ] ```
Member

Resolved via #4633. CC @Pako

Resolved via https://git.pleroma.social/pleroma/pleroma/pulls/4633. CC @Pako
Sign in to join this conversation.
No milestone
No project
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pleroma/pleroma#939
No description provided.