redirect_uri protocol mismatch (behind HAProxy, LinkedIn provider)

[marko-rbn]

Greetings,

My application is behind a proxy which handles all SSL support, so the application itself is set up as non-secure website in IIS. When sign-in request goes out to LinkedIn, the "redirect_uri" uses "http://" prefix, but LinkedIn expects "https://". According to your code, looks like Request.Scheme is being used to set the protocol part. I tried using ProxyHost option, but that doesn't accept the protocol part (it's still prepended with "http://").

ProxyProtocol option would have been a useful feature, or allowing to override the protocol in ProxyHost ;) What solution would you recommend that would override "redirect_uri" in the request to incorporate "https"?

Thanks!

[TerribleDev]

Does the proxy send an X-Forwarded-Proto header? If so, then if I were you, I would write a middleware or one probably exist anyway, just set the requests protocol to be that had value. You likely have other features in MVC that probably don't work properly without doing that.

[marko-rbn]

Adding the code below at the beginning of ConfigureAuth fixed the redirect_url, thanks. But now I'm getting an apologetically sounding error from LinkedIn: "Your LinkedIn Network Will Be Back Soon We’ve notified our operations staff that you are having a problem reaching LinkedIn." - any idea what's that's all about?

app.Use(async (context, next) => { var httpContextWrapper = context.Environment["System.Web.HttpContextBase"] as HttpContextWrapper; string proxyProto = httpContextWrapper.Request.ServerVariables["HTTP_X_FORWARDED_PROTO"]; if (!proxyProto.IsNullOrWhiteSpace()) { context.Request.Scheme = proxyProto; } await next.Invoke(); });

[TerribleDev]

can you use the api through the proxy with just postman?

[marko-rbn]

Thanks will try postman next week. I've also opened a case with LinkedIn support, so see if they have any suggestions.

[marko-rbn]

Sorry to come back again, I really appreciate your help with this. I got the proxy issue figured out. I don't know if there's anything to test with Postman. The application generates a GET request when LinkedIn login button is pressed, and LinkedIn responds with an error - I'm not even getting to the part where I would enter credentials.

Here's my application, really basic: https://linkedin-poc-soren.dppl.com/Account/Login (press LinkedIn button on the right, with Inspector open)

[marko-rbn]

Hello again, still trying to figure this out. I found this post about scope today:
https://community.auth0.com/t/the-linkedin-login-is-deprecated-updating-to-the-new-scopes-is-necessary/113696

Could this have something to do with the malfunction I'm experiencing? I tried replacing the value of "scope" variable in my link, but that didn't help. Maybe there's something more that needs to be done.

For comparison, here's a working link that I found on an unrelated site:
https://www.linkedin.com/oauth/v2/authorization?client_id=863bdlfg7be5zh&state=eyJTdGF0ZUlkIjoiNjU4MmZlMDVkOTMyMzgxN2FjNmRiZGQ0IiwiR2F0ZXdheUlkIjoiNjEyODE4Njg1YTIwYmQyY2I3NGQzOWFjIn0=&response_type=code&redirect_uri=https://api.breadbutter.io/callback&scope=openid+profile+email&login_hint=&

And this is the one generated by my app:
https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=78yutxjzeqgftr&redirect_uri=https%3A%2F%2Flinkedin-poc-soren.dppl.com%2Fsignin-linkedin&scope=r_liteprofile%2Cr_emailaddress&state=YkajqCAa1EGlqA5JAX1d0M_rI8UBSrfRvZXgpMPZ3UKi__uqT768BG7SrMIDo8TRuX5oGfx9P5kLwn40AY24oSKjhZYp7EMd781Fzst78OWLhY-lduLE1yg0L3H_xXCFt4qY3tFqIZ2Ndm2_JBtkJWrkPhDT5BevVnZKoTWbabo6jn5oUgm-DuOstHTVJFzyJWP4P_e5TGq9RbKC0niz6V8SuJMoHtozKW_cUiLZ98Q

Just out of curiosity I changed scope in the working link to r_liteprofile, and it returned an error.

LinkedIn support is useless if you're not a partner.

[TerribleDev]

Can you reproduce the problem without your proxy?

…

On Wed, Dec 20, 2023 at 10:24 AM marko-rbn ***@***.***> wrote: Hello again, still trying to figure this out. I found this post about scope today: https://community.auth0.com/t/the-linkedin-login-is-deprecated-updating-to-the-new-scopes-is-necessary/113696 Could this have something to do with the malfunction I'm experiencing? I tried replacing the value of "scope" variable in my link, but that didn't help. Maybe there's something more that needs to be done. For comparison, here's a working link that I found on an unrelated site: https://www.linkedin.com/oauth/v2/authorization?client_id=863bdlfg7be5zh&state=eyJTdGF0ZUlkIjoiNjU4MmZlMDVkOTMyMzgxN2FjNmRiZGQ0IiwiR2F0ZXdheUlkIjoiNjEyODE4Njg1YTIwYmQyY2I3NGQzOWFjIn0=&response_type=code&redirect_uri=https://api.breadbutter.io/callback&scope=openid+profile+email&login_hint=& And this is the one generated by my app: https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=78yutxjzeqgftr&redirect_uri=https%3A%2F%2Flinkedin-poc-soren.dppl.com%2Fsignin-linkedin&scope=r_liteprofile%2Cr_emailaddress&state=YkajqCAa1EGlqA5JAX1d0M_rI8UBSrfRvZXgpMPZ3UKi__uqT768BG7SrMIDo8TRuX5oGfx9P5kLwn40AY24oSKjhZYp7EMd781Fzst78OWLhY-lduLE1yg0L3H_xXCFt4qY3tFqIZ2Ndm2_JBtkJWrkPhDT5BevVnZKoTWbabo6jn5oUgm-DuOstHTVJFzyJWP4P_e5TGq9RbKC0niz6V8SuJMoHtozKW_cUiLZ98Q Just out of curiosity I changed scope in the working link to r_liteprofile, and it returned an error. LinkedIn support is useless if you're not a partner. — Reply to this email directly, view it on GitHub <#524 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA2MVWHI3AVIYF2WCRANQCDYKL7K5AVCNFSM6AAAAABAM7FWTCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNRUGY3DIMZSGI> . You are receiving this because you commented.Message ID: ***@***.***>

[marko-rbn]

I moved the app to my local PC (no proxy) and I still get the same error. Looking at the registered application on LinkedIn, I see that OAuth2.0 Scopes "no permissions added". And I'm not able to modify that.

Under (additional) Products tab, the closest thing I found is "Sign In with LinkedIn using OpenID Connect" - Standard Tier - whatever that means. There's no longer a plain "Sign in with LinkedIn" product, like this post describes: https://stackoverflow.com/questions/62390915/cant-add-oauth-2-0-scopes-linkedin

Also led me to this page: https://docs.pathfix.com/integrating-with-linkedin

For V1, the login basic scopes will be r_liteprofile r_emailaddress w_member_social
For V2, the login basic scopes will be openid profile email

I wonder if they only support OpenID now.

[marko-rbn]

So, I added the product "Sign In with LinkedIn using OpenID Connect" to application registration. And now have scopes openid/profile/email listed. Then I used the link generated by your library, and changed "scope" value from "r_liteprofile,r_emailaddress" to "openid+profile+email", and the error was gone, it loaded the LinkedIn login form.

then I tried to overwrite Scope option in my code:

            app.UseLinkedInAuthentication(new LinkedInAuthenticationOptions()
            {
                ClientId = "***",
                ClientSecret = "***",
                Scope = { "openid", "profile", "email" }
            });

But that simply appended the new values to existing r_* scope items. Looks like those may be hard-coded in your LinkedIn library.

[marko-rbn]

Hello TerribleDev, hope you had a nice break. Have you had a chance to look at the code? I think if I only had the ability to completely overwrite Scope, that could potentially solve the problem. Unless you see some other issues. Thanks.