OIDC connexion issue ( notice=state-mismatch )

[b0g]

Hello,

I’m installing outline self-host for my company : We’re using odoo (especialy this module for OIDC : https://odoo-community.org/shop/authentication-openid-connect-6545#attr=25818 )
OpenID is working for another services (nextcloud / rocketchat)

But when running outline I have this strange issue : notice=state-mismatch ?

I wonder if it’s not a DNS configuration issue (like I read in few other discussions) because the error is sending me to a weird address, here is the flow :

1. I’m going to https://outline.mycompany.coop
2. the error is at : https://outline.mycompany.coop:3000/?notice=state-mismatch

In the meantime I can see that the state value is well send back by my OIDC login address

I configured well the URL and PORT in env variables but ... I’m confused, I don’t know what to do next ... Any ideas ?

---

Here’s the log’s error

{"error":"State not return in OAuth flow","level":"error","message":"Error during authentication","stack":"BadRequestError: State not return in OAuth flow\n    at OAuthStateMismatchError (/opt/outline/build/server/errors.js:148:34)\n    at StateStore.verify (/opt/outline/build/server/utils/passport.js:47:61)\n    at OAuth2Strategy.authenticate (/opt/outline/node_modules/passport-oauth2/lib/strategy.js:222:26)\n    at _passportOauth.Strategy.authenticate (/opt/outline/build/plugins/oidc/server/auth/oidc.js:40:26)\n    at attempt (/opt/outline/node_modules/@outlinewiki/koa-passport/node_modules/passport/lib/middleware/authenticate.js:369:16)\n    at authenticate (/opt/outline/node_modules/@outlinewiki/koa-passport/node_modules/passport/lib/middleware/authenticate.js:370:7)\n    at /opt/outline/node_modules/@outlinewiki/koa-passport/lib/framework/koa.js:194:7\n    at new Promise (<anonymous>)\n    at /opt/outline/node_modules/@outlinewiki/koa-passport/lib/framework/koa.js:193:12\n    at /opt/outline/node_modules/@outlinewiki/koa-passport/lib/framework/koa.js:143:7\n    at new Promise (<anonymous>)\n    at passportAuthenticate (/opt/outline/node_modules/@outlinewiki/koa-passport/lib/framework/koa.js:107:15)\n    at passportMiddleware (/opt/outline/build/server/middlewares/passport.js:76:7)\n    at /opt/outline/node_modules/dd-trace/packages/datadog-instrumentations/src/koa.js:88:57\n    at passportMiddleware (/opt/outline/node_modules/dd-trace/packages/datadog-shimmer/src/shimmer.js:26:21)\n    at dispatch (/opt/outline/node_modules/koa-router/node_modules/koa-compose/index.js:44:32)\n    at next (/opt/outline/node_modules/koa-router/node_modules/koa-compose/index.js:45:18)\n    at /opt/outline/node_modules/koa-router/lib/router.js:346:16\n    at dispatch (/opt/outline/node_modules/koa-router/node_modules/koa-compose/index.js:44:32)\n    at next (/opt/outline/node_modules/koa-router/node_modules/koa-compose/index.js:45:18)\n    at /opt/outline/node_modules/@outlinewiki/koa-passport/lib/framework/koa.js:60:14\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)"}

Thank’s for your help

[tommoor]

The URL configuration should not include a port number in a production setup

[b0g]

Yes, but it’s not the case, should I define PORT to 80 or 443 ?

[b0g]

Hello, Back on tracks !

I workaround my first issue (I hope) But i’m hitting a new one... I think maybe you are bored to answer "use openssl" ... So I promise I checked all my secrets first

I have this issue :

outline-1       | {"label":"http","level":"info","message":"  --> GET /auth/oidc 302 3ms 0b"}
outline-1       | {"label":"http","level":"info","message":"  <-- GET /auth/oidc.callback?state=2e86963a2c62c032&code=eyJhbGciOiJIUzI1NiIsImtpZCI6IkJnWk1pS09oSm5HdjRidFgifQ.eyJjbGllbnRfaWQiOiJtcGhzamxrYXFoeW1kcGp6IiwiZXhwIjoxNzEyMTUyNzEwLCJyZWRpcmVjdF91cmkiOiJodHRwczovL291dGxpbmVkb2NrZXIuZGV2MS5lbGFib3JlLmNvb3AvYXV0aC9vaWRjLmNhbGxiYWNrIiwic2NvcGVzIjpbIm9wZW5pZCJdLCJzaWQiOiJkN2RjYjU1NDRmMzc3ZmEyM2QwNzJmNWQ5OTUwNjYyZmY0NWNkYjQ3IiwidXNlcl9pZCI6NTd9.6FGvMKgvDFE2OCvucnxHfofPUYVzyvrEO36pNx8o8q4"}
outline-1       | {"error":"Failed to parse response from https://mycompany.coop/oauth/userinfo. Expected JSON, got: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>400 Bad Request</title>\n<h1>Bad Request</h1>\n<p>Invalid JSON data: ''</p>\n","level":"error","message":"Error during authentication","stack":"InternalServerError: Failed to parse response from https://elabore.coop/oauth/userinfo. Expected JSON, got: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>400 Bad Request</title>\n<h1>Bad Request</h1>\n<p>Invalid JSON data: ''</p>\n\n    at InternalError (/opt/outline/build/server/errors.js:37:34)\n    at request (/opt/outline/build/server/utils/passport.js:80:37)\n    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at async _passportOauth.Strategy.userProfile (/opt/outline/build/plugins/oidc/server/auth/oidc.js:24:22)"}

I simplify it :

• When after having the callback from oidc with state and code :
  -> It’s calling userinfo

BUT my /userinfo page is saying : Invalid Json data: '' <- empty
Expected JSON, got: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<title>400 Bad Request</title>\n<h1>Bad Request</h1>\n<p>Invalid JSON data: ''

It’s like if it’s sending something empty. I would like to debug it myself but i’m not very .ts fluent

Am I missing something ?

Thank’s a lot

Boris

[tommoor]

Outline makes a GET request to the specified userinfo endpoint, it doesn't contain any parameters at all and is expected to return a JSON object with the current users information, this is part of the standard.

Looking at the source for the OIDC provider you're using, it doesn't seem to implement a userinfo endpoint that I can see. Where did you get the /oauth/userinfo endpoint from?

https://github.com/OCA/server-auth/blob/16.0/auth_oidc/README.rst

[b0g]

It should have some access-token with the GET request no ?

Oh, maybe the module I’m using is not really standard ... There it is https://apps.odoo.com/apps/modules/10.0/galicea_openid_connect/

# -*- coding: utf-8 -*-

from odoo import http
from odoo.addons.galicea_openid_connect.api import resource

class ExternalAPI(http.Controller):
    @resource('/oauth/userinfo', method='GET')
    def userinfo(self, req, **query):
        user = req.env.user
        return {
            'sub': str(user.id),
            'name': user.name,
            'email': user.email
        }

(note that this particular endpoint is bundled into galicea_openid_connect add-on). The client can then call this endpoint with either a header that looks like Authorization: Bearer <token> or &access_token=<token> query parameter.

$ curl --header 'Authorization: Bearer 9Dkv2W...gzpz' '<odoo-base-url>/oauth/userinfo'

{"email": false, "sub": "1", "name": "Administrator"}

It seem’s to be regular according to what I read in the standard documentation.

Where can I put some print or console.log to watch if the GET is send with an authorization-token ?

It seem’s that :

• When i’m going to the endpoint : oauth/userinfo without token the answer is : {"error": "invalid_request", "error_message": "error: access_token param is missing"}
• When i’m givin a random access token the error is : {"error": "invalid_request", "error_message": "error: access_token is invalid"}

So It seem’s that the token given by outline is correct ... or something else is happening.
Do you have an idea ?

I try to tcpdump inside the container but it’s a bit beyond my level of knowledge (I don’t know how to analyse then...)