peertube-plugin-auth-openid-connect: authorization flow uses PKCE which is considered invalid by Hydra when the client has a secret
Hi.
I’m using Ory Hydra (an OIDC provider) and I’m unable to login using peertube-plugin-auth-openid-connect
because the state
query parameter is not set in the authentication request.
The authentication process automatically ends with:
[peertube.br0.fr:443 peertube-plugin-auth-openid-connect] 2020-12-23 01:38:47.341 error: Error in handle callback. {
"err": {
"message": "invalid_state (The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure sufficien
t entropy.)",
"name": "OPError",
"stack": "OPError: invalid_state (The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure su
fficient entropy.)\n at Client.callback (/data/plugins/node_modules/openid-client/lib/client.js:418:13)\n at handleCb (/data/plugins/node_modules/peertube-plugin-auth-openid-connect/main.js:226:41)\n at
process._tickCallback (internal/process/next_tick.js:68:7)",
"error": "invalid_state",
"error_description": "The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure sufficient ent
ropy."
}
}
[peertube.br0.fr:443] 2020-12-23 01:38:47.344 info: 192.168.0.0 - - [23/Dec/2020:01:38:47 +0000] "GET /plugins/auth-openid-connect/router/code-cb?error=invalid_state&error_description=The+state+is+missing+or+does
+not+have+enough+characters+and+is+therefore+considered+too+weak%0A%0ARequest+parameter+%22state%22+must+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&error_hint=Request+parameter+%22state%22+mus
t+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&state= HTTP/1.1" 302 102 "https://peertube.br0.fr/" "Firefox"
This might be an upstream issue, but there’s been quite a few version of openid-client
since 3.15.0 and version 4.2.1 seems to fix a related issue so I wanted to check with you first.
I’ve had a look at the code but can’t figure out what’s missing. Also, I’m not sure how I can test this plugin. Is there a way to “build” a plugin and manually install it?
Edited by Johan Fleury (Arcaik)