Skip to content

GitLab

  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • O official-plugins
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
  • Issues 15
    • Issues 15
    • List
    • Boards
    • Service Desk
    • Milestones
  • Merge requests 0
    • Merge requests 0
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Repository
  • Wiki
    • Wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Framasoft
  • PeerTube
  • official-plugins
  • Issues
  • #23

Closed
Open
Created Dec 23, 2020 by Johan Fleury (Arcaik)@ArcaikContributor

peertube-plugin-auth-openid-connect: authorization flow uses PKCE which is considered invalid by Hydra when the client has a secret

Hi.

I’m using Ory Hydra (an OIDC provider) and I’m unable to login using peertube-plugin-auth-openid-connect because the state query parameter is not set in the authentication request.

The authentication process automatically ends with:

[peertube.br0.fr:443 peertube-plugin-auth-openid-connect] 2020-12-23 01:38:47.341 error: Error in handle callback. {
  "err": {
    "message": "invalid_state (The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure sufficien
t entropy.)",
    "name": "OPError",
    "stack": "OPError: invalid_state (The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure su
fficient entropy.)\n    at Client.callback (/data/plugins/node_modules/openid-client/lib/client.js:418:13)\n    at handleCb (/data/plugins/node_modules/peertube-plugin-auth-openid-connect/main.js:226:41)\n    at
process._tickCallback (internal/process/next_tick.js:68:7)",
    "error": "invalid_state",
    "error_description": "The state is missing or does not have enough characters and is therefore considered too weak\n\nRequest parameter \"state\" must be at least be 8 characters long to ensure sufficient ent
ropy."
  }
}
[peertube.br0.fr:443] 2020-12-23 01:38:47.344 info: 192.168.0.0 - - [23/Dec/2020:01:38:47 +0000] "GET /plugins/auth-openid-connect/router/code-cb?error=invalid_state&error_description=The+state+is+missing+or+does
+not+have+enough+characters+and+is+therefore+considered+too+weak%0A%0ARequest+parameter+%22state%22+must+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&error_hint=Request+parameter+%22state%22+mus
t+be+at+least+be+8+characters+long+to+ensure+sufficient+entropy.&state= HTTP/1.1" 302 102 "https://peertube.br0.fr/" "Firefox"

This might be an upstream issue, but there’s been quite a few version of openid-client since 3.15.0 and version 4.2.1 seems to fix a related issue so I wanted to check with you first.

I’ve had a look at the code but can’t figure out what’s missing. Also, I’m not sure how I can test this plugin. Is there a way to “build” a plugin and manually install it?

Edited Dec 23, 2020 by Johan Fleury (Arcaik)
Assignee
Assign to
Time tracking