Comments (3)
I cannot see how i could possibly help when i know it's something to do with the way you have your sessions set up or cookies and i don't see your whole setup :)
from node-openid-client.
thx for your reply
this my app.js
const express = require('express');
const path = require('path');
const favicon = require('serve-favicon');
const logger = require('morgan');
const request = require('request');
const fs = require('fs');
const cookieParser = require('cookie-parser');
const session = require('cookie-session');
const bodyParser = require('body-parser');
const index = require('./routes/index');
const auth = require('./routes/auth');
const passport = require('passport');
const Strategy = require('openid-client').Strategy;
const Issuer = require('openid-client').Issuer;
const app = express();
// view engine setup
app.set('views', path.join(__dirname, 'views'));
app.set('view engine', 'pug');
// uncomment after placing your favicon in /public
//app.use(favicon(path.join(__dirname, 'public', 'favicon.ico')));
app.use(logger('dev'));
app.use(bodyParser.json());
app.use(bodyParser.urlencoded({extended: false}));
app.use(cookieParser());
app.use(session({ secret: 'foo', resave: false, saveUnitialized: true, cookie: { secure: false } }));
Issuer.discover('https://oidc')
.then(idSrvIssuer => {
const client = new idSrvIssuer.Client({
client_id: 'client_id',
client_secret: 'client'
});
const params = {
redirect_uri: 'https:/url/auth/sso/callback',
scope: 'openid profile'
};
passport.use('oidc', new Strategy({client, params}, (tokenset, userinfo, done) => {
// **NEVER GET HERE**
console.log(session);
if (tokenset.claims.role !== 'role') {
const err = new Error('Not Authorized');
console.log(err);
return done(null, false);
}else {
return done(null, userinfo);
}
}));
})
.catch(ex => {
console.log(ex)
});
passport.serializeUser(function (user, done) {
done(null, user);
});
passport.deserializeUser(function (user, done) {
done(null, user);
});
app.use(passport.initialize());
app.use(passport.session()); // persistent login sessions
app.use('/static', express.static(path.join(__dirname, '/public/static')));
app.get('/', function (req, res, next) {
if (req.isAuthenticated()) {
res.sendFile(path.resolve(__dirname, 'public/index.html'));
} else {
res.redirect('/auth/sso/login');
}
});
app.use('/api/v1/', index);
app.use('/auth/sso/', auth);
// catch 404 and forward to error handler
app.use(function (req, res, next) {
const err = new Error('Not Found');
err.status = 404;
next(err);
});
// error handler
app.use(function (err, req, res, next) {
// set locals, only providing error in development
res.locals.message = err.message;
res.locals.error = req.app.get('env') === 'development' ? err : {};
// render the error page
res.status(err.status || 500);
res.render('error');
});
module.exports = app;
and this is the router file auth.js
const express = require('express');
const router = express.Router();
const passport = require('passport');
router.get('/callback', passport.authenticate('oidc', { successRedirect: '/', failureRedirect: '/auth/sso/failure' }));
router.get('/failure', function (req, res) {
res.status(403).send('login failed');
});
router.get('/login', passport.authenticate('oidc'));
module.exports = router;
from node-openid-client.
As i suspected, the problem is somewhere within your environment. The following gist for me works just fine and i get to the oidc claims with no issues whatsoever. What i find strange is your redirect uri. And your session cookie should be secure if you're using https...
And it's also entirely possible your OP is not sending the state back unmodified and then that's the actual problem, but that's why the assertion is in place.
from node-openid-client.
Related Issues (20)
- Passport strategy broken with iss in authentication request HOT 3
- JWT signature error validations aren't passed through
- Need option for verify AZP when AUD is an array
- Device flow with GitHub does not continue to poll HOT 3
- Auth server and Postman non-conforming? HTTP Basic Auth x-www-form-urlencoded HOT 2
- Client.userinfo does not accept other header than Authorization HOT 3
- Always return an error saying please use an absolute URL HOT 1
- Low-level errors during `Issuer.discover()` cause error without stack trace
- OAuth 2.0 Device Authorization Grant (Device Flow) - poll without PKCE HOT 3
- Type checking httpOptions and rejectUnauthorized
- RPError thrown when IdToken JWE Header enc is blank HOT 2
- client won't run under `edge` runtime HOT 1
- Support setting client_secret to an empty string when using client_secret_basic or client_secret_post HOT 1
- Cannot assign to read only property 'dpopProof' of object '#<Client>' HOT 2
- Unsuccessful Callback to Unknow client side error HOT 10
- isKeyObject check fails in Bun HOT 5
- Scope delimiter replace problem HOT 2
- Multiple authenticate requests from the same session causes state mismatch HOT 1
- Can't authenticate when the server advertises authorization_response_iss_parameter_supported HOT 2
- Requests made without Accept-Encoding header HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from node-openid-client.