Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix failing Elixir AAI token refresh #927

Closed
wants to merge 1 commit into from
Closed

Fix failing Elixir AAI token refresh #927

wants to merge 1 commit into from

Conversation

kysrpex
Copy link

@kysrpex kysrpex commented Jul 24, 2024

Proposed changes

Refreshing Elixir AAI tokens fails with error An error occurred when refreshing user token: 401 Client Error: 401 for url: https://login.elixir-czech.org/oidc/token. The source of the HTTP 401 error is a malformed request. Closes #826, read the issue for details.

Types of changes

Please check the type of change your PR introduces:

  • Release (new release request)
  • Bugfix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Code style update (PEP8, lint, formatting, renaming, etc)
  • Refactoring (no functional changes, no api changes)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Build related changes (build process, tests runner, etc)
  • Other (please describe):

Checklist

Put an x in the boxes that apply. You can also fill these out after creating
the PR. If you're unsure about any of them, don't hesitate to ask. We're here to
help! This is simply a reminder of what we are going to look for before merging
your code.

Other information

At the moment I just want to highlight the source of the problem and the solution, the patch is not properly integrated within the codebase, that's why the PR is a draft. For example, it is probably better to patch social_core.backends.oauth:BaseOAuth2.refresh_token.

@kysrpex
Fix failing Elixir AAI token refresh
4fd6943 
Refreshing Elixir AAI tokens fails with error `An error occurred when refreshing user token: 401 Client Error: 401 for url: https://login.elixir-czech.org/oidc/token`. The source of the HTTP 401 error is a malformed request.

social-auth-core is sending this sort of request (a few headers are omitted)

```
POST /oidc/token HTTP/1.1
Host: login.elixir-czech.org
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Content-Length: ***

{"grant_type": "refresh_token", "refresh_token": "******", "client_id": "******", "client_secret": "******"}
```

and getting this sort of response (again some headers are omitted).

```
HTTP/1.1 401 401
Content-Type: application/json

{"error":"invalid_client","error_description":"Bad client credentials"}
```

If the requests are modified so that they look like it is described in RFC6749 (https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1)

```
POST /oidc/token HTTP/1.1
Host: login.elixir-czech.org
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Content-Length: ***

grant_type=refresh_token&refresh_token=******&client_id=******&client_secret=******
```

then everything works smoothly.
@nijel nijel mentioned this pull request Jul 24, 2024
Open
@dBucik
Copy link

dBucik commented Jul 25, 2024 •
edited
Loading

From the OP point of view, the authentication method for the token endpoint should be configurable and the refresh token grant should respect that setting.
Specifically for the LS AAI (previously known as ELIXIR AAI), there are three types of authentication for the token endpoint:

  • client_secret_basic (translates to Authorization: Basic client_id:client_secret header)
  • client_Secret_post (translates to client_id: XYZ and client_secret: XYZ parameters in the POST request body)
  • none (no authentication needed)

This method of authentication is specified in the metadata when registering the service.

So now to some more details.
I think base classes support this already, it just needs some tweaks:

@kysrpex kysrpex closed this Jul 26, 2024
@kysrpex kysrpex deleted the fix_elixir_token_refresh branch July 26, 2024 13:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

OAuth2 grant type refresh_token sends the access token when no refresh token is available
2 participants
@kysrpex @dBucik