Can't login with openid (keycloak) #70

New Issue

bdeb1337 · 2021-11-29T15:31:09Z

bdeb1337 commented

2021-11-29 15:31:09 +00:00

Hi!

While testing out vikunja, I was trying to give the desktop application a go. However when I try to login to my instance, I keep on getting the following error after completing my login:

I'm using openid to authenticate through my keycloak instance, and it's working fine in browser at the moment.

My config.yml and keycloak settings are as following:

service:
  # The URL of the frontend, used to send password reset emails.
  frontendurl: "https://vikunja.example.com"

auth:
  local:
    enabled: false
  openid:
    enabled: true
    #redirecturl: vikunja.example.com
    providers:
      - name: example.com
        authurl: https://idp.example.com/auth/realms/master
        clientid: vikunja
        clientsecret: my-keycloak-secret-pass-phrase

Not really sure how to go about debugging this further.

Thank you kindly for your time and answer.

Kind regards.

Hi! While testing out vikunja, I was trying to give the desktop application a go. However when I try to login to my instance, I keep on getting the following error after completing my login: ![image](/attachments/d958b085-aa49-4061-8f7f-cf4cfbb490ee) I'm using openid to authenticate through my keycloak instance, and it's working fine in browser at the moment. My config.yml and keycloak settings are as following: ``` service: # The URL of the frontend, used to send password reset emails. frontendurl: "https://vikunja.example.com" auth: local: enabled: false openid: enabled: true #redirecturl: vikunja.example.com providers: - name: example.com authurl: https://idp.example.com/auth/realms/master clientid: vikunja clientsecret: my-keycloak-secret-pass-phrase ``` ![image](/attachments/1cd4cb52-b38b-4a36-ac5d-e1ef42eafd9e) Not really sure how to go about debugging this further. Thank you kindly for your time and answer. Kind regards.

image.png

23 KiB

image.png

51 KiB

konrad commented

2021-11-29 20:14:31 +00:00

Just to verify, these are the steps you're doing?

Open the desktop app
Enter the api url of your instance
Click on "Login with example.com"
Enter credentials in Keycloak
Get redirected to the error in the screenshot

All happening in the app shell, with no browsers etc opening in between?

Just to verify, these are the steps you're doing? 1. Open the desktop app 2. Enter the api url of your instance 3. Click on "Login with example.com" 4. Enter credentials in Keycloak 5. Get redirected to the error in the screenshot All happening in the app shell, with no browsers etc opening in between?

bdeb1337 commented

2021-11-29 20:51:18 +00:00

Yes, that's exactly the flow of how this happens for me.

And indeed: All the redirects happen inside the application (no pop-ups or extra screens), without any external browser or anything opening.

Yes, that's exactly the flow of how this happens for me. And indeed: All the redirects happen inside the application (no pop-ups or extra screens), without any external browser or anything opening.

konrad commented

2021-11-29 20:55:06 +00:00

What api and desktop app version are you using?

bdeb1337 commented

2021-11-29 21:02:05 +00:00

docker:latest for the api, which i guess was 0.18.1 and also the desktop app 0.18.1.

konrad commented

2021-12-05 15:20:52 +00:00

Can confirm this is reproducable with the latest unstable as well.

konrad referenced this issue from vikunja/frontend

2021-12-05 15:40:41 +00:00

feat: build openid redirect url dynamically #1144

konrad commented

2021-12-05 15:45:06 +00:00

Looks like this is a bit tricky to solve: Because the redirect url from the third party provider is used instead of the one from the desktop app directly, you actually get redirected to the frontend running on your server, not the one running in the electron shell. Because the frontend has never seen the state at that point, you get the mentioned error.

Attempt to fix in vikunja/frontend#1144 but I still had issues with it while testing with gitlab. Using that fix you'd need to add http://127.0.0.1:45735/ to the valid redirects or allow arbitrary redirects to any host after authenticating (not sure if keycloak can do that?).

Looks like this is a bit tricky to solve: Because the redirect url from the third party provider is used instead of the one from the desktop app directly, you actually get redirected to the frontend running on your server, not the one running in the electron shell. Because the frontend has never seen the state at that point, you get the mentioned error. Attempt to fix in https://kolaente.dev/vikunja/frontend/pulls/1144 but I still had issues with it while testing with gitlab. Using that fix you'd need to add `http://127.0.0.1:45735/` to the valid redirects or allow arbitrary redirects to any host after authenticating (not sure if keycloak can do that?).

This repo is archived. You cannot comment on issues.