OAuth profile error

rtdany10 · August 21, 2020, 7:52am

https://mydomainhere/api/method/frappe.integrations.oauth2.openid_profile returns json value when I access it from my browser but when my third party app does, it throws an error

InternalOAuthError: Failed to fetch user profile
(Taken from docker logs)

What could be the reason, please guide.
@revant_one

revant_one · August 21, 2020, 8:43am

Try curl with bearer token in header?

refer this test: frappe/test_oauth20.py at develop · frappe/frappe · GitHub

As per this CodiMD Documentation - HackMD default scope is email, referring (OAuth Redirect URI not working - #5 by rtdany10)

can you change that to openid and all or add email to scope field separated by space in OAuth Client on your frappe/erpnext server

rtdany10 · August 21, 2020, 10:23am

I tried using Postman, it failed.
The get token API call returns Session Expired even though I just logged in.

And yes, I have been using openid as scope from the beginning(changed the env accordingly).

Also, my erpnext is on frappe cloud, if that matters.

revant_one · August 21, 2020, 10:55am

Is Frappe added as social login (no need to enable)? How to setup OAuth 2?
related fix: Use SameSite=Lax instead of SameSite=Strict by adityahase · Pull Request #11035 · frappe/frappe · GitHub
Try curl instead of postman, I’ve seen forum posts where curl works but postman fails.

rtdany10 · August 21, 2020, 11:10am

Yes, added. I’m able to login as well in the screen and then I get the Allow/Deny screen as well.

Yes, I have the same issue. My postman logs show my sid as Guest.
The pull-request seemed to be merged. I can’t update since I’m on cloud. I will try on my local machine and report back.

If the above one is my problem, I’m not sure if using curl will fix it. But, I’ll give it a try anyway!

Thank you so much for your help! Much appreciated!

rtdany10 · August 21, 2020, 12:16pm

Update: I just checked the version and my frappe framework is up to date.

I tried curl and it returned HTML code.

curl https://mydomainhere/api/method/frappe.integrations.oauth2.authorize?response_type=code&client_id=<removed>&scope=openid&redirect_uri=https://myotherdomainhere/auth/oauth2/callback

It threw HTML code on my terminal(expected because I’m not logged in on from that server)

If I normally put the link in my browser, it redirects me to:
https://myotherdomainhere/auth/oauth2/callback?code=<code-here>

And I took that code and tried to get token with it, but I get invalid_grand error.

rtdany10 · August 21, 2020, 12:26pm

Although it was merged, I don’t see it in the latest version’s code.

github.com

frappe/frappe/blob/4b4894f7142d65b3fade1fb84bd189c8ffa3d28a/frappe/auth.py#L334


      
          	def init_cookies(self):
          		if not frappe.local.session.get('sid'): return
          
          		# sid expires in 3 days
          		expires = datetime.datetime.now() + datetime.timedelta(days=3)
          		if frappe.session.sid:
          			self.cookies["sid"] = {"value": frappe.session.sid, "expires": expires}
          		if frappe.session.session_country:
          			self.cookies["country"] = {"value": frappe.session.get("session_country")}
          
          	def set_cookie(self, key, value, expires=None):
          		self.cookies[key] = {"value": value, "expires": expires}
          
          	def delete_cookie(self, to_delete):
          		if not isinstance(to_delete, (list, tuple)):
          			to_delete = [to_delete]
          
          		self.to_delete.extend(to_delete)
          
          	def flush_cookies(self, response):
          		for key, opts in self.cookies.items():

It is in the develop branch tho

I guess I will have to wait until they push another update as I can’t do anything on the back end on frappe cloud.

rtdany10 · August 21, 2020, 3:16pm

Update: I was able to authenticate with postman. I changed client authentication setting in postman from send as basic auth header to send client credentials in body.

As said in this thread.

Now, I have to find a way to add this configuration in CodiMD
@revant_one Thanks for the help!

Also, is there any way I can make the authorization work for send as basic auth header?
Please guide.

revant_one · August 21, 2020, 4:12pm

Frappe doesn’t require client secret.

github.com

frappe/frappe/blob/develop/frappe/tests/test_oauth20.py#L59


      
          		)
          
          
	def delete(self, path, **kwargs) -> TestResponse:
          		return make_request(target=self.TEST_CLIENT.delete, args=(path,), kwargs=kwargs, site=self.site)
          
          

          
class TestOAuth20(FrappeRequestTestCase):
          	site = frappe.local.site
          
          
	@classmethod
          	def setUpClass(cls):
          		super().setUpClass()
          		make_test_records("User")
          
          
		cls.form_header = {"content-type": "application/x-www-form-urlencoded"}
          		cls.scope = "all openid"
          		cls.redirect_uri = "http://localhost"
          
          
		# Set Frappe server URL reqired for id_token generation
          		frappe_login_key: "SocialLoginKey" = frappe.new_doc("Social Login Key")
          		frappe_login_key.get_social_login_provider("Frappe", initialize=True)

~~and any header should work.~~

Header like Authorization: Basic base64(client_id:client_secret) triggers frappe to check username and password instead of client_id and client_secret.

rtdany10 · August 22, 2020, 5:14am

I followed this documentation: OAuth 2

Get token API call returns this error.

Traceback (most recent call last):
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/app.py", line 64, in application
    response = frappe.api.handle()
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/api.py", line 59, in handle
    return frappe.handler.handle()
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/handler.py", line 24, in handle
    data = execute_cmd(cmd)
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/handler.py", line 63, in execute_cmd
    return frappe.call(method, **frappe.form_dict)
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/__init__.py", line 1054, in call
    return fn(*args, **newargs)
  File "/home/frappe/benches/bench-version-12-f1-71/apps/frappe/frappe/integrations/oauth2.py", line 111, in get_token
    headers, body, status = get_oauth_server().create_token_response(uri, http_method, body, headers, frappe.flags.oauth_credentials)
  File "/home/frappe/benches/bench-version-12-f1-71/env/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/endpoints/base.py", line 116, in wrapper
    return f(endpoint, uri, *args, **kwargs)
  File "/home/frappe/benches/bench-version-12-f1-71/env/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/endpoints/token.py", line 96, in create_token_response
    self.validate_token_request(request)
  File "/home/frappe/benches/bench-version-12-f1-71/env/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/endpoints/token.py", line 122, in validate_token_request
    self._raise_on_bad_method(request)
  File "/home/frappe/benches/bench-version-12-f1-71/env/lib/python3.6/site-packages/oauthlib/oauth2/rfc6749/endpoints/base.py", line 84, in _raise_on_bad_method
    description=('Unsupported request method %s' % request.http_method.upper()))
oauthlib.oauth2.rfc6749.errors.InvalidRequestError: (invalid_request) Unsupported request method GET <oauthlib.Request SANITIZED>

revant_one · August 22, 2020, 5:22am

/api/method/frappe.integrations.oauth2.get_token is a POST request with Content-Type: application/x-www-form-urlencoded

github.com

frappe/frappe/blob/develop/frappe/tests/test_oauth20.py#L67


      
          
          
	@classmethod
          	def setUpClass(cls):
          		super().setUpClass()
          		make_test_records("User")
          
          
		cls.form_header = {"content-type": "application/x-www-form-urlencoded"}
          		cls.scope = "all openid"
          		cls.redirect_uri = "http://localhost"
          
          
		# Set Frappe server URL reqired for id_token generation
          		frappe_login_key: "SocialLoginKey" = frappe.new_doc("Social Login Key")
          		frappe_login_key.get_social_login_provider("Frappe", initialize=True)
          		frappe_login_key.base_url = frappe.utils.get_url()
          		frappe_login_key.enable_social_login = 0
          		frappe_login_key.insert(ignore_if_duplicate=True)
          		frappe.db.commit()
          
          
	def setUp(self):
          		self.TEST_CLIENT = get_test_client()
          		self.oauth_client = frappe.new_doc("OAuth Client")

rtdany10 · August 22, 2020, 5:26am

Yes, but so is /api/method/frappe.integrations.oauth2.authorize and it works fine on the browser and redirects to the url with a code.

According to this documentation, the api call should return a json response.

I’m confused.

revant_one · August 22, 2020, 5:29am

HTTP Method POST.

typing url in browser and pressing enter results into GET request

rtdany10 · August 22, 2020, 6:02am

Even when I tried POST, it threw error.
The error was because the details were passed as request params. When I passed the details in the request body, it gave back a json response saying invalid grant.

I guess I will have to modify CodiMD’s post request and include the details in the body and not in the params.

Thank you @revant_one

Also, @rmeyer please modify the Oauth 2 documentation(OAuth 2) as browser requests are GET and not POST.

rtdany10 · August 22, 2020, 10:53am

It works fine now. There were some misconfiguration on the client side.
The client was looking for keys which weren’t present in the response. Once I fixed it, everything got alright.

Really sorry for taking up a lot of you time. And thank you once again!

rmeyer · August 23, 2020, 9:32pm

That’s right, authorize should be a GET request. Feel free to send a PR to fix the docs and tag me for the review.