Sign Up with Social Login

ERPNext
1

I set up a Custom Social Signup with /api/method/frappe.integrations.oauth2_logins.login_via_oauth2.
I enabled under Website settings signup but I still get the following message:

Not Permitted
You do not have enough permissions to complete the action
Status: 403

To give some context: I tried to login/signup with a user from the IDM which isn’t already created in ERPNext. After the user was authenticated the message was shown.
For me this looks like an authorization issue which could be solved somehow in ERPNext.
From the perspektive of the IDM the access was granted so I guess that this is not the issue.

Does someone know what I need to change? I’m very new to ERPNext

2

can you share more details about your social login key

you can skip the id and secret when you share here.

if it’s custom social login key the redirect uri has component that comes from social login key name.

example custom login with custom app: GitHub - castlecraft/microsoft_integration: Microsoft Integrations for Frappe Framework

3

example redirect uri for custom key: /api/method/frappe.integrations.oauth2_logins.custom/{key_name}

4

I replaced the previous redirect uri with the one you mentioned. Now I get a different error:

Traceback (most recent call last):
  File "apps/frappe/frappe/app.py", line 66, in application
    response = frappe.api.handle()
  File "apps/frappe/frappe/api.py", line 54, in handle
    return frappe.handler.handle()
  File "apps/frappe/frappe/handler.py", line 45, in handle
    data = execute_cmd(cmd)
  File "apps/frappe/frappe/handler.py", line 83, in execute_cmd
    return frappe.call(method, **frappe.form_dict)
  File "apps/frappe/frappe/__init__.py", line 1607, in call
    return fn(*args, **newargs)
  File "apps/frappe/frappe/integrations/oauth2_logins.py", line 58, in custom
    login_via_oauth2(provider, code, state, decoder=decoder_compat)
  File "apps/frappe/frappe/utils/oauth.py", line 115, in login_via_oauth2
    info = get_info_via_oauth(provider, code, decoder)
  File "apps/frappe/frappe/utils/oauth.py", line 143, in get_info_via_oauth
    session = flow.get_auth_session(**args)
  File "env/lib/python3.10/site-packages/rauth/service.py", line 556, in get_auth_session
    session = self.get_session(self.get_access_token(method, **kwargs))
  File "env/lib/python3.10/site-packages/rauth/service.py", line 542, in get_access_token
    access_token, = process_token_request(r, decoder, key)
  File "env/lib/python3.10/site-packages/rauth/service.py", line 20, in process_token_request
    data = decoder(r.content)
  File "apps/frappe/frappe/integrations/oauth2_logins.py", line 63, in decoder_compat
    return json.loads(bytes(b).decode("utf-8"))
  File "/usr/local/lib/python3.10/json/__init__.py", line 346, in loads
    return _default_decoder.decode(s)
  File "/usr/local/lib/python3.10/json/decoder.py", line 337, in decode
    obj, end = self.raw_decode(s, idx=_w(s, 0).end())
  File "/usr/local/lib/python3.10/json/decoder.py", line 355, in raw_decode
    raise JSONDecodeError("Expecting value", s, err.value) from None
json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0)
5

I’m using the authentik provider

Base URL: https://id.domain.org/
Authorize URL: /application/o/authorize/
Access Token URL: /application/o/token/
Redirect URL: /api/method/frappe.integrations.oauth2_logins.custom/authentik
API Endpoint: https://id.domain.org/application/o/userinfo/
Auth URL Data: {"scope": "openid profile email", "response_type": "code"}

On the Authentik side i use as redirect url:
https://erp.domain.org/api/method/frappe.integrations.oauth2_logins.custom/authentik

6

This page is the redirect endpoint where you get the error?

Do you see ?state=xyz&code=pqr appended to the url params?

If you see these params then we need to debug the code exchange request and response.

That response is either non 200 or non-json.

The code exchange request is made here frappe/oauth.py at 090c91b44fb116c28d52e440599d9e95d4d00b21 · frappe/frappe · GitHub

7

yes i see:
?code=3d61c2b715a948eeae11cfcb2e00b28d&state=eyJzaXRlIjogImh0dHBzOi8vZXJwLnN5c2VsZi5vcmciLCAidG9rZW4iOiAiZTVmNGE2YmMwMThiYjIwY2U4Nzk5YmIzMmRkZTc4NWYwNzQ3OGI2NDg0ZjRlY2RkZGQxNzcwNWUiLCAicmVkaXJlY3Rfd8iOiBudWgxsfQ%3D%3D

8

can you give me access to authentik test setup somewhere? I’ll debug locally the responses and check.

9

for authentik make sure you’ve a trailing / on token endpoint e.g. /application/o/token/

without it the endpoint returns 301 redirect which is not expected by token request made by frappe.

10

yes i do have the same problem and the trailing / is there what can i do now, i can create an authentik instance for trail purpose if need for u