OAuth2 User Info Failure #1010

drewstinnett · 2019-06-08T13:12:36Z

OAuth2 User Info Failure

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	OSX
TheHive version	3.3.0-1
Package Type	Docker
Browser type & version	Firefox 67.0.1

Problem Description

We are attempting to use the OAuth2 Authentication method implemented in #430, however we are getting an authentication error after the sign-on.

Steps to Reproduce

Go to login page
Click 'Sign in with SSO'
Authenticate with your SSO provider
After authentication happens, a red box with Authentication Failure pops up, and the log message below appears in the log

Complementary information

This is the log we get when the authentication fails

thehive_1        | [error] o.e.s.a.MultiAuthSrv - Authentication failure
thehive_1        | org.elastic4play.AuthenticationError: User info fails:
thehive_1        |      at services.mappers.SimpleUserMapper.getUserFields(SimpleUserMapper.scala:40)
thehive_1        |      at services.mappers.MultiUserMapperSrv.getUserFields(MultiUserMapperSrv.scala:28)
thehive_1        |      at services.OAuth2Srv.$anonfun$getOrCreateUser$1(OAuth2Srv.scala:131)
thehive_1        |      at scala.Option.fold(Option.scala:158)
thehive_1        |      at services.OAuth2Srv.withOAuth2Config(OAuth2Srv.scala:76)
thehive_1        |      at services.OAuth2Srv.getOrCreateUser(OAuth2Srv.scala:130)
thehive_1        |      at services.OAuth2Srv.$anonfun$getAuthTokenAndAuthenticate$5(OAuth2Srv.scala:118)
thehive_1        |      at scala.concurrent.Future.$anonfun$flatMap$1(Future.scala:303)
thehive_1        |      at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
thehive_1        |      at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
thehive_1        | [info] o.e.ErrorHandler - POST /api/ssoLogin?code=REDACTED_CODE returned 401
thehive_1        | org.elastic4play.AuthenticationError: Authentication failure
thehive_1        |      at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$authenticate$6.applyOrElse(MultiAuthSrv.scala:75)
thehive_1        |      at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$authenticate$6.applyOrElse(MultiAuthSrv.scala:71)
thehive_1        |      at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:413)
thehive_1        |      at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
thehive_1        |      at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
thehive_1        |      at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
thehive_1        |      at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
thehive_1        |      at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
thehive_1        |      at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
thehive_1        |      at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)

Our configuration is:

...
  oauth2 {
    clientId = "the-clientid"
    clientSecret = "the-secret"
    redirectUri = "https://thehive-host/index.html#login"
    responseType = "code"
    grantType = "authorization_code"
    authorizationUrl = "https://oauth-host/oidc/authorize"
    tokenUrl = "https://oauth-host/oidc/token"
    userUrl = "https://oauth-host/oidc/userinfo"
    scope = "openid"
  }

   sso {
        mapper = simple
        autocreate = true
        defaultRoles = ["read"]
        attributes {
                login = "sub"
                name = "name"
                }
        }
...

Looking at the code here, it appears that the error should be printed in the log after "User info fails: ", however in our logs nothing is showing up there.

Any help or pointers is appreciated, thank you!

The text was updated successfully, but these errors were encountered:

nadouani · 2019-06-14T07:36:55Z

@To-om Could we add a bit more logs to try figure out what happens there?

ananth07reddy · 2019-06-18T08:21:57Z

I am having the same issue. I am using a 3.4.0-RC1 Hive veversion, please find my logs below:

[error] o.e.s.a.MultiAuthSrv - **Authentication failure**
java.lang.IllegalArgumentException: Invalid URL 
at play.api.libs.ws.ahc.StandaloneAhcWSClient.validate(StandaloneAhcWSClient.scala:84)
at play.api.libs.ws.ahc.StandaloneAhcWSClient.url(StandaloneAhcWSClient.scala:42)
at play.api.libs.ws.ahc.AhcWSClient.url(AhcWSClient.scala:37)
at services.mappers.GroupUserMapper.$anonfun$getUserFields$2(GroupUserMapper.scala:43)
at scala.Option.fold(Option.scala:158)
at services.mappers.GroupUserMapper.getUserFields(GroupUserMapper.scala:43)
at services.mappers.MultiUserMapperSrv.getUserFields(MultiUserMapperSrv.scala:27)
at services.OAuth2Srv.$anonfun$getOrCreateUser$1(OAuth2Srv.scala:123)
at scala.Option.fold(Option.scala:158)
at services.OAuth2Srv.withOAuth2Config(OAuth2Srv.scala:66)
Caused by: java.lang.IllegalArgumentException:  could not be parsed into a proper Uri, missing scheme
at play.shaded.ahc.org.asynchttpclient.uri.Uri.create(Uri.java:40)
at play.shaded.ahc.org.asynchttpclient.uri.Uri.create(Uri.java:32)
at play.api.libs.ws.ahc.StandaloneAhcWSClient.validate(StandaloneAhcWSClient.scala:81)
at play.api.libs.ws.ahc.StandaloneAhcWSClient.url(StandaloneAhcWSClient.scala:42)
at play.api.libs.ws.ahc.AhcWSClient.url(AhcWSClient.scala:37)
at services.mappers.GroupUserMapper.$anonfun$getUserFields$2(GroupUserMapper.scala:43)
at scala.Option.fold(Option.scala:158)
at services.mappers.GroupUserMapper.getUserFields(GroupUserMapper.scala:43)
at services.mappers.MultiUserMapperSrv.getUserFields(MultiUserMapperSrv.scala:27)
at services.OAuth2Srv.$anonfun$getOrCreateUser$1(OAuth2Srv.scala:123)
[info] o.e.ErrorHandler - POST /api/ssoLogin?code=fc0c6142-4056-4017-9ee0-d181a1d27b86.3c566da0-3eb0-4ed2-83c4-6f942fc4462f.ecde927e-733e-4477-b0ff-93238254eaa6 returned 401
org.elastic4play.AuthenticationError: Authentication failure
at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$authenticate$6.applyOrElse(MultiAuthSrv.scala:71)
at org.elastic4play.services.auth.MultiAuthSrv$$anonfun$authenticate$6.applyOrElse(MultiAuthSrv.scala:67)
at scala.concurrent.Future.$anonfun$recoverWith$1(Future.scala:413)
at scala.concurrent.impl.Promise.$anonfun$transformWith$1(Promise.scala:37)
at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
at scala.concurrent.BlockContext$.withBlockContext(BlockContext.scala:81)
at akka.dispatch.BatchingExecutor$BlockableBatch.run(BatchingExecutor.scala:91)

nadouani · 2019-06-18T12:59:13Z

java.lang.IllegalArgumentException: Invalid URL

Please check which property is not a valid URL in your config

ananth07reddy · 2019-06-19T08:39:07Z

I am not able to figure it out that which URL is not valid. But according to default configuration redirect URL is redirecting to the Login page, I don't know why is this. remaining URLs are my OAuth provider related. My config as follows:

auth {
  
  provider = [local, oauth2]

  oauth2 {
  clientId = "hive"
  clientSecret = "***************"
  redirectUri = "http://127.0.0.1:9000/index.html#/login"
  responseType = "code"
  grantType = "authorization_code"
  authorizationUrl = "https://<domain.name>/protocol/openid-connect/auth"
  tokenUrl = "https://<domain.name>/protocol/openid-connect/token"
  userUrl = "https://<domain.name>/protocol/openid-connect/userinfo"
  scope = "openid"
  }

  sso {
    mapper = group
    autocreate = true
    defaultRoles = ["read"]
    autologin = true
    attributes {
        login = "userid"
        name = "preferred_username"
        groups = "groups" // name of the attribute containing the user groups
        }
    groups.mappings { // map groups to roles
          mygroup1= ["read", "write", "admin"]
          mygroup2= ["read", "write"]
          }
    }
}

ananth07reddy · 2019-06-19T08:43:25Z

java.lang.IllegalArgumentException: Invalid URL
Please check which property is not a valid URL in your config

I am not able to figure it out that which URL is not valid. But according to default configuration redirect URL is redirecting to the Login page, I don't know why is this. remaining URLs are my OAuth provider related. My config as follows:

auth {

provider = [local, oauth2]

oauth2 {
clientId = "hive"
clientSecret = "***************"
redirectUri = "http://127.0.0.1:9000/index.html#/login"
responseType = "code"
grantType = "authorization_code"
authorizationUrl = "https://<domain.name>/protocol/openid-connect/auth"
tokenUrl = "https://<domain.name>/protocol/openid-connect/token"
userUrl = "https://<domain.name>/protocol/openid-connect/userinfo"
scope = "openid"
}

sso {
mapper = group
autocreate = true
defaultRoles = ["read"]
autologin = true
attributes {
login = "userid"
name = "preferred_username"
groups = "groups" // name of the attribute containing the user groups
}
groups.mappings { // map groups to roles
mygroup1= ["read", "write", "admin"]
mygroup2= ["read", "write"]
}
}
}

nadouani · 2019-06-19T13:38:48Z

The login page is the callback URL your OAuth provided will call after you authentification. Once you come back to login page, TheHive will use the authorization code to get the authenticated user details and log you in.

nadouani · 2019-06-19T13:39:33Z

The error is clear

Caused by: java.lang.IllegalArgumentException: could not be parsed into a proper Uri, missing scheme

ananth07reddy · 2019-06-19T14:54:02Z

Thanks for the quick reply.
I see the error but I don't understand what should be done to correct an error. it's been really difficult to solve this issue. I have checked the Uris in the config, all are fine. I am clueless to solve this issue.

ananth07reddy · 2019-06-19T16:16:38Z

Simpler Mapping is working fine but Group mapping is not working and throwing an error called invalid URL. Should I pass url for the group in the config like below:
groups {
url = "https://auth-site.com/api/Groups"

nadouani · 2019-06-20T08:38:52Z

@ananth07reddy You need in fact a URL to fetch the user groups as said in your last comment

ananth07reddy · 2019-06-20T14:10:43Z

Thank you for the quick reply. But I am using Keycloak as the identity provider and don't see any group uri to pass like above.

ananth07reddy · 2019-06-21T08:01:35Z

Can you please send me an example full configuration because it is really confusing? I don't see that being used group.url in the config.

drewstinnett · 2019-06-26T14:16:39Z

Are we talking about 2 different issues here? My original issue was about a missing log message, but i think we're delving in to a different stated error message. Just don't want my original to get lost in the shuffle 😁

nadouani · 2019-06-26T14:18:57Z

I agree @drewstinnett

The OAuth feature is something that is not exhaustive, so we discover new use cases every time, new configurations etc...

1earch · 2019-09-05T13:31:41Z

Hi @drewstinnett, I'm working on a PR that will improve OAuth2 support. After a deep study of the OAuth2 code, I think your error is presented when a field can't be found in user info. Could you check that sub and name attributes are received by TheHive when it retreives user info?

auth {
  ...
  sso {
    ...
    attributes {
      login = "sub"
      name = "name"
    }
  }
}

Note: I'm currently fixing the message not showing up in the PR

drewstinnett · 2019-09-25T18:05:22Z

Apologies for the delayed replay @1earch you were exactly right! The "name" attribute wasn't getting passed back. When I adjusted both name and login to "sub", the authentication succeeded, many thanks!

1earch · 2019-09-26T11:00:32Z

Happy to help 🙂
If your issue is fixed, don't hesitate to close it! 😉

nadouani · 2020-06-15T12:34:22Z

Thanks @1earch and @drewstinnett

I'm closing the issue.

nadouani assigned To-om Jun 12, 2019

This was referenced Sep 3, 2019

Improved support for OpenID connect and OAuth2 #1110

Closed

OpenID Connect and OAuth2 sign-on improvement #1112

Merged

torsolaso mentioned this issue Apr 13, 2020

[Bug] Oauth2 on TH4 #1284

Closed

1earch mentioned this issue Jun 10, 2020

[Enhancement] Security enhancements for OIDC authentication #1390

Open

nadouani closed this as completed Jun 15, 2020

vatsaldesai93 mentioned this issue Feb 17, 2021

Invalid URL error - Group Parsing TheHive-Project/Cortex#344

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OAuth2 User Info Failure #1010

OAuth2 User Info Failure #1010

drewstinnett commented Jun 8, 2019

nadouani commented Jun 14, 2019

ananth07reddy commented Jun 18, 2019 •

edited by nadouani

Loading

nadouani commented Jun 18, 2019

ananth07reddy commented Jun 19, 2019 •

edited by nadouani

Loading

ananth07reddy commented Jun 19, 2019

nadouani commented Jun 19, 2019

nadouani commented Jun 19, 2019

ananth07reddy commented Jun 19, 2019 •

edited

Loading

ananth07reddy commented Jun 19, 2019

nadouani commented Jun 20, 2019

ananth07reddy commented Jun 20, 2019

ananth07reddy commented Jun 21, 2019

drewstinnett commented Jun 26, 2019

nadouani commented Jun 26, 2019

1earch commented Sep 5, 2019

drewstinnett commented Sep 25, 2019

1earch commented Sep 26, 2019

nadouani commented Jun 15, 2020

OAuth2 User Info Failure #1010

OAuth2 User Info Failure #1010

Comments

drewstinnett commented Jun 8, 2019

OAuth2 User Info Failure

Request Type

Work Environment

Problem Description

Steps to Reproduce

Complementary information

nadouani commented Jun 14, 2019

ananth07reddy commented Jun 18, 2019 • edited by nadouani Loading

nadouani commented Jun 18, 2019

ananth07reddy commented Jun 19, 2019 • edited by nadouani Loading

ananth07reddy commented Jun 19, 2019

nadouani commented Jun 19, 2019

nadouani commented Jun 19, 2019

ananth07reddy commented Jun 19, 2019 • edited Loading

ananth07reddy commented Jun 19, 2019

nadouani commented Jun 20, 2019

ananth07reddy commented Jun 20, 2019

ananth07reddy commented Jun 21, 2019

drewstinnett commented Jun 26, 2019

nadouani commented Jun 26, 2019

1earch commented Sep 5, 2019

drewstinnett commented Sep 25, 2019

1earch commented Sep 26, 2019

nadouani commented Jun 15, 2020

ananth07reddy commented Jun 18, 2019 •

edited by nadouani

Loading

ananth07reddy commented Jun 19, 2019 •

edited by nadouani

Loading

ananth07reddy commented Jun 19, 2019 •

edited

Loading