OpenID Connect and OAuth2 sign-on improvement #1112
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
User groups are parsed directly from user infos. The config parameter `auth.sso.groups.url` is useless in that case. Note: an AuthenticationError is raised when no groups are available for the user.
Default now respects OpenID Connect conventions.
Something is drastrically changing, and may cause issues:Before this PR, the OAuth2 authentication code was extracted from an URL following the pattern Now, it is extracted from an URL following the pattern |
|
@1earch I was struggling with the same issues using OAuth (OpenID). Getting generic "Authentication Failed" issues but can't seem to find any logs indicating what could be wrong. Hopefully this change will fix this ^^ Great addition regarding the auto update btw! Any update about the merge/review? |
|
Last comment on this was Oct 22, 2019. Is there any update on this? |
Closed
jiprocha
added a commit
to jiprocha/Cortex
that referenced
this pull request
Dec 1, 2022
…ctionality This commit fixes issue TheHive-Project#344 by backporting fix from TheHive repository. Original pull request from which the backport was taken can be found at TheHive-Project/TheHive#1112.
To-om
pushed a commit
to TheHive-Project/Cortex
that referenced
this pull request
Sep 20, 2023
…ctionality This commit fixes issue #344 by backporting fix from TheHive repository. Original pull request from which the backport was taken can be found at TheHive-Project/TheHive#1112.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This patch fixes #1110.
Bug fixes
Invalid URLon groups parsing (mentionned in OAuth2 User Info Failure #1010)Authentication failure(OAuth2 not working : Authentication failure #946)Authentication failureon disconnectionImprovements
Invalid URLerror)Authentication failureon disconnection)In addition, I improved the login form when SSO signing in. Before this commit, nothing was displayed indicating that we were signing in using SSO. Now, when we are redirected to TheHive after signing on our federated identity provider, TheHive disables the login form and change button message to indicate that a SSO signing in is currently performed. The following image shows this feature:
Finally, a user with no matched roles (using the
groupmapper) can't SSO sign in. AnAuthenticationErrorwill be raised. This is needed in case of an internal user wants to access TheHive but should not: this user will match no profiles (read, write, admin).PS: I will submit another PR on TheHiveDocs to explain how to configure SSO login.