<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi, we found the problem.</p>
<p>We had to put the "token_endpoint_auth_method" attribute in the
ClientMetadata declaration, like this :</p>
<pre><span class="pl-s1">pc</span> <span class="pl-c1">=</span> <span class="pl-v">ProviderConfiguration</span>(
<span class="pl-s1">issuer</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_ISSUER'</span>],
<span class="pl-c"># provider_metadata=pmd,</span>
<span class="pl-s1">userinfo_http_method</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_USERINFO_HTTP_METHOD'</span>],
<span class="pl-s1">client_metadata</span><span class="pl-c1">=</span><span class="pl-v">ClientMetadata</span>(
<span class="pl-s1">client_id</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_CLIENT_ID'</span>],
<span class="pl-s1">client_secret</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_CLIENT_SECRET'</span>],
token_endpoint_auth_method='client_secret_post'
),
<span class="pl-s1">auth_request_params</span><span class="pl-c1">=</span>{
<span class="pl-s">'scope'</span>: <span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_SCOPES'</span>]
}
)</pre>
<div class="moz-cite-prefix">We had to dig in the code to find that.</div>
<div class="moz-cite-prefix">Adding this in the documentation of
Flask-PyOIDC would have been a time saver for us so we are going
to suggest that.</div>
<div class="moz-cite-prefix">Thank you all for your advice.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Le 24/11/2020 à 10:10, Julien Cochennec
a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:2264407b-a750-2834-c9be-0d31bfffc3e5@ac-orleans-tours.fr">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<p>Hi,</p>
<p>Interesting, we switched to Flask-PyOIDC on another branch, and
a problem still happens, but further.</p>
<p>That lib seems more clearly coded, more standard, but has very
few documentation.</p>
<p>Anyway, here's what happens now.</p>
<p>The auth decorator works and redirect to the login page, but
then, after login, we always get<br>
</p>
<p>> Something went wrong with the authentication, please try
to login again. </p>
<p>I fear it may be related to this post
<a class="moz-txt-link-freetext"
href="https://shibboleth.1660669.n2.nabble.com/OIDC-extension-OAuth2-client-authentication-error-td7643243.html"
moz-do-not-send="true">https://shibboleth.1660669.n2.nabble.com/OIDC-extension-OAuth2-client-authentication-error-td7643243.html</a></p>
<p>Were a member of this list says :<br>
</p>
<p>> The problem was, in fact, that they weren't including the
HTTP authentication header to do HTTP basic auth. <br>
</p>
<p>> They added this, and it fixed the problem. Those for the
post endpoint information, though. That could come in handy in
the future. <br>
</p>
<p>More info about that :</p>
<p>The idp logs</p>
<pre><code>> 2020-11-23 14:38:19,281 - 212.47.237.47 - WARN [org.geant.idpextension.oidc.profile.impl.ValidateEndpointAuthentication:203] - Profile Action ValidateEndpointAuthentication: Unrecognized client authentication com.nimbusds.oauth2.sdk.auth.ClientSecretBasic@15d10d97 for client_secret_post</code></pre>
<p>My code (maybe wrong, I just discovered that lib, commented
code are for last test)</p>
<pre><span class="pl-s1">pmd</span> <span class="pl-c1">=</span> <span class="pl-v">ProviderMetadata</span>(
<span class="pl-s1">issuer</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_ISSUER'</span>],
<span class="pl-s1">authorization_endpoint</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_AUTH_URI'</span>],
<span class="pl-s1">token_endpoint</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_TOKEN_URI'</span>],
<span class="pl-s1">userinfo_endpoint</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_USERINFO_URI'</span>]
)
<span class="pl-s1">pc</span> <span class="pl-c1">=</span> <span class="pl-v">ProviderConfiguration</span>(
<span class="pl-s1">issuer</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_ISSUER'</span>],
<span class="pl-c"># provider_metadata=pmd,</span>
<span class="pl-s1">userinfo_http_method</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_USERINFO_HTTP_METHOD'</span>],
<span class="pl-s1">client_metadata</span><span class="pl-c1">=</span><span class="pl-v">ClientMetadata</span>(
<span class="pl-s1">client_id</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_CLIENT_ID'</span>],
<span class="pl-s1">client_secret</span><span class="pl-c1">=</span><span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_CLIENT_SECRET'</span>]
),
<span class="pl-s1">auth_request_params</span><span class="pl-c1">=</span>{
<span class="pl-s">'scope'</span>: <span class="pl-s1">app</span>.<span class="pl-s1">config</span>[<span class="pl-s">'OIDC_SCOPES'</span>]
}
)
<span class="pl-s1">auth</span> <span class="pl-c1">=</span> <span class="pl-v">OIDCAuthentication</span>({<span class="pl-s">'default'</span>: <span class="pl-s1">pc</span>}, <span class="pl-s1">app</span>)</pre>
<p><br>
</p>
<p>Thanks for your help. Have a nice day.</p>
<p><br>
</p>
<div class="moz-cite-prefix">Le 19/11/2020 à 10:05, Peter Schober
a écrit :<br>
</div>
<blockquote type="cite"
cite="mid:20201119090553.igrrwetif6vinozr@aco.net">
<pre class="moz-quote-pre" wrap="">* Julien COCHENNEC <a class="moz-txt-link-rfc2396E" href="mailto:julien.cochennec@ac-orleans-tours.fr" moz-do-not-send="true"><julien.cochennec@ac-orleans-tours.fr></a> [2020-11-18 21:23]:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">We're testing a Python client that is developed with Flask (web
microframework) and Flask-OIDC (OIDC add-on with oauth-client lib
embedded).
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">No comment on your current issue but given that pyoidc is an OIDC
reference implementation (AFAIR) why not use Flask-pyoidc then?
<a class="moz-txt-link-freetext" href="https://pypi.org/project/Flask-pyoidc/" moz-do-not-send="true">https://pypi.org/project/Flask-pyoidc/</a>
-peter
</pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Julien Cochennec
Pôle de compétences - gestion des identités
Mél <a class="moz-txt-link-abbreviated" href="mailto:julien.cochennec@ac-orleans-tours.fr" moz-do-not-send="true">julien.cochennec@ac-orleans-tours.fr</a>
Tél 02 38 83 48 88
DSI - Rectorat d'Orléans-Tours
10 Rue Molière
45000 Orléans
<a class="moz-txt-link-abbreviated" href="http://www.ac-orleans-tours.fr" moz-do-not-send="true">www.ac-orleans-tours.fr</a></pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<pre class="moz-signature" cols="72">--
Julien Cochennec
Pôle de compétences - gestion des identités
Mél <a class="moz-txt-link-abbreviated" href="mailto:julien.cochennec@ac-orleans-tours.fr">julien.cochennec@ac-orleans-tours.fr</a>
Tél 02 38 83 48 88
DSI - Rectorat d'Orléans-Tours
10 Rue Molière
45000 Orléans
<a class="moz-txt-link-abbreviated" href="http://www.ac-orleans-tours.fr">www.ac-orleans-tours.fr</a></pre>
</body>
</html>