Netflix/security_monkey

OpenID Connect SSO - user authentication fails because client_id is included in redirect_uri

Open

#957 opened on 2018年2月22日

GitHub で見る
 (3 comments) (0 reactions) (0 assignees)Python (4,341 stars) (832 forks)batch import
difficulty: newcomerenhancementhelp wanted

説明

Please make sure that you have checked the boxes:

  • Review the Quickstart guide
  • Search for both open and closed issues regarding the problem you are experiencing
  • For permissions issues (Access Denied and credential related errors), please refer to the requisite docs before submitting an issue: AWS, GCP, OpenStack, GitHub

Description of issue:

When OpenID Connect is configured for user authentication, and a user is redirected from SecurityMonkey to an OAuth Authorization Server to be authenticated, SecurityMonkey includes the client_id in the state parameter, which causes an issue for all Authorization Servers that enforce RFC 6749 (OAuth 2.0 Authorization Framework), specifically section 2.3.1 Client Password:

https://tools.ietf.org/html/rfc6749#section-2.3.1

Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes).  The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.

I believe that removing the client_id from the state parameter would fix this issue and help this project conform to the OAuth 2.0 specification better.

コントリビューターガイド

技術スタック
python
領域
securitybackend
Issue 種別
bug
難度新しい貢献者にとっての実装難度です。1 は非常に小さな変更、5 は専門的な作業です。
3
推定時間経験ある貢献者が調査、実装、テスト、pull request 準備にかけるおおよその時間範囲です。
1-3 hours
活動状況Issue が今どれだけ取り組みやすいかを示します。新しい、活発、古い、ブロック中、またはメンテナー入力待ちなどです。
stale
明確さ期待される変更、受け入れ条件、次の手順がどれだけ明確かを示します。
clear
前提条件
Understanding of OpenID ConnectFamiliarity with Python web frameworksBasic knowledge of OAuth 2.0 RFC 6749
初心者向け度初回貢献者にどれだけ取り組みやすいかを 1-100 で推定したスコアです。
70
調査方針
The issue is in the OAuth authentication flow, likely in the view or handler that constructs the redirect URI. The fix involves removing the client id from the state parameter. Inspect the code that handles the OAuth callback and state generation. The issue references RFC 6749 section 2.3.1. Ensure the client credentials are sent via HTTP Basic auth instead of in the redirect URI.