Netflix/security_monkey

OpenID Connect SSO - user authentication fails because client_id is included in redirect_uri

Open

#957 建立於 2018年2月22日

在 GitHub 查看
 (3 留言) (0 反應) (0 負責人)Python (4,341 star) (832 fork)batch import
difficulty: newcomerenhancementhelp wanted

描述

Please make sure that you have checked the boxes:

  • Review the Quickstart guide
  • Search for both open and closed issues regarding the problem you are experiencing
  • For permissions issues (Access Denied and credential related errors), please refer to the requisite docs before submitting an issue: AWS, GCP, OpenStack, GitHub

Description of issue:

When OpenID Connect is configured for user authentication, and a user is redirected from SecurityMonkey to an OAuth Authorization Server to be authenticated, SecurityMonkey includes the client_id in the state parameter, which causes an issue for all Authorization Servers that enforce RFC 6749 (OAuth 2.0 Authorization Framework), specifically section 2.3.1 Client Password:

https://tools.ietf.org/html/rfc6749#section-2.3.1

Including the client credentials in the request-body using the two
parameters is NOT RECOMMENDED and SHOULD be limited to clients unable
to directly utilize the HTTP Basic authentication scheme (or other
password-based HTTP authentication schemes).  The parameters can only
be transmitted in the request-body and MUST NOT be included in the
request URI.

I believe that removing the client_id from the state parameter would fix this issue and help this project conform to the OAuth 2.0 specification better.

貢獻者指南

技術棧
python
領域
securitybackend
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
3
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-3 hours
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
stale
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
clear
前置要求
Understanding of OpenID ConnectFamiliarity with Python web frameworksBasic knowledge of OAuth 2.0 RFC 6749
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
70
研究方向
The issue is in the OAuth authentication flow, likely in the view or handler that constructs the redirect URI. The fix involves removing the client id from the state parameter. Inspect the code that handles the OAuth callback and state generation. The issue references RFC 6749 section 2.3.1. Ensure the client credentials are sent via HTTP Basic auth instead of in the redirect URI.