oauth.py _parse_access_token function uses access_token instead of id_token #2003
Assignees
Comments
|
Thanks @keanpaderes! We have had users who couldn't set up Aleph to use Google OAuth. So thank you for diagnosing the issue! |
|
Hey everyone, I know multiple people are facing this same issue and we want to help fix it soon. But unfortunately we are blocked on some urgent internal work at the moment. We'll get to fixing the issue as soon as we can and ship it in the next Aleph release. |
sunu
added a commit
that referenced
this issue
Nov 19, 2021
OIDC doesn't specify the format for access_token. Some providers use it as a JWT to store information about groups (eg: Keycloak), some don't use it as a JWT (eg: Google). So we try to parse it as a JWT but if that fails we ignore the error and move on. In case the access_token is not an JWT, the groups info is stored in the id_token and that's where we look. Refs #2003
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
OS: MacOS Catalina 10.15.7
Docker Version: 20.10.7
Aleph Version: 3.11.0
Good day! We stumbled upon an error while integrating Google OAuth to our Aleph Instance. We have traced the problem to
aleph/aleph/oauth.py, specifically the_parse_access_tokenfunction (line 28). In its current form, it uses theaccess_tokenproperty which leads to an error when authlib's JsonWebToken.decode function parses it asaccess_tokenis not JWT. It should useid_tokenproperty which is also available in theoauth_tokenparameter and we confirmed that it works when we applied the change on our local image.The text was updated successfully, but these errors were encountered: