[CILogon] Instructions for CILogon with Google OAuth use new Google API for oid, but CILogon uses an old OAuth API

[GeorgianaElena]

Bug description

The allowed_idps dict is documented to expect its keys to be entity ids from the list provided by CILogon at https://cilogon.org/idplist.

oauthenticator/oauthenticator/cilogon.py

Line 113 in 333f356

See https://cilogon.org/idplist for the list of `EntityIDs` of each IdP.

However, the idp field of the userinfo response from CILogon

oauthenticator/oauthenticator/cilogon.py

Line 306 in f3af268

selected_idp = resp_json.get("idp")

is an old Google oidc endpoint, i.e. http://google.com/accounts/o8/id . I believe the OpenID Connect authorization endpoint to use instead is https://accounts.google.com/o/oauth2/v2/auth which is document at https://developers.google.com/identity/protocols/oauth2/openid-connect.

Expected + actual behaviour

I expected what CILogon would return in the userinfo dict would be the entity id in the list at https://cilogon.org/idplist, which is https://accounts.google.com/o/oauth2/auth, but is not, so when trying to use the Google identity provider, JupyterHub returns a 500 error.

How to reproduce

A config like:

c.CILogonOAuthenticator.allowed_idps = {
    'https://accounts.google.com/o/oauth2/auth': {
        'username_derivation': {
            'username_claim': 'email',
        }
    },
}

won't work, because it would think you're using an idp that wasn't authorized when logging in using Google (which is actually the opposite of what's wanted)

Possible solution

I opened an issue about it upstream also ncsa/oa4mp#45 and I believe solving that would also solve this issue.

In the meantime however, we should document which is the actual entity id of Google that is expected.

[terrencegf]

https://test.cilogon.org has been updated so that the entityID values reported by https://test.cilogon.org/idplist/ match the "idp" claim returned by the OAuth2/OIDC "userinfo" endpoint. See the upstream issue for details.

https://cilogon.org should be updated mid-July.

[terrencegf]

The update has been deployed to https://cilogon.org . Please contact [email protected] if the update does not solve this issue.

[GeorgianaElena]

ncsa/oa4mp#45 has been fixed, so closing this one too! Thanks @terrencegf !