Integration with oauth2_proxy

[falfaro]

I am trying to write some integration tests for oauth2_proxy using this OpenID server mock as a base, but I am unable to figure out all the details. I am using https://github.com/a5huynh/oauth2_proxy/ as the starting point for my experiment.

My docker-compose.yaml file looks like this:

version: '3'

services:
  # OpenID Connect server mock
  server_mock:
   image: soluto/oidc-server-mock   
    networks:
      demo-net:
    ports:
      - "4011:80"
    environment: 
      - ASPNETCORE_ENVIRONMENT=Development
      - CLIENT_ID=openid-mock-client
      - REDIRECT_URIS=http://localhost:3000/auth/oidc,http://localhost:4004/auth/oidc,http://localhost:4180/oauth2/callback
      - TEST_USER={"SubjectId":"1","Username":"test","Password":"test"}

  # Azure OAuth Proxy
  authproxy:
    build: ../..
    networks:
      demo-net:
    ports:
      - "4180:4180"
    command: [
      "-wait",
      "http://oidcservermock_server_mock_1:80",
      "-timeout",
      "1m",
      "/bin/oauth2_proxy",
      "--provider=oidc",
      "--cookie-secure=false",
      "--upstream=http://localhost:80",
      "--http-address=0.0.0.0:4180",
      "--redirect-url=http://127.0.0.1:4180/oauth2/callback",
      "--oidc-issuer-url=http://oidcservermock_server_mock_1:80",
      "--email-domain=email.com",
    ]
    environment:
      OAUTH2_PROXY_COOKIE_SECRET: totally-secret-key
      OAUTH2_PROXY_COOKIE_DOMAIN: "*"
      OAUTH2_PROXY_CLIENT_ID: openid-mock-client
      OAUTH2_PROXY_CLIENT_SECRET: "VTFDRmlLc3ByajgrSlVYVkwxcU5LUT09"

  # NGINX example app
  upstream:
    build: ../nginx
    networks:
      demo-net:
    ports:
      - "80:80"

networks:
  demo-net:

But when I try to log in via http://localhost:80, I get the oauth2_proxy to show a button to start authentication via Open ID connect. Clicking on the button, however, fails with the following error from the Open ID server mock:

fail: IdentityServer4.Validation.AuthorizeRequestValidator[0]
server_mock_1  |       Invalid grant type for client: authorization_code
server_mock_1  |       {
server_mock_1  |         "ClientId": "openid-mock-client",
server_mock_1  |         "RedirectUri": "http://localhost:4180/oauth2/callback",
server_mock_1  |         "AllowedRedirectUris": [
server_mock_1  |           "http://localhost:3000/auth/oidc",
server_mock_1  |           "http://localhost:4004/auth/oidc",
server_mock_1  |           "http://localhost:4180/oauth2/callback"
server_mock_1  |         ],
server_mock_1  |         "SubjectId": "anonymous",
server_mock_1  |         "ResponseType": "code",
server_mock_1  |         "ResponseMode": "query",
server_mock_1  |         "GrantType": "authorization_code",
server_mock_1  |         "RequestedScopes": "",
server_mock_1  |         "State": "58c1c0b86898e460f2428e5c53af66b9:/",
server_mock_1  |         "Raw": {
server_mock_1  |           "approval_prompt": "force",
server_mock_1  |           "client_id": "openid-mock-client",
server_mock_1  |           "redirect_uri": "http://localhost:4180/oauth2/callback",
server_mock_1  |           "response_type": "code",
server_mock_1  |           "scope": "openid email profile",
server_mock_1  |           "state": "58c1c0b86898e460f2428e5c53af66b9:/"
server_mock_1  |         }
server_mock_1  |       }
server_mock_1  | fail: IdentityServer4.Endpoints.AuthorizeEndpoint[0]
server_mock_1  |       Request validation failed

Any idea what is going wrong?

[AleF83]

Hey,
Sorry for late response.
This image is based on IdentiryServer4 library.
I use it in Tweek project for Implicit flow authentication.

I think that the problem is in the url that you send from the client-side to start the flow.
I use oidc-client on client-side with the following parameters:

const settings = {
  response_type: 'token id_token',
  filterProtocolClaims: true,
  loadUserInfo: true,
  automaticSilentRenew: true,
  userStore: new Oidc.WebStorageStateStore({ store: storage }),
  redirect_uri: `${window.location.origin}/auth/oidc`,
  silent_redirect_uri: `${window.location.origin}/auth/silent`,
  post_logout_redirect_uri: `${window.location.origin}/login`,
  prompt: 'login',
  authority: 'http://localhost:4011',
  client_id: 'openid-mock-client',
  scope: 'openid profile email',
};

It builds url and redirects our SPA to the authentication page of oidc-server-mock.

[AleF83]

closed due inactivity