Problem setting up github authentication

[graciousgrey]

Describe the issue
We want to use weblate with github authentication for our open source project photoprism/photoprism.
I've set up weblate with docker and additionally added a settings-override.py file as described here.
The weblate interface itself does look good but the github authentication does not work.

I already tried

1) In settings-override.py, I've set the variables defined here: https://docs.weblate.org/en/latest/admin/auth.html
AUTHENTICATION_BACKENDS, SOCIAL_AUTH_GITHUB_KEY, SOCIAL_AUTH_GITHUB_SECRET, SOCIAL_AUTH_GITHUB_SCOPE

What is not clear to me is whether I need to create an Github App or an OAuth App on Github because here it says
"You need to register an application on GitHub and then tell Weblate all its secrets"
whereas here
the link sends me to the Create OAuth App page from Github.

So I tried both: registering a
1a) Github App
1b) OAuth app
for our organization and added the client id and secret to the settings-override.py file.

I tried two variants of callback urls for both types of apps
1aa) & 1ba) "https://mydomian.com/accounts/complete/github/" as documented here
and
1ab) & 1ba) "https://mydomain.com/complete/github/" as documented here

--> in all 4 cases I see the Github button in the interface but I get the following error "Could not authenticate, probably due to an expired token or connection error."

2) I tried the same with the organizations settings described here

I've changed the following in the settings-override.py file:

• Use GithubOrganizationOAuth2 instead of GithubOAuth2 as authentication backend
• Rename the variables SOCIAL_AUTH_GITHUB_KEY, SOCIAL_AUTH_GITHUB_SECRET, SOCIAL_AUTH_GITHUB_SCOPE to SOCIAL_AUTH_GITHUB_ORG_KEY, SOCIAL_AUTH_GITHUB_ORG_SECRET, SOCIAL_AUTH_GITHUB_ORG_SCOPE
• Add the variable SOCIAL_AUTH_GITHUB_ORG_NAME

Again I tried both types of Apps and both variants of the callback url
2aa) Github App + "https://mydomian.com/accounts/complete/github/" as callback url
2ba) OAuth App + "https://mydomian.com/accounts/complete/github/" as callback url
2ab) Github App + "https://mydomian.com/complete/github/" as callback url
2bb) OAuth App + "https://mydomian.com/complete/github/" as callback url

--> in all 4 cases I get
"error=redirect_uri_mismatch&error_description=The+redirect_uri+MUST+match+the+registered+callback+URL+for+this+application"

Note: We set WEBLATE_SITE_DOMAIN: "translate.photoprism.app" in docker and use "https://translate.photoprism.app/accounts/complete/github/" or "https://translate.photoprism.app/complete/github/" as callback url.

Question: I am not sure about the organization thing. Do we need to use it if we want to use weblate for a repo that is part of an organization? Or do we only need it in case we want only members of the organization to be able to authenticate via Github?
Because we do want all Github users to be able to authenticate.

Server configuration and status

Weblate installation: Docker

• Weblate: 4.4
• Django: 3.1.4
• siphashc: 2.1
• Whoosh: 2.7.4
• translate-toolkit: 3.2.0
• lxml: 4.6.2
• Pillow: 8.0.1
• bleach: 3.2.1
• python-dateutil: 2.8.1
• social-auth-core: 3.3.3
• social-auth-app-django: 4.0.0
• django-crispy-forms: 1.10.0
• oauthlib: 3.1.0
• django-compressor: 2.4
• djangorestframework: 3.12.2
• django-filter: 2.4.0
• django-appconf: 1.0.4
• user-agents: 2.2.0
• filelock: 3.0.12
• setuptools: 40.8.0
• jellyfish: 0.8.2
• openpyxl: 3.0.5
• celery: 5.0.4
• kombu: 5.0.2
• translation-finder: 2.6
• weblate-language-data: 2020.13
• html2text: 2020.1.16
• pycairo: 1.16.2
• pygobject: 3.30.4
• diff-match-patch: 20200713
• requests: 2.25.0
• django-redis: 4.12.1
• hiredis: 1.1.0
• sentry_sdk: 0.19.5
• Cython: 0.29.21
• misaka: 2.1.1
• GitPython: 3.1.11
• borgbackup: 1.1.14
• pyparsing: 2.4.7
• Python: 3.7.3
• Git: 2.20.1
• psycopg2: 2.8.6
• psycopg2-binary: 2.8.6
• phply: 1.2.5
• chardet: 3.0.4
• ruamel.yaml: 0.16.12
• tesserocr: 2.5.1
• akismet: 1.1
• boto3: 1.16.36
• zeep: 4.0.0
• aeidon: 1.7.0
• iniparse: 0.5
• mysqlclient: 2.0.2
• Mercurial: 5.6.1
• git-svn: 2.20.1
• git-review: 1.28.0
• Redis server: 6.0.9
• PostgreSQL server: 13.1
• Database backends: django.db.backends.postgresql
• Cache backends: default:RedisCache, avatar:FileBasedCache
• Email setup: django.core.mail.backends.smtp.EmailBackend: in-v3.mailjet.com
• OS encoding: filesystem=utf-8, default=utf-8
• Celery: redis://redis:6379/1, redis://redis:6379/1, regular
• Platform: Linux 5.4.0-54-generic (x86_6

Weblate deploy checks
System check identified some issues:

WARNINGS:
?: (security.W004) You have not set a value for the SECURE_HSTS_SECONDS setting. If your entire site is served only over SSL, you may want to consider setting a value and enabling HTTP Strict Transport Security. Be sure to read the documentation first; enabling HSTS carelessly can cause serious, irreversible problems.
?: (security.W008) Your SECURE_SSL_REDIRECT setting is not set to True. Unless your site should be available over both SSL and non-SSL connections, you may want to either set this setting True or configure a load balancer or reverse-proxy server to redirect all connections to HTTPS.
?: (security.W012) SESSION_COOKIE_SECURE is not set to True. Using a secure-only session cookie makes it more difficult for network traffic sniffers to hijack user sessions.
?: (security.W018) You should not have DEBUG set to True in deployment.

INFOS:
?: (weblate.I021) Error collection is not set up, it is highly recommended for production use
HINT: https://docs.weblate.org/en/weblate-4.4/admin/install.html#collecting-errors
?: (weblate.I028) Backups are not configured, it is highly recommended for production use
HINT: https://docs.weblate.org/en/weblate-4.4/admin/backup.html

Thanks for your help!

[github-actions]

This issue looks more like a support question than an issue. We strive to answer these reasonably fast, but purchasing the support subscription is not only more responsible and faster for your business but also makes Weblate stronger. In case your question is already answered, making a donation is the right way to say thank you!

[nijel]

The GitHub auth can be configured in Docker by environment variables as well, see https://docs.weblate.org/en/latest/admin/install/docker.html#github

What is not clear to me is whether I need to create an Github App or an OAuth App on Github

The documentation was written in time when GitHub Apps didn't yet exist, I've just clarified it to OAuth in 20e6012.

"error=redirect_uri_mismatch&error_description=The+redirect_uri+MUST+match+the+registered+callback+URL+for+this+application"

Check the URL sent in the authentication request to GitHub. My guess is that Weblate doesn't detect https in your case, try toggling https://docs.weblate.org/en/latest/admin/install/docker.html#envvar-WEBLATE_ENABLE_HTTPS

[graciousgrey]

Thank you! Setting WEBLATE_ENABLE_HTTPS solved my issue :)

[github-actions]

The issue you have reported is resolved now. If you don’t feel it’s right, please follow it’s labels to get a clue and take further steps.

• In case you see a similar problem, please open a separate issue.
• If you are happy with the outcome, don’t hesitate to support Weblate by making a donation.