Google OAuth2

[jimiflowers]

Hi. I wonder if OAuth.pm works with Google OAuth2, because I tried and get "cannot get oauth data" error.

I'm using OMD Labs version 4.20

Here my oauth config:

<auth_oauth>

login = "Google Account Login"
client_id = MY_CLIENT_ID
client_secret = MY_CLIENT_SECRET
scopes = openid profile email
auth_url = https://accounts.google.com/o/oauth2/v2/auth
token_url = https://accounts.google.com/o/oauth2/v2/token
api_url = https://accounts.google.com/o/oauth2/v2/userinfo
login_field = email

</auth_oauth>

Greetings!

[sni]

Those urls are wrong, use these and it should work:

  <provider>
    login = "Google Account Login"
    client_id = ...
    client_secret = ...
    scopes = openid profile email
    auth_url = https://accounts.google.com/o/oauth2/v2/auth
    token_url = https://oauth2.googleapis.com/token
    api_url = https://openidconnect.googleapis.com/v1/userinfo
    login_field = email
  </provider>

I also started a page with some common examples here: https://thruk.org/documentation/oauth2.html

[patrick-nomblot]

hello,

it works fine going to the login url but in my case, unauthenticated users not redirected to login.
I think I'm missing something but I can't find the solution in the documentation.
A little nudge in the right direction would be greatly appreciated.

[sni]

what happens instead if a user is unauthenticated?

[patrick-nomblot]

Hello,

I created a 'generic' user in icinga : /omd/sites/monitoring/etc/icinga2/conf.d/users-omd.conf
and defined this account also in Thruk with https://1.2.3.4/monitoring/thruk/cgi-bin/conf.cgi?sub=users
I also disabled auth in /omd/sites/monitoring/etc/apache/conf.d/auth.conf

with this, the behavior is not bad :
if user is not authentified, the generic user is used on Thruk, else, the authenticated google user via oauth.

I can easily setup authentication in apache (AD, LDAP, htpasswd, etc...) pushing REMOTE_USER, but did not get it working with thruk. So I tryied the Google OAUTH with looks working better. So, there is something I do not understand with Thruk session cookies / external apache auth. I also do not understand the magic that make the generic account I created to be used when not authenticated with oauth.

Your help would be appreciated, many thanks.

[patrick-nomblot]

I've made some progress in my testing and I have a better understanding of what I don't understand. Here are some things that can help me:

If I go directly to the Thruk interface without going through the login CGI, for example directly to: https://monitoring.flowbird.group/monitoring/thruk/cgi-bin/main.cgi

I see the Thruk interface ans I'm am automaticcaly logged as the user I created on Thruk from the omdadmin account (flowbird).

But I don't know by what magic this account is chosen, is it simply the first one in the list?

If I go through the login CGI, I can log in via Google and everything works as expected, I just have to configure the authenticated user account on the Thruk interface.

So I am missing the understanding of the authentication mechanism that selects an account if there is no authentication. I have never been able to configure Apache authentication by injecting the BASIC AUTH header either, only the cookie mechanism seems to be used and I think it is around the cookie and the URL path that I lack understanding

your help will be highly appreciated.