Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve auth flow error handling #1862

Merged
merged 1 commit into from
Aug 2, 2021
Merged

Conversation

tkleczek
Copy link
Contributor

Overview:
Fixes several unrelated problems related to auth flow error handling

What problem does it solve?:

  1. Fixes a case of wrong error returned in case of unsupported grant type (according to RFC should be "unsupported_grant_type", not "invalid_grant").
  2. Fixes "connector not found" error displayed in an inconsistent not-end-user-friendly way (errTokenHelper used instead of renderError)
  3. Makes errors related to invalid connector in parseAuthorizationRequest redirect back to the client (as RFC states that after client_id/redirect uri is validated, all further errors should be redirected to client)
  4. Makes two type of errors returned from parseAuthorizationRequest explicit (either redirected error or displayed error)

This PR partially fixes #1796

Special notes for a reviewer:

@sagikazarmark
Copy link
Member

@tkleczek can you please rebase your PR?

@tkleczek
Copy link
Contributor Author

@sagikazarmark done, sorry for the delay

Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left some comments, but overall it looks good! Thanks!

server/handlers.go Outdated Show resolved Hide resolved
server/handlers.go Outdated Show resolved Hide resolved
server/oauth2.go Outdated Show resolved Hide resolved
server/oauth2.go Outdated Show resolved Hide resolved
server/oauth2_test.go Show resolved Hide resolved
server/oauth2.go Outdated Show resolved Hide resolved
server/handlers.go Show resolved Hide resolved
@sagikazarmark
Copy link
Member

@tkleczek I know this has been in the queue for a long time, but I'd like to release it. Do you think you can take a look at @nabokihms comments?

@sagikazarmark
Copy link
Member

Moving to the next milestone

@tkleczek
Copy link
Contributor Author

@sagikazarmark @nabokihms I rebased the PR and fixed code review issues.

Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good, thanks. I added some NIT comments.

I am going to test this PR. If everything is ok, I will mark it as approved.

server/oauth2.go Outdated Show resolved Hide resolved
server/oauth2.go Outdated Show resolved Hide resolved
server/oauth2_test.go Outdated Show resolved Hide resolved
server/oauth2_test.go Outdated Show resolved Hide resolved
Signed-off-by: Tomasz Kleczek <tomasz.kleczek@gmail.com>
Copy link
Member

@nabokihms nabokihms left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The only problem I found is that we still see a displayed error on accessing the /auth endpoint with the wrong connector id. This happens because now we are parsing an auth request only after redirecting to the connector login page.

I don't think this blocks us from accepting this PR as is. Let's merge it. We can deal with the rest later.

@nabokihms
Copy link
Member

@tkleczek thank you for the contribution!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dex error-handling is not RFC-compliant
3 participants