PKCE support for SSO #5189

avdb13 · 2024-11-12T00:22:35Z

Description

In continuation of #4881.

Implements PKCE support, in order to mitigate against the threat of authorization code interception attacks.

Background reading: https://www.oauth.com/oauth2-servers/pkce

crates/db_schema/src/schema.rs

Nutomic · 2024-11-12T09:27:46Z

@privacyguard Could you have a look at this?

avdb13 · 2024-11-12T10:50:21Z

Frontend PR: LemmyNet/lemmy-ui#2806
Trying to figure out how to test it now, hints are appreciated.

crates/api_crud/src/user/create.rs

privacyguard · 2024-11-13T10:37:44Z

crates/db_schema/src/source/oauth_provider.rs

@@ -57,6 +57,8 @@ pub struct OAuthProvider {
  pub auto_verify_email: bool,
  /// Allows linking an OAUTH account to an existing user account by matching emails
  pub account_linking_enabled: bool,
+  /// switch to enable or disable PKCE
+  pub use_pkce: bool,


use_pkce should also be added to the serialized fields in the PublicOAuthProvider. This will be required by the client to be able to check whether or not code_verifier should be generated for the provider in question at login time.

privacyguard · 2024-11-13T10:50:24Z

@Nutomic overall the server changes to support PKCE are:
1- The stored provider with all the CRUD methods should have have a boolean: use_pkce
2- The PublicOAuthProvider should contain the field in order to tell the frontend that this provider requires the code_verifier to be generated.
2- The oauth authentication route should accept the code_verifier as a parameter when use_pkce is enabled, validate it, then pass it as a parameter to the issue token request.

We gave our feedback on the functionality aspect. We'll let the rust experts give their feedback on the code.

We also gave feedback on the frontend PR.

privacyguard · 2024-11-13T10:54:16Z

@avdb13 If you check the comments on the SSO PR, there are a couple of comments detailing the steps needed to test locally. If you're using Privacy Portal to test, don't forget to enable PKCE in the OAUTH app settings there too.

#4881 (comment)

crates/api_common/src/utils.rs

crates/api_crud/src/user/create.rs

dessalines · 2024-11-21T13:32:13Z

crates/api_common/src/utils.rs

@@ -1162,6 +1162,19 @@ fn build_proxied_image_url(
  ))
 }

+pub fn check_code_verifier(code_verifier: &str) -> LemmyResult<&str> {


Also this should probably be renamed to check_pkce_code

This function is only used in a single file, so move it directly there and make it private.

crates/api_crud/src/user/create.rs

dessalines · 2024-11-21T13:38:04Z

crates/api_crud/src/user/create.rs

  if !response.status().is_success() {
-    Err(LemmyErrorType::OauthLoginFailed)?;
+    dbg!(response.bytes().await);


It'd probably be better to include this in the error message if its vital. Otherwise just remove this line. Ideally after you've tested this and it works, you can remove it.

dessalines · 2024-11-21T13:39:40Z

migrations/2024-11-12-080606_oauth_pkce/up.sql

Since we've merged other DB changes since then, you'll probably need to rename this migration to the current date, or anything after the last one.

We never actually had problems with old dates on migrations so its fine.

One issue is that our check_diesel_migration woodpecker CI task can only check that diesel migration redo works for the newest DB migration.

Ah because there is already a newer migration on this same branch. Right it needs to be renamed then.

crates/api_common/src/utils.rs

avdb13 · 2024-11-22T18:02:16Z

Converting it back to draft for now, I tested it against gitlab but without success as their OIDC implementation seems to be too unreliable. Testing it with django-oauth-toolkit tonight.

privacyguard · 2024-11-23T12:53:28Z

@avdb13 We tested the PRs locally, there are a couple of issues that need to be fixed:
1- The way code_challenge is being base64url encoded is incorrect. Check out the PKCE section of this tutorial it includes functions you can use to generate the code_verifier and code_challenge. The code_verifier can also be simplified to base64url encoding.
2- The schema.rs file seems to have been edited manually? When we run the migrations use_pkce should be the last property. Changing it back to the last property would require updating some structs.
3- Also, as mentioned by @dessalines, the migration file needs to be manually renamed to update the timestamp to something more recent such as 2024-11-12-090606_oauth_pkce

avdb13 · 2024-11-24T00:38:13Z

Testing it seems to assert correctness yet I keep getting "Invalid login credentials" for some reason. This was with account linking disabled.

Correction: I was incorrectly base64 encoding by not removing all trailing equal signs on the front-end side.

avdb13 · 2024-11-24T21:44:09Z

CI doesn't pass because of lemmy-js-client. If you generate the types again it should work.
Iforgot to run cargo-fmt but otherwise it's complete.

Thanks for the tutorial @privacyguard , I decided to use the same code with a few small changes.

avdb13 · 2024-11-24T21:59:20Z

CI doesn't pass because of lemmy-js-client. If you generate the types again it should work.

Thanks for the tutorial @privacyguard , I decided to use the same code with a few small changes.

I have been thinking about opening another PR in order to support the nonce claim for OIDC providers, after this PR hopefully gets merged.

crates/api_common/src/oauth_provider.rs

crates/api_common/src/utils.rs

dessalines

One comment above to address. Then I can regenerate lemmy-js-client and make a test version you can use to test for lemmy-ui.

avdb13 · 2024-11-28T01:47:00Z

Not sure why federation tests fail. All issues have been addressed.

dessalines · 2024-11-28T03:14:14Z

Its not you, its a different intermittent CI issue we're facing.

BTW in the future, plz use regular commits and merges rather than rebasing. We can't see the specific changes because you rewrote the history and force-pushed it.

avdb13 · 2024-11-28T03:35:51Z

Its not you, its a different intermittent CI issue we're facing.

Demo to prove this is the case anyway: https://files.catbox.moe/pijbbh.mkv

BTW in the future, plz use regular commits and merges rather than rebasing. We can't see the specific changes because you rewrote the history and force-pushed it.

Apologies, I figured that the changes were limited in scope.

avdb13 · 2024-11-29T16:28:44Z

Do PRs require approval of all reviewers?

Nutomic · 2024-12-02T09:41:11Z

Only one approval is required, but I will give others a chance to have a look as well.

avdb13 requested review from Nutomic, dessalines, phiresky, dullbananas and SleeplessOne1917 as code owners November 12, 2024 00:22

flamingo-cant-draw reviewed Nov 12, 2024

View reviewed changes

crates/db_schema/src/schema.rs Outdated Show resolved Hide resolved

avdb13 force-pushed the pkce branch 2 times, most recently from 5dda4a1 to 7fc1ead Compare November 12, 2024 08:15

privacyguard suggested changes Nov 13, 2024

View reviewed changes

crates/api_crud/src/user/create.rs Show resolved Hide resolved

privacyguard suggested changes Nov 13, 2024

View reviewed changes

avdb13 force-pushed the pkce branch 6 times, most recently from 9ac5b55 to 22f47aa Compare November 21, 2024 11:02

dessalines reviewed Nov 21, 2024

View reviewed changes

SleeplessOne1917 reviewed Nov 21, 2024

View reviewed changes

crates/api_common/src/utils.rs Outdated Show resolved Hide resolved

avdb13 changed the title ~~PKCE support for SSO~~ draft: PKCE support for SSO Nov 22, 2024

avdb13 changed the title ~~draft: PKCE support for SSO~~ PKCE support for SSO Nov 22, 2024

avdb13 marked this pull request as draft November 22, 2024 18:00

avdb13 force-pushed the pkce branch 3 times, most recently from 4ed32d7 to cc1a8fc Compare November 24, 2024 00:03

avdb13 marked this pull request as ready for review November 24, 2024 09:00

avdb13 force-pushed the pkce branch 2 times, most recently from 9bfb4c5 to dc58c26 Compare November 24, 2024 10:03

avdb13 requested review from privacyguard, flamingo-cant-draw, dessalines and SleeplessOne1917 November 24, 2024 13:41

Nutomic reviewed Nov 26, 2024

View reviewed changes

crates/api_common/src/oauth_provider.rs Outdated Show resolved Hide resolved

Nutomic reviewed Nov 26, 2024

View reviewed changes

crates/api_common/src/utils.rs Outdated Show resolved Hide resolved

dessalines requested changes Nov 27, 2024

View reviewed changes

avdb13 force-pushed the pkce branch from 517821a to b05d907 Compare November 28, 2024 00:45

feat: add PKCE

52dd992

avdb13 force-pushed the pkce branch from b05d907 to 52dd992 Compare November 28, 2024 00:55

avdb13 requested a review from dessalines November 28, 2024 00:55

Nutomic approved these changes Nov 28, 2024

View reviewed changes

Nutomic and others added 2 commits November 28, 2024 10:18

Merge branch 'main' into pkce

8af0f36

Merge branch 'main' into pkce

15d8321

dessalines approved these changes Dec 2, 2024

View reviewed changes

dessalines merged commit 9505d1d into LemmyNet:main Dec 2, 2024
1 check passed

erlend-sh mentioned this pull request Feb 4, 2025

PKCE support for SSO LemmyNet/lemmy-ui#2806

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PKCE support for SSO #5189

PKCE support for SSO #5189

avdb13 commented Nov 12, 2024 •

edited

Loading

Nutomic commented Nov 12, 2024

avdb13 commented Nov 12, 2024 •

edited

Loading

privacyguard Nov 13, 2024 •

edited

Loading

privacyguard commented Nov 13, 2024

privacyguard commented Nov 13, 2024 •

edited

Loading

dessalines Nov 21, 2024

Nutomic Nov 21, 2024

dessalines Nov 21, 2024

dessalines Nov 21, 2024

Nutomic Nov 21, 2024

dessalines Nov 21, 2024

Nutomic Nov 22, 2024

avdb13 commented Nov 22, 2024

privacyguard commented Nov 23, 2024

avdb13 commented Nov 24, 2024 •

edited

Loading

avdb13 commented Nov 24, 2024 •

edited

Loading

avdb13 commented Nov 24, 2024

dessalines left a comment

avdb13 commented Nov 28, 2024

dessalines commented Nov 28, 2024

avdb13 commented Nov 28, 2024

avdb13 commented Nov 29, 2024

Nutomic commented Dec 2, 2024

PKCE support for SSO #5189

PKCE support for SSO #5189

Conversation

avdb13 commented Nov 12, 2024 • edited Loading

Description

Nutomic commented Nov 12, 2024

avdb13 commented Nov 12, 2024 • edited Loading

privacyguard Nov 13, 2024 • edited Loading

Choose a reason for hiding this comment

privacyguard commented Nov 13, 2024

privacyguard commented Nov 13, 2024 • edited Loading

dessalines Nov 21, 2024

Choose a reason for hiding this comment

Nutomic Nov 21, 2024

Choose a reason for hiding this comment

dessalines Nov 21, 2024

Choose a reason for hiding this comment

dessalines Nov 21, 2024

Choose a reason for hiding this comment

Nutomic Nov 21, 2024

Choose a reason for hiding this comment

dessalines Nov 21, 2024

Choose a reason for hiding this comment

Nutomic Nov 22, 2024

Choose a reason for hiding this comment

avdb13 commented Nov 22, 2024

privacyguard commented Nov 23, 2024

avdb13 commented Nov 24, 2024 • edited Loading

avdb13 commented Nov 24, 2024 • edited Loading

avdb13 commented Nov 24, 2024

dessalines left a comment

Choose a reason for hiding this comment

avdb13 commented Nov 28, 2024

dessalines commented Nov 28, 2024

avdb13 commented Nov 28, 2024

avdb13 commented Nov 29, 2024

Nutomic commented Dec 2, 2024

avdb13 commented Nov 12, 2024 •

edited

Loading

avdb13 commented Nov 12, 2024 •

edited

Loading

privacyguard Nov 13, 2024 •

edited

Loading

privacyguard commented Nov 13, 2024 •

edited

Loading

avdb13 commented Nov 24, 2024 •

edited

Loading

avdb13 commented Nov 24, 2024 •

edited

Loading