Skip to content

Commit 5e6b033

Browse files
lakhansamanilakhansamani
committed
fix microsoft active directory config
1 parent 171d4e3 commit 5e6b033

File tree

4 files changed

+31
-33
lines changed

4 files changed

+31
-33
lines changed

‎server/db/providers/cassandradb/verification_requests.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,6 @@ func (p *provider) ListVerificationRequests(ctx context.Context, pagination *mod
7474
var verificationRequest models.VerificationRequest
7575
err := scanner.Scan(&verificationRequest.ID, &verificationRequest.Token, &verificationRequest.Identifier, &verificationRequest.ExpiresAt, &verificationRequest.Email, &verificationRequest.Nonce, &verificationRequest.RedirectURI, &verificationRequest.CreatedAt, &verificationRequest.UpdatedAt)
7676
if err != nil {
77-
fmt.Println("=> getting error here...", err)
7877
return nil, err
7978
}
8079
verificationRequests = append(verificationRequests, verificationRequest.AsAPIVerificationRequest())

‎server/handlers/oauth_callback.go‎

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -32,11 +32,11 @@ func OAuthCallbackHandler() gin.HandlerFunc {
3232
return func(ctx *gin.Context) {
3333
provider := ctx.Param("oauth_provider")
3434
state := ctx.Request.FormValue("state")
35-
3635
sessionState, err := memorystore.Provider.GetState(state)
3736
if sessionState == "" || err != nil {
3837
log.Debug("Invalid oauth state: ", state)
3938
ctx.JSON(400, gin.H{"error": "invalid oauth state"})
39+
return
4040
}
4141
// contains random token, redirect url, role
4242
sessionSplit := strings.Split(state, "___")
@@ -46,32 +46,34 @@ func OAuthCallbackHandler() gin.HandlerFunc {
4646
ctx.JSON(400, gin.H{"error": "invalid redirect url"})
4747
return
4848
}
49-
5049
// remove state from store
5150
go memorystore.Provider.RemoveState(state)
52-
5351
stateValue := sessionSplit[0]
5452
redirectURL := sessionSplit[1]
5553
inputRoles := strings.Split(sessionSplit[2], ",")
5654
scopes := strings.Split(sessionSplit[3], ",")
57-
5855
var user *models.User
5956
oauthCode := ctx.Request.FormValue("code")
57+
if oauthCode == "" {
58+
log.Debug("Invalid oauth code: ", oauthCode)
59+
ctx.JSON(400, gin.H{"error": "invalid oauth code"})
60+
return
61+
}
6062
switch provider {
6163
case constants.AuthRecipeMethodGoogle:
62-
user, err = processGoogleUserInfo(oauthCode)
64+
user, err = processGoogleUserInfo(ctx, oauthCode)
6365
case constants.AuthRecipeMethodGithub:
64-
user, err = processGithubUserInfo(oauthCode)
66+
user, err = processGithubUserInfo(ctx, oauthCode)
6567
case constants.AuthRecipeMethodFacebook:
66-
user, err = processFacebookUserInfo(oauthCode)
68+
user, err = processFacebookUserInfo(ctx, oauthCode)
6769
case constants.AuthRecipeMethodLinkedIn:
68-
user, err = processLinkedInUserInfo(oauthCode)
70+
user, err = processLinkedInUserInfo(ctx, oauthCode)
6971
case constants.AuthRecipeMethodApple:
70-
user, err = processAppleUserInfo(oauthCode)
72+
user, err = processAppleUserInfo(ctx, oauthCode)
7173
case constants.AuthRecipeMethodTwitter:
72-
user, err = processTwitterUserInfo(oauthCode, sessionState)
74+
user, err = processTwitterUserInfo(ctx, oauthCode, sessionState)
7375
case constants.AuthRecipeMethodMicrosoft:
74-
user, err = processMicrosoftUserInfo(oauthCode)
76+
user, err = processMicrosoftUserInfo(ctx, oauthCode)
7577
default:
7678
log.Info("Invalid oauth provider")
7779
err = fmt.Errorf(`invalid oauth provider`)
@@ -281,9 +283,8 @@ func OAuthCallbackHandler() gin.HandlerFunc {
281283
}
282284
}
283285

284-
func processGoogleUserInfo(code string) (*models.User, error) {
286+
func processGoogleUserInfo(ctx context.Context, code string) (*models.User, error) {
285287
var user *models.User
286-
ctx := context.Background()
287288
oauth2Token, err := oauth.OAuthProviders.GoogleConfig.Exchange(ctx, code)
288289
if err != nil {
289290
log.Debug("Failed to exchange code for token: ", err)
@@ -313,9 +314,9 @@ func processGoogleUserInfo(code string) (*models.User, error) {
313314
return user, nil
314315
}
315316

316-
func processGithubUserInfo(code string) (*models.User, error) {
317+
func processGithubUserInfo(ctx context.Context, code string) (*models.User, error) {
317318
var user *models.User
318-
oauth2Token, err := oauth.OAuthProviders.GithubConfig.Exchange(context.TODO(), code)
319+
oauth2Token, err := oauth.OAuthProviders.GithubConfig.Exchange(ctx, code)
319320
if err != nil {
320321
log.Debug("Failed to exchange code for token: ", err)
321322
return user, fmt.Errorf("invalid github exchange code: %s", err.Error())
@@ -420,9 +421,9 @@ func processGithubUserInfo(code string) (*models.User, error) {
420421
return user, nil
421422
}
422423

423-
func processFacebookUserInfo(code string) (*models.User, error) {
424+
func processFacebookUserInfo(ctx context.Context, code string) (*models.User, error) {
424425
var user *models.User
425-
oauth2Token, err := oauth.OAuthProviders.FacebookConfig.Exchange(context.TODO(), code)
426+
oauth2Token, err := oauth.OAuthProviders.FacebookConfig.Exchange(ctx, code)
426427
if err != nil {
427428
log.Debug("Invalid facebook exchange code: ", err)
428429
return user, fmt.Errorf("invalid facebook exchange code: %s", err.Error())
@@ -471,9 +472,9 @@ func processFacebookUserInfo(code string) (*models.User, error) {
471472
return user, nil
472473
}
473474

474-
func processLinkedInUserInfo(code string) (*models.User, error) {
475+
func processLinkedInUserInfo(ctx context.Context, code string) (*models.User, error) {
475476
var user *models.User
476-
oauth2Token, err := oauth.OAuthProviders.LinkedInConfig.Exchange(context.TODO(), code)
477+
oauth2Token, err := oauth.OAuthProviders.LinkedInConfig.Exchange(ctx, code)
477478
if err != nil {
478479
log.Debug("Failed to exchange code for token: ", err)
479480
return user, fmt.Errorf("invalid linkedin exchange code: %s", err.Error())
@@ -553,9 +554,9 @@ func processLinkedInUserInfo(code string) (*models.User, error) {
553554
return user, nil
554555
}
555556

556-
func processAppleUserInfo(code string) (*models.User, error) {
557+
func processAppleUserInfo(ctx context.Context, code string) (*models.User, error) {
557558
var user *models.User
558-
oauth2Token, err := oauth.OAuthProviders.AppleConfig.Exchange(context.TODO(), code)
559+
oauth2Token, err := oauth.OAuthProviders.AppleConfig.Exchange(ctx, code)
559560
if err != nil {
560561
log.Debug("Failed to exchange code for token: ", err)
561562
return user, fmt.Errorf("invalid apple exchange code: %s", err.Error())
@@ -606,9 +607,9 @@ func processAppleUserInfo(code string) (*models.User, error) {
606607
return user, err
607608
}
608609

609-
func processTwitterUserInfo(code, verifier string) (*models.User, error) {
610+
func processTwitterUserInfo(ctx context.Context, code, verifier string) (*models.User, error) {
610611
var user *models.User
611-
oauth2Token, err := oauth.OAuthProviders.TwitterConfig.Exchange(context.TODO(), code, oauth2.SetAuthURLParam("code_verifier", verifier))
612+
oauth2Token, err := oauth.OAuthProviders.TwitterConfig.Exchange(ctx, code, oauth2.SetAuthURLParam("code_verifier", verifier))
612613
if err != nil {
613614
log.Debug("Failed to exchange code for token: ", err)
614615
return user, fmt.Errorf("invalid twitter exchange code: %s", err.Error())
@@ -674,24 +675,24 @@ func processTwitterUserInfo(code, verifier string) (*models.User, error) {
674675
}
675676

676677
// process microsoft user information
677-
func processMicrosoftUserInfo(code string) (*models.User, error) {
678+
func processMicrosoftUserInfo(ctx context.Context, code string) (*models.User, error) {
678679
var user *models.User
679-
ctx := context.Background()
680680
oauth2Token, err := oauth.OAuthProviders.MicrosoftConfig.Exchange(ctx, code)
681681
if err != nil {
682682
log.Debug("Failed to exchange code for token: ", err)
683-
return user, fmt.Errorf("invalid google exchange code: %s", err.Error())
683+
return user, fmt.Errorf("invalid microsoft exchange code: %s", err.Error())
684684
}
685-
686-
verifier := oauth.OIDCProviders.MicrosoftOIDC.Verifier(&oidc.Config{ClientID: oauth.OAuthProviders.MicrosoftConfig.ClientID})
687-
685+
// we need to skip issuer check because for common tenant it will return internal issuer which does not match
686+
verifier := oauth.OIDCProviders.MicrosoftOIDC.Verifier(&oidc.Config{
687+
ClientID: oauth.OAuthProviders.MicrosoftConfig.ClientID,
688+
SkipIssuerCheck: true,
689+
})
688690
// Extract the ID Token from OAuth2 token.
689691
rawIDToken, ok := oauth2Token.Extra("id_token").(string)
690692
if !ok {
691693
log.Debug("Failed to extract ID Token from OAuth2 token")
692694
return user, fmt.Errorf("unable to extract id_token")
693695
}
694-
695696
// Parse and verify ID Token payload.
696697
idToken, err := verifier.Verify(ctx, rawIDToken)
697698
if err != nil {

‎server/resolvers/verify_otp.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ func VerifyOtpResolver(ctx context.Context, params model.VerifyOTPRequest) (*mod
6969
user, err = db.Provider.GetUserByPhoneNumber(ctx, refs.StringValue(params.PhoneNumber))
7070
}
7171
if user == nil || err != nil {
72-
fmt.Println("=> failing here....", err)
7372
log.Debug("Failed to get user by email or phone number: ", err)
7473
return res, err
7574
}

‎server/token/auth_token.go‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -386,7 +386,6 @@ func CreateIDToken(user *models.User, roles []string, hostname, nonce, atHash, c
386386
userBytes, _ := json.Marshal(&resUser)
387387
var userMap map[string]interface{}
388388
json.Unmarshal(userBytes, &userMap)
389-
fmt.Println("=> userBytes", string(userBytes))
390389
claimKey, err := memorystore.Provider.GetStringStoreEnvVariable(constants.EnvKeyJwtRoleClaim)
391390
if err != nil {
392391
claimKey = "roles"

0 commit comments

Comments
 (0)