Help needed with CustomSSOProvider Configuration for GitHub Enterprise

[jay0129]

Description:

I am seeking help with configuring the CustomSSOProvider for our GitHub Enterprise (GHE) environment. Here are the details of what I have attempted and encountered.

Current Setup:

• We are using GitHub Enterprise instead of gitHub.com. Here is the relevant documentation: GitHub Enterprise Server 3.12.

Initial Implementation Approach:

• As GitHubProvider with endpoint overriding is not supported, I decided to try the CustomSSOProvider. However, this approach doesn't seem to be working as expected.

Environment Variables for Langfuse Web Server:

- name: AUTH_CUSTOM_CLIENT_ID
  value: "xxx"
- name: AUTH_CUSTOM_CLIENT_SECRET
  value: "yyy"
- name: AUTH_CUSTOM_ALLOW_ACCOUNT_LINKING
  value: "true"
- name: AUTH_CUSTOM_CLIENT_ISSUER
  value: "https://git.mycom.com"
- name: AUTH_CUSTOM_NAME
  value: "GHE"
- name: AUTH_CUSTOM_SCOPE
  value: "read:user user:email"

Previous Attempts:

• I have attempted both the GitHub App (with email read permission enabled) and GitHub OAuth configurations.

Additional Information:

• I've included a screenshot for reference. The button seems to be missing:

---

If further information is needed, or there are specific questions you'd like to ask, feel free to let me know!

[dosubot[bot]]

To configure the CustomSSOProvider for your GitHub Enterprise environment, you can follow the example setup provided below. It seems like you have most of the necessary environment variables set up correctly. Here's a refined approach to ensure everything is configured properly:

1. CustomSSOProvider Configuration:

   Make sure your CustomSSOProvider is set up like this:

   import { CustomSSOProvider } from '@langfuse/shared/src/server';
   
   const githubEnterpriseSSOProvider = CustomSSOProvider({
     id: 'ghe', // Identifier for your provider
     issuer: 'https://git.mycom.com', // Your GitHub Enterprise domain
     clientId: process.env.AUTH_CUSTOM_CLIENT_ID,
     clientSecret: process.env.AUTH_CUSTOM_CLIENT_SECRET,
     authorization: {
       params: {
         scope: 'read:user user:email', // Scopes you want to request
       },
     },
     allowDangerousEmailAccountLinking: process.env.AUTH_CUSTOM_ALLOW_ACCOUNT_LINKING === 'true',
   });

2. Environment Variables:

   Ensure that your environment variables are correctly set and accessible in your application. Double-check that AUTH_CUSTOM_CLIENT_ID, AUTH_CUSTOM_CLIENT_SECRET, and other variables are correctly loaded.

3. OAuth Configuration:

   • Verify that your GitHub Enterprise OAuth app is correctly configured with the necessary callback URLs and permissions.
   • Ensure that the clientId and clientSecret match those provided by your GitHub Enterprise OAuth app.

4. Debugging:

   • Check the logs for any error messages that might indicate what is going wrong.
   • Ensure that your GitHub Enterprise server is accessible from the environment where your Langfuse application is running.

5. Security Considerations:

   • Make sure your clientSecret is encrypted when stored and decrypted when used, as shown in the dbToNextAuthProvider function ^[1].

If you continue to encounter issues, reviewing the logs for specific error messages can provide more insight into what might be going wrong.

To continue talking to Dosu, mention @dosu.

[marcklingen]

Thanks for raising this, I've also double checked this and the default GitHub provider does not support GHE: https://next-auth.js.org/providers/github

What behavior do you get when setting these variables?

AUTH_CUSTOM_CLIENT_ID
AUTH_CUSTOM_CLIENT_SECRET
AUTH_CUSTOM_ISSUER
AUTH_CUSTOM_NAME

[jay0129]

There is no button on the login page, so I can't login.

[jay0129]

After re configuring, I found the button but got 401 or 301 error from the pod log.

I guess modifying source code is necessary because GitHub login requires 3 endpoints. and there is only one Env variable for url injection.

• accessTokenUrl: "https://your-ghe-instance.com/login/oauth/access_token",
• authorizationUrl: "https://your-ghe-instance.com/login/oauth/authorize",
• profileUrl: "https://your-ghe-instance.com/api/v3/user",

[marcklingen]

do you feel comfortable adding this via a PR?

[jay0129]

@marcklingen
I open PR
#4463

[jay0129]

I found GHE patch for next auth:
https://github.com/nextauthjs/next-auth/blob/main/packages/core/src/providers/github.ts#L124-L138

But it is not applied to 4.24.7
https://github.com/nextauthjs/next-auth/blob/next-auth%404.24.7/packages/next-auth/src/providers/github.ts

[marcklingen]

Thanks for sharing, just checked again, unfortunately also not available on the latest 4.x release but it requires 5.x which is not GA yet, would be awesome if this was added to 4.x

[marcklingen]

thanks for opening the PR, let's continue the conversation there: #4463