Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

quarkus-oidc does not build final redirect uri with https when using force-redirect-https-scheme=true #12130

Closed
funcbro opened this issue Sep 16, 2020 · 0 comments · Fixed by #12143
Labels
area/oidc kind/bug Something isn't working
Milestone

Comments

@funcbro
Copy link

funcbro commented Sep 16, 2020

Describe the bug
When using quarkus:oidc with "quarkus.oidc.authentication.force-redirect-https-scheme=true" the final redirect uri is created with http instead of https.
After authentication via an oidc provider the final redirect points to an non-existent http adress.
Authentication is still successful. When manually correcting the url to https, one can access the protected endpoints.

Quarkus Service runs in a container on http port in OpenShift.
The Routing adds ssl security.

see https://github.com/quarkusio/quarkus/blob/master/extensions/oidc/runtime/src/main/java/io/quarkus/oidc/runtime/CodeAuthenticationMechanism.java#L410

private String buildUri(RoutingContext context, boolean forceHttps, String path) {
        final String scheme = forceHttps ? "https" : context.request().scheme();
        return new StringBuilder(scheme).append("://")
                .append(URI.create(context.request().absoluteURI()).getAuthority())
                .append(path)
                .toString();
    }

    private String buildUriWithoutQueryParams(RoutingContext context) {
        URI absoluteUri = URI.create(context.request().absoluteURI());
        return new StringBuilder(context.request().scheme()).append("://")
                .append(absoluteUri.getAuthority())
                .append(absoluteUri.getRawPath())
                .toString();
    }

--> https configuration is only used in buildUri(), but not in buildUriWithoutQueryParams()

Expected behavior
https is used instead of http for:

  1. redirect_uri when calling oidc-provider
  2. after authentication for local redirect requests in quarkus e.g. when redirecting back to the original url.

Actual behavior

  1. redirect_uri for oidc-provider is https -> everything fine
  2. Final redirect URI created by CodeAuthenticationMechanism uses http instead of https
    (Describe the actual behavior clearly and concisely.)

To Reproduce
Steps to reproduce the behavior:

  1. configure as specified below
  2. run quarkus on http port within container and routing configuration for https
  3. access service unauthorized
  4. authorize
    -> redirects to https service. oidc-extension builds the final redirect uri with http resulting in redirect to nonexistent address

Configuration

quarkus.oidc.application-type=web-app
quarkus.oidc.authentication.force-redirect-https-scheme=true
quarkus.oidc.authentication.redirect-path=/
quarkus.oidc.authentication.restore-path-after-redirect=true
quarkus.oidc.authentication.remove-redirect-parameters=true

Screenshots

2020-09-16 09:33:41,005 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-1) Authentication request redirect_uri parameter: https://service.domain.net/ 
2020-09-16 09:33:41,006 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-1) q_auth cookie 'max-age' parameter is set to 1800
2020-09-16 09:33:41,007 INFO  [io.qua.htt.access-log] (vert.x-eventloop-thread-1) 10.221.13.1 - - 16/Sep/2020:09:33:41 +0000 "GET / HTTP/1.1" 302 -
2020-09-16 09:33:41,105 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-1) Token request redirect_uri parameter: https://service.domain.net/ 
2020-09-16 09:33:41,229 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-1) q_session cookie 'max-age' parameter is set to 7200
2020-09-16 09:33:41,229 DEBUG [io.qua.oid.run.CodeAuthenticationMechanism] (vert.x-eventloop-thread-1) Final redirect URI: http://service.domain.net/ 

--> Final redirect URI is http instead of https

Environment (please complete the following information):

  • Output of uname -a or ver:
  • Output of java -version:
    openjdk version "11.0.7" 2020-04-14
    OpenJDK Runtime Environment GraalVM CE 20.1.0 (build 11.0.7+10-jvmci-20.1-b02)
    OpenJDK 64-Bit Server VM GraalVM CE 20.1.0 (build 11.0.7+10-jvmci-20.1-b02, mixed mode, sharing)
  • GraalVM version (if different from Java):
  • Quarkus version or git rev: 1.7.3
  • Build tool (ie. output of mvnw --version or gradlew --version): 3.6.3

Additional context
(Add any other context about the problem here.)

@funcbro funcbro added the kind/bug Something isn't working label Sep 16, 2020
@gsmet gsmet added this to the 1.8.1.Final milestone Sep 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/oidc kind/bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants