plugin-oauth2

plugin-oauth2 copied to clipboard

Actual behaviour

External authentication failed and Warning: Undefined array key "id" in /var/www/app/plugins/OAuth2/User/GenericOAuth2UserProvider.php on line 266 is thrown when using Azure AD as identity provider.

GitHub auth works as intended - Likely something not supported in GenericOAuth2UserProvider.php for Azure AD?

Expected behaviour

Authentication is successful

Steps to reproduce

Add following config in OAuth2 Plugin: Callback URL: https://kanboard.domain.com/oauth/callback Client ID: ******************* Client Secret: ******************************** Authorize URL: https://login.microsoftonline.com/common/oauth2/authorize Token URL: https://login.microsoftonline.com/common/oauth2/token User API URL: https://graph.microsoft.com/beta/me Scopes: User.Read or openid (happens regardless of scope) Username Key: userPrincipalName Name Key: displayName Email Key: mail User ID Key: id (Undefined array key always thrown regardless of value here) Allow Account Creation: Any Allow account creation only for those domains: Empty Groups Key: Empty Group Filter: Empty

Configuration

• Plugin version: 1.0.2
• Kanboard version: 1.2.23
• Database type and version: SQLite
• PHP version: Whatever comes with 1.2.23
• OS: Docker Compose on Ubuntu 20.04
• Browser: MS Edge
• Reverse proxy: caddy - pointing to kanboard.domain.com on port 443

docker-compose.yml version: '2' services: kanboard: image: kanboard/kanboard:latest ports: - "9443:80" volumes: - ./kanboard_kanboard_data/_data:/var/www/app/data - ./kanboard_kanboard_plugins/_data:/var/www/app/plugins - ./config.php:/var/www/app/config.php

config.php: config.php.txt

Same issue with Keycloak 18.

Same issue with Azure AD and same settings as above except the callback URL https://kanboard.domain.com/?controller=OAuthController&action=handler&plugin=OAuth2

Has anyone been able to get it working with AzureAD?

Same issue with Authelia:

Warning: Undefined array key "id" in /var/www/app/app/Core/User/UserProfile.php on line 56

That's the only error thrown regardless of the configuration for the User ID Key

---

Configuration:

Callback URL: https://kanboard.example.com/?controller=OAuthController&action=handler&plugin=OAuth2 Client ID: ******** Client Secret: ************************ Authorize URL: https://authelia.example.com/api/oidc/authorization Token URL: https://authelia.example.com/api/oidc/token User API URL: https://authelia.example.com/api/oidc/userinfo Scopes: openid profile groups email Username Key: preferred_username Name Key: name Email Key: email User ID Key: sub

Allow Account Creation: Checked

---

Please let me know if any other information is required, I can atleast confirm that OIDC works for my other applications e.g. Portainer.

I'm getting the same error as @yash-ahir while using Authentik.

If you're tweaking your configuration as you try to connect, remember to close and re-open a private browsing session and use a clean URL before retrying to connect. I had the exact same issue as OP (with Azure AD) even though my settings were right. In a clean environment I was able to connect.

I found a workaround to this problem

1. add define('LDAP_GROUP_SYNC', false); to config.php
2. have the user first login with their kanboard user/password combo, then navigate to 'My Profile > External Accounts (under Actions)' and click 'Link OAuth2 Account'

Works using Authentik 2023.06

I needed to change the User API URL from:

https://graph.microsoft.com/beta/me

to:

https://graph.microsoft.com/v1.0/me

I had the same issue with Azure AD due to using the wrong (v1) endpoints, had to switch to the v2 endpoints to make it work. https://login.microsoftonline.com/<uuid>/oauth2/authorize (v1, not working) vs. https://login.microsoftonline.com/<uuid>/oauth2/v2.0/authorize (v2, working) and https://login.microsoftonline.com/<uuid>/oauth2/token (v1, not working) vs. https://login.microsoftonline.com/<uuid>/oauth2/v2.0/token (v2, working).

I needed to change the User API URL from:

https://graph.microsoft.com/beta/me

to:

https://graph.microsoft.com/v1.0/me

this is the right endpoint and this works. Doc may be updated