openid not working with webapi/atlas when using Azure AD application #1711
Description
I have configured openid to use an azure AD application and go through the entire openid login flow but in the end the user is not authenticated and I see "Log in" on the Atlas page. I am compiling webapi from source and using latest code for both webapi and atlas (I first tried with github ouath in a different environment and was able to authenticate ok)
I've noticed in the openid flow one of the location headers is wrong for calling url https://xxx.xxx.xxx/WebAPI/user/login/openid?redirectUrl=/home. location header has the home url and encoded data appended directly to it without a parameter
Location: https://xxx.xxx.xxx/atlas/#/welcomeeyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJleHQxMTA0ODg0MEBodXN0aWV0b2FsbGFzLmZpIiwiZXhwIjoxNjA2OTc5Mzc1fQ.TeUHdAwEo_5Cq7h9GwV9VY5-cGNk311o4-hQ1CtpTjgupUrQJBmKlgNOpg3ardMnLi8ZBLVpcUXjopSco4nnqA
And here is that same location header when I try out the github auth
Location: http://xxx.xxx.xxx/atlas/#/welcome/null/eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJzaGFtYmVyZ2VybUBnbWFpbC5jb20iLCJleHAiOjE2MDcwNDk4MDF9.aoaV-NgGGpL8jBLlGKXzQwBC7FFtPANSa1Sih9HdmelWeiFxPRFki7xi9MvQ0rEHzyAaRoHOB-m0yVIE16lONw/%2Fhome
security.provider=AtlasRegularSecurity
security.cors.enabled=true
security.token.expiration=43200
security.origin=*
security.ssl.enabled=false (terminating ssl in nginx in front of webapi/atlas)
security.oid.clientId=xxxxx
security.oid.apiSecret=xxxxx
security.oid.url=https://login.microsoftonline.com/xxxxx/v2.0/.well-known/openid-configuration
security.oid.redirectUrl=https://xxx.xxx.xxx/atlas/#/welcome
security.oid.logoutUrl=https://xxx.xxx.xxx/atlas/#/welcome
I have added some extra logging and do not see any errors in webapi:
2020-12-02 06:41:14.075 DEBUG http-nio-8080-exec-5 org.pac4j.core.engine.DefaultSecurityLogic - - authorizers: null
2020-12-02 06:41:14.075 DEBUG http-nio-8080-exec-5 org.pac4j.core.authorization.checker.DefaultAuthorizationChecker - - Checking authorizer: org.pac4j.core.authorization.authorizer.CsrfAuthorizer@353edea7 -> true
2020-12-02 06:41:14.075 DEBUG http-nio-8080-exec-5 org.pac4j.core.engine.DefaultSecurityLogic - - authenticated and authorized -> grant access
2020-12-02 06:41:14.075 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - Checking principal
2020-12-02 06:41:14.076 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - use preferred_username if email is null
2020-12-02 06:41:14.076 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - session is not null so stopping // stop session to make logout of OAuth users possible
2020-12-02 06:41:14.244 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - creating jwt token
2020-12-02 06:41:14.410 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - setting jwt to token attribute
2020-12-02 06:41:14.484 INFO http-nio-8080-exec-5 org.ohdsi.webapi.shiro.filters.UpdateAccessTokenFilter - - permissions: [source:daimon:priority:get, source:*:get, user:me:get, role:*:get, cache:clear:get, role:*:users:get, source:post, user:import:job:*:delete, *:person:*:get:dates, user:import:*:mapping:post, user:import:job:*:put, permission:get, role:post, user:runas:post, user:import:*:mapping:get, user:import:job:*:history:get, comparativecohortanalysis:*:put, user:import:job:*:get, user:import:*:post, user:get, role:*:permissions:get, source:details:*:get, cohortanalysis:post, role:*:users:*:put, comparativecohortanalysis:*:copy:get, user:import:job:get, configuration:edit:ui, role:get, user:import:job:post, source:*:daimons:*:set-priority:post, user:providers:get, user:import:*:test:get, user:import:*:groups:get, user:import:post, role:1:permissions:*:delete, comparativecohortanalysis:*:delete, role:1:permissions:*:put, role:*:users:*:delete, source:connection:*:get, source:*:put, source:*:delete]
In Atlas, I am seeing the following after the authentication redirects:
There was another issue that openid is using the user email as a required field though some organizations may not use this field. I was able to workaround this by adding the following code in filters/UpdateAccessTokenFilter.java. It would be good to be able to specify an alternate field besides email.
/**
* If email or name not set then use another field
*/
if (login == null && ((Pac4jPrincipal)principal).getProfile().getAttribute("preferred_username") != null) {
logger.info("use preferred_username if email is null");
login = ((Pac4jPrincipal)principal).getProfile().getAttribute("preferred_username").toString();
}
if (name == null && ((Pac4jPrincipal)principal).getProfile().getAttribute("preferred_username") != null) {
logger.info("use preferred_username if name is null");
name = ((Pac4jPrincipal)principal).getProfile().getAttribute("preferred_username").toString();
}