OAuth SSO with google gives 404/wrong redirect

[justinas-b]

Hey! I am struggling to setup SSO through OAuth, At the moment my configuration looks like:

...
auth:
  callback_url_prefix: https://wg.mydomain.net/api/v0
  oauth:
    - id: google
      provider_name: google
      display_name: Google
      base_url: https://accounts.google.com/
      client_id: [REDACTED]
      client_secret: [REDACTED]
      auth_url: https://accounts.google.com/o/oauth2/v2/auth
      token_url: https://oauth2.googleapis.com/token
      user_info_url: https://openidconnect.googleapis.com/v1/userinfo
      #redirect_url: https://wg.mydomain.net/api/v0/google/callback
      scopes:
        - openid
        - email
        - profile
      field_map:
        email: email
        firstname: name
        user_identifier: preferred_username
        is_admin: roles
      registration_enabled: false

When i try to login using google, i am getting 404 error

Nov 04 11:12:47 vpn-01 wg-portal-amd64[586117]:
  time="2024-11-04T11:12:47+02:00"
  level=warning
  clientIP=10.100.1.4
  dataLength=0
  hostname=vpn-01
  latency=1
  method=GET
  path="/api/v0https://wg.mydomain.net/api/v0/google/init"
  referer="https://wg.mydomain.net/app/"
  statusCode=404
  userAgent="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15"
  msg="10.100.1.4 - vpn-01 [04/Nov/2024:11:12:47 +0200] \"GET /api/v0https://wg.mydomain.net/api/v0/google/init\" 404 0 \"https://wg.mydomain.net/app/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15\"
    (1ms)"

I think the redirect url is broken, specifically this line path="/api/v0https://wg.mydomain.net/api/v0/google/init". Any ideas how to fix this?

[justinas-b]

If i set callback_url_prefix: "", redirection seems to be fixed:
https://wg.mydomain.net/api/v0/google/init?redirect=true&return=https%3A%2F%2Fwg.mydomain.net%2F%23%2Flogin

However i am still getting 404

[justinas-b]

I am running v2 alpha.2

[dithmer]

Same happened with OAuth with Entra ID.

I am working on a fix right now.

[bonddim]

@dithmer , this is my working config:

config.yaml

config:
  web:
    external_url: https://${WG_PORTAL_DNS_HOSTNAME}
  auth:
    callback_url_prefix: "https://${WG_PORTAL_DNS_HOSTNAME}/api/v0"
    oidc:
      - id: azure
        provider_name: azure
        display_name: Login with Azure
        registration_enabled: true
        base_url: "https://login.microsoftonline.com/${TENANT_ID}/v2.0"
        client_id: "${WG_PORTAL_CLIENT_ID}"
        client_secret: "${WG_PORTAL_CLIENT_SECRET}"
        extra_scopes:
          - profile
          - email
        field_map:
          user_identifier: email
          is_admin: admin

Application config on Entra ID

Api permissions

App role for admins

Assign Admin role to group in Enterprise applications

Additional token config (probably not needed)

Result

[bonddim]

As you may see, I'm using oidc not oauth.
oauth also didn't work for me, when I tried it.

[dithmer]

Thank you for the clarity and the alternative for the moment!

Nevertheless did I already find the issue in the OAuth Flow. I just need some time to properly fix and test it. :)