Google OAuth2

[jimiflowers]

Hi. I wonder if OAuth.pm works with Google OAuth2, because I tried and get "cannot get oauth data" error.

I'm using OMD Labs version 4.20

Here my oauth config:

<auth_oauth>

login = "Google Account Login"
client_id = MY_CLIENT_ID
client_secret = MY_CLIENT_SECRET
scopes = openid profile email
auth_url = https://accounts.google.com/o/oauth2/v2/auth
token_url = https://accounts.google.com/o/oauth2/v2/token
api_url = https://accounts.google.com/o/oauth2/v2/userinfo
login_field = email

</auth_oauth>

Greetings!

[sni]

Those urls are wrong, use these and it should work:

  <provider>
    login = "Google Account Login"
    client_id = ...
    client_secret = ...
    scopes = openid profile email
    auth_url = https://accounts.google.com/o/oauth2/v2/auth
    token_url = https://oauth2.googleapis.com/token
    api_url = https://openidconnect.googleapis.com/v1/userinfo
    login_field = email
  </provider>

I also started a page with some common examples here: https://thruk.org/documentation/oauth2.html

[patrick-nomblot]

hello,

it works fine going to the login url but in my case, unauthenticated users not redirected to login.
I think I'm missing something but I can't find the solution in the documentation.
A little nudge in the right direction would be greatly appreciated.

[sni]

what happens instead if a user is unauthenticated?

[patrick-nomblot]

Hello,

I created a 'generic' user in icinga : /omd/sites/monitoring/etc/icinga2/conf.d/users-omd.conf
and defined this account also in Thruk with https://1.2.3.4/monitoring/thruk/cgi-bin/conf.cgi?sub=users
I also disabled auth in /omd/sites/monitoring/etc/apache/conf.d/auth.conf

with this, the behavior is not bad :
if user is not authentified, the generic user is used on Thruk, else, the authenticated google user via oauth.

I can easily setup authentication in apache (AD, LDAP, htpasswd, etc...) pushing REMOTE_USER, but did not get it working with thruk. So I tryied the Google OAUTH with looks working better. So, there is something I do not understand with Thruk session cookies / external apache auth. I also do not understand the magic that make the generic account I created to be used when not authenticated with oauth.

Your help would be appreciated, many thanks.

[patrick-nomblot]

I've made some progress in my testing and I have a better understanding of what I don't understand. Here are some things that can help me:

If I go directly to the Thruk interface without going through the login CGI, for example directly to: https://monitoring.flowbird.group/monitoring/thruk/cgi-bin/main.cgi

I see the Thruk interface ans I'm am automaticcaly logged as the user I created on Thruk from the omdadmin account (flowbird).

But I don't know by what magic this account is chosen, is it simply the first one in the list?

If I go through the login CGI, I can log in via Google and everything works as expected, I just have to configure the authenticated user account on the Thruk interface.

So I am missing the understanding of the authentication mechanism that selects an account if there is no authentication. I have never been able to configure Apache authentication by injecting the BASIC AUTH header either, only the cookie mechanism seems to be used and I think it is around the cookie and the URL path that I lack understanding

your help will be highly appreciated.

[ioxxoi]

Hi, they are a little bug in the logging at:

file : lib/Thruk/Utils/OAuth.pm
line: 201
original line: return $c->detach_error({msg => "cannot get oauth data", code => 500, debug_information => { res => $res } });

the $res var is a class, to see the error message, you need to use the next alternative line:

return $c->detach_error({msg => "cannot get oauth data", code => 500, debug_information => { res => $res**->content** } });

now you can see the message, in my case is a problem with the ca file, note that thruk is not using the system ca file, and you need to include it in the config file:

etc/thruk/thruk_local.conf
ssl_ca_file= /etc/ssl/my_cac_ert.pem

[sni]

which version is this? Because $res is expanded later into a textual representation:
https://github.com/sni/Thruk/blob/master/lib/Thruk/Utils/Filter.pm#L520-L521