Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changes in public url format requirements have broken SSO callback urls #3924

Closed
tapioca-sublime opened this issue Nov 27, 2024 · 0 comments · Fixed by #3926
Closed

Changes in public url format requirements have broken SSO callback urls #3924

tapioca-sublime opened this issue Nov 27, 2024 · 0 comments · Fixed by #3926

Comments

@tapioca-sublime
Copy link

tapioca-sublime commented Nov 27, 2024

The changes introduced in #3862 have broken SSO callback urls when using GUI.base_path

This is because the following condition in frontend.go requires /app/index.html to be appended to the public url

 if !strings.HasSuffix(config_obj.GUI.PublicUrl,
				config_obj.GUI.BasePath+"/app/index.html") {

Resulting in /app/index.html to be inserted in the middle of the callback url which is set up in bin/config_interactive.go

	case "GitHub":
		redirect = config_obj.GUI.PublicUrl + "auth/github/callback"
	case "Azure":
		redirect = config_obj.GUI.PublicUrl + "auth/azure/callback"
	case "OIDC":
		redirect = config_obj.GUI.PublicUrl + "auth/oidc/callback"

The redirect url in SSO provider must match the callback url supplied by Velociraptor. The registration is still successful, however, you are then redirect to an invalid page (e.g. https://www.example.com/velociraptor/app/index.html/velociraptor/auth/azure/callback?code=token_token_token_token which give a 404 error) and you need to manually modified the url (e.g. to https://www.example.com/velociraptor/auth/azure/callback?code=token_token_token_token)

scudette added a commit that referenced this issue Jan 14, 2025
Added test to ensure base path works correctly with all the
authentication mechanisms.

Fixes: #3924

---------

Co-authored-by: snyk-bot <[email protected]>
scudette added a commit that referenced this issue Jan 14, 2025
Added test to ensure base path works correctly with all the
authentication mechanisms.

Fixes: #3924

---------

Co-authored-by: snyk-bot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant