{"action":"created","issue":{"url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/1","repository_url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin","labels_url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/1/comments","events_url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/1/events","html_url":"https://github.com/gvanderploeg/liferay-oidc-plugin/issues/1","id":180797781,"number":1,"title":"Issue in matching state param","user":{"login":"chintana","id":27903,"avatar_url":"https://avatars.githubusercontent.com/u/27903?v=3","gravatar_id":"","url":"https://api.github.com/users/chintana","html_url":"https://github.com/chintana","followers_url":"https://api.github.com/users/chintana/followers","following_url":"https://api.github.com/users/chintana/following{/other_user}","gists_url":"https://api.github.com/users/chintana/gists{/gist_id}","starred_url":"https://api.github.com/users/chintana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chintana/subscriptions","organizations_url":"https://api.github.com/users/chintana/orgs","repos_url":"https://api.github.com/users/chintana/repos","events_url":"https://api.github.com/users/chintana/events{/privacy}","received_events_url":"https://api.github.com/users/chintana/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-10-04T03:27:08Z","updated_at":"2016-10-04T07:40:27Z","closed_at":null,"body":"I'm testing OIDC plugin with WSO2 Identity Server. When it redirect after a successful login I get the following error in Liferay.\r\n\r\n<pre>\r\n03:04:13,636 INFO  [http-bio-8080-exec-7][OpenIDConnectFilter:147] Provided state parameter <b>'2e48dc844de1a6e94be1dc08b3eedf95'</b> does not equal expected <b>'92c251587d5cc607c4c7f0f2df1d5a37'</b>, cannot continue.\r\nOct 04, 2016 3:04:13 AM org.apache.catalina.core.StandardWrapperValve invoke\r\nSEVERE: Servlet.service() for servlet [Main Servlet] in context with path [] threw exception\r\njava.io.IOException: Invalid state parameter\r\n...\r\n</pre>\r\n\r\nWhen I look at the redirects it seems like Identity Server is sending the correct state parameter. See below trace,\r\n\r\nWhen I try to authenticate Liferay generate the following request and send to Identity Server\r\n<pre>\r\nHTTP/1.1 302 Found\r\nServer: Apache-Coyote/1.1\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nX-XSS-Protection: 1\r\nSet-Cookie: JSESSIONID=FD4DE44FE549C6BDAACD9615A9761224; Path=/; HttpOnly\r\nLocation: https://localhost:9443/oauth2/authorize?scope=openid+profile+email&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fc%2Fportal%2Flogin&<b>state=2e48dc844de1a6e94be1dc08b3eedf95</b>&client_id=4U2friUHdvkyTPazAlGyblSWi6Ia\r\nContent-Length: 0\r\nDate: Tue, 04 Oct 2016 03:04:09 GMT\r\n</pre>\r\n\r\nIdentity Server, after a successful login redirect with following,\r\n<pre>\r\nGET /c/portal/login?code=7bc0b59a-b36f-33ea-87eb-30f63f857d8f&<b>state=2e48dc844de1a6e94be1dc08b3eedf95</b>&session_state=6551ef8e441ae6713a3e543b47a2040653498e85435c388439a10917450eb6b2.3Db30aZASYeVb2IV0mcQgA HTTP/1.1\r\nHost: localhost:8080\r\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:49.0) Gecko/20100101 Firefox/49.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en\r\nAccept-Encoding: gzip, deflate\r\nCookie: COOKIE_SUPPORT=true; GUEST_LANGUAGE_ID=en_US\r\nDNT: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\n</pre>\r\n\r\nTo me it seems like when the OIDC plugin generate the state, that's not somehow persisted for the access token generation request?\r\n\r\nBTW is the code for the plugin available somewhere? Thanks."},"comment":{"url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/comments/251316511","html_url":"https://github.com/gvanderploeg/liferay-oidc-plugin/issues/1#issuecomment-251316511","issue_url":"https://api.github.com/repos/gvanderploeg/liferay-oidc-plugin/issues/1","id":251316511,"user":{"login":"chintana","id":27903,"avatar_url":"https://avatars.githubusercontent.com/u/27903?v=3","gravatar_id":"","url":"https://api.github.com/users/chintana","html_url":"https://github.com/chintana","followers_url":"https://api.github.com/users/chintana/followers","following_url":"https://api.github.com/users/chintana/following{/other_user}","gists_url":"https://api.github.com/users/chintana/gists{/gist_id}","starred_url":"https://api.github.com/users/chintana/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chintana/subscriptions","organizations_url":"https://api.github.com/users/chintana/orgs","repos_url":"https://api.github.com/users/chintana/repos","events_url":"https://api.github.com/users/chintana/events{/privacy}","received_events_url":"https://api.github.com/users/chintana/received_events","type":"User","site_admin":false},"created_at":"2016-10-04T07:40:27Z","updated_at":"2016-10-04T07:40:27Z","body":"This is happening because the JSESSIONID that comes back from the server is different from the one that was used to generate it.\r\n\r\nSo initially state is calculated using the existing JSESSIONID (ran it through a decompiler),\r\n```\r\n  protected String generateStateParam(HttpServletRequest request)\r\n  {\r\n    return DigestUtils.md5Hex(request.getSession().getId());\r\n  }\r\n```\r\n\r\nError in Liferay,\r\n<pre>\r\n07:20:31,567 INFO  [http-bio-8080-exec-12][OpenIDConnectFilter:147] Provided state parameter \r\n'4ec426ee0bc34938b06dd62c9848fe0d' does not equal expected \r\n'be7e94741bd61d109e9992e33cd06092', cannot continue.\r\n</pre>\r\n\r\nFirst request,\r\n<img width=\"1001\" alt=\"screen shot 2016-10-04 at 12 29 56 am\" src=\"https://cloud.githubusercontent.com/assets/27903/19065752/273334a8-89ca-11e6-9c52-b5a902dfdba4.png\">\r\n\r\nmd5(1CCA4BC8C36FD762F7128C17F1FFA26C) = 4ec426ee0bc34938b06dd62c9848fe0d\r\n\r\nFrom the last request,\r\n<img width=\"1033\" alt=\"screen shot 2016-10-04 at 12 30 26 am\" src=\"https://cloud.githubusercontent.com/assets/27903/19065769/448fa946-89ca-11e6-9ee2-43cd68937930.png\">\r\n\r\nmd5(588ABF86872E5E192DA33EE8FE3E319C) = be7e94741bd61d109e9992e33cd06092\r\n\r\nWhen you generate the state param from Liferay and send, may be you can \"remember\" it and match it with whatever comes back from the redirect? Correct me if I'm wrong, the authorization server is suppose to return back whatever it see in the state param without changing it."}}
{"actor":{"display_login":"chintana"}}