{"action":"created","issue":{"url":"https://api.github.com/repos/mattermost/platform/issues/3944","repository_url":"https://api.github.com/repos/mattermost/platform","labels_url":"https://api.github.com/repos/mattermost/platform/issues/3944/labels{/name}","comments_url":"https://api.github.com/repos/mattermost/platform/issues/3944/comments","events_url":"https://api.github.com/repos/mattermost/platform/issues/3944/events","html_url":"https://github.com/mattermost/platform/issues/3944","id":174894490,"number":3944,"title":"Mattermost generates wrong redirect uri for SSO authentication","user":{"login":"jdoubleu","id":11274444,"avatar_url":"https://avatars.githubusercontent.com/u/11274444?v=3","gravatar_id":"","url":"https://api.github.com/users/jdoubleu","html_url":"https://github.com/jdoubleu","followers_url":"https://api.github.com/users/jdoubleu/followers","following_url":"https://api.github.com/users/jdoubleu/following{/other_user}","gists_url":"https://api.github.com/users/jdoubleu/gists{/gist_id}","starred_url":"https://api.github.com/users/jdoubleu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdoubleu/subscriptions","organizations_url":"https://api.github.com/users/jdoubleu/orgs","repos_url":"https://api.github.com/users/jdoubleu/repos","events_url":"https://api.github.com/users/jdoubleu/events{/privacy}","received_events_url":"https://api.github.com/users/jdoubleu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-09-03T12:26:47Z","updated_at":"2016-10-15T10:26:13Z","closed_at":"2016-09-14T18:17:42Z","body":"Maybe it's a bit late but the bug still exists.\r\n\r\nThere was a long issue about a bug where singing-in into Mattermost through GitLab doesn't work if Mattermost is behind a reverse proxy and this proxy communicates with HTTP with Mattermost while the user is facing the page with HTTPS (because the proxy support SSL). You can read it [here](https://github.com/mattermost/platform/issues/1899).\r\n\r\nFirst of all:\r\n\r\n#### Summary\r\nSingin-in/Authenticating via SSO with GitLab won't work because the generated URI contains the wrong protocol if Mattermost ist behind a proxy, communicating with HTTP, and the page URL isn't set in Mattermost's settings.\r\n\r\n#### Steps to reproduce\r\n* Run Mattermost behind a reverse proxy,\r\n* let the proxy communicate with Mattermost via HTTP,\r\n* configure the proxy to support HTTPS for the user,\r\n* enable SSO with GitLab,\r\n* _finally_: try to log-in\r\n\r\n#### Expected behavior\r\nAfter clicking the SSO button on Mattermost, it will redirect me to GitLab where I have to login-in and authorize the Application to use my account data. After authorizing GitLab should redirect me to Mattermost where I'm logged in now.\r\n\r\n#### Observed behavior\r\nAfter clicking the SSO button GitLab will fail (with the error message: `The redirect URI included is not valid.`) due to the fact, that the `redirect_uri` query param doesn't match the provided `client_id`.\r\n\r\n#### Possible fixes\r\nOne simple fix might be to set the page url of Mattermost in its settings.\r\n\r\n\r\nI've inspected the code and I wanted to share my results here.\r\n\r\nClicking the GitLab button on the log-in page of Mattermost will redirect me to `/api/v3/oauth/gitlab/login`, this API call with initiate a 302 redirect to GitLab `https://gitlab.example.com/oauth/authorize?response_type=code&client_id=_64_length_string&redirect_uri=http%3A%2F%2Fmattermost.example.com%2Fsignup%2Fgitlab%2Fcomplete&state=_another_long_string`.\r\n\r\nThis redirect is managed inside the `api/oauth.go` file, where [on line 727]((https://github.com/mattermost/platform/blob/master/api/oauth.go#L727)) the link is generated.\r\n\r\nThe function `GetSiteUrl` in [`api/context.go`, line 462](https://github.com/mattermost/platform/blob/master/api/context.go#L462) gets called which only returns the actual site url.\r\n\r\nThe current site url is set in the [`ServeHTTP` function in the `context.go` file](https://github.com/mattermost/platform/blob/master/api/context.go#L102), on [line 145](https://github.com/mattermost/platform/blob/master/api/context.go#L145) this will set the url set by the user, if it exists, or, if not, generate it with the protocol and host.\r\n\r\nTo get the protocol, this function calls the [`GetProtocol` function in `context.go` on line 267](https://github.com/mattermost/platform/blob/master/api/context.go#L267).\r\n\r\nAlthough this function tries to get the `X-Forwarded-Proto` (client header call on line 268, using the [`HEADER_FORWARDED_PROTO`](https://github.com/mattermost/platform/blob/master/model/client.go#L28) constant) it get's the wrong protocol.\r\n\r\nMy proxy serves the `X-Forwarded-Proto` header correctly to Mattermost.\r\nI didn't test what went wrong in the `GetProtocol` function.\r\n\r\n\r\nAlso one thing I want to point out is that there is a newer standardized form of the `Forwared` headers (see [RFC 7239](https://tools.ietf.org/html/rfc7239)) which should be recognized."},"comment":{"url":"https://api.github.com/repos/mattermost/platform/issues/comments/253975747","html_url":"https://github.com/mattermost/platform/issues/3944#issuecomment-253975747","issue_url":"https://api.github.com/repos/mattermost/platform/issues/3944","id":253975747,"user":{"login":"jdoubleu","id":11274444,"avatar_url":"https://avatars.githubusercontent.com/u/11274444?v=3","gravatar_id":"","url":"https://api.github.com/users/jdoubleu","html_url":"https://github.com/jdoubleu","followers_url":"https://api.github.com/users/jdoubleu/followers","following_url":"https://api.github.com/users/jdoubleu/following{/other_user}","gists_url":"https://api.github.com/users/jdoubleu/gists{/gist_id}","starred_url":"https://api.github.com/users/jdoubleu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdoubleu/subscriptions","organizations_url":"https://api.github.com/users/jdoubleu/orgs","repos_url":"https://api.github.com/users/jdoubleu/repos","events_url":"https://api.github.com/users/jdoubleu/events{/privacy}","received_events_url":"https://api.github.com/users/jdoubleu/received_events","type":"User","site_admin":false},"created_at":"2016-10-15T10:26:12Z","updated_at":"2016-10-15T10:26:12Z","body":"Okay I rechecked all my settings and the problem still exists.\r\n\r\n**Here's my setup:**\r\n\r\nI'm currently using GitLab `8.12.6` Omnibus which runs under `https://git.example.com`.\r\nI couldn't determine the exact version of Mattermost but I'm using the `latest` docker image (image ID `35281f9a2aa2` created 6 days ago).\r\nMattermost is accessible under `https://mattermost.example.com`.\r\n\r\nBoth GitLab and Mattermost are running behind a reverse proxy which communicates via HTTP with them but over HTTPS with be client.\r\nThe reverse proxy passes the following proxy headers:\r\n```\r\nproxy_set_header Host $http_host;\r\nproxy_set_header Upgrade $http_upgrade;\r\nproxy_set_header Connection $proxy_connection;\r\nproxy_set_header X-Real-IP $remote_addr;\r\nproxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\r\nproxy_set_header X-Forwarded-Proto $proxy_x_forwarded_proto;\r\n```\r\n(_Note the ` X-Forwarded-Proto` header_)\r\n\r\nI've left the `Site URL` option of Mattermost in `Settings > General > Configuration` blank.\r\nIn GitLab I created a global Application in the admin Settings giving the callback URL's:\r\n```\r\nhttps://mattermost.example.com/login/gitlab/complete\r\nhttps://mattermost.example.com/signup/gitlab/complete\r\n```\r\nOn the side of Mattermost I setup the following options under `Settings > Authentication > GitLab`:\r\n1. `Application ID` and `Application Secret Key` give from the step before,\r\n2. `User API Endpoint` to `https://git.example.com/api/v3/user`,\r\n3. `Auth Endpoint` to `https://git.example.com/oauth/authorize` and\r\n4.  `Token Endpoint` to `https://git.example.com/oauth/token`\r\n\r\n**Behaviour**\r\nTrying to login into Mattermost and clicking the GitLab sign-in button redirects me to\r\n```\r\nhttps://git.example.com/oauth/authorize?response_type=code&client_id=_SOME_64_CHARS_LONG_STRING_&redirect_uri=http%3A%2F%2Fmattermost.example.com%2Fsignup%2Fgitlab%2Fcomplete&state=_ANOTHER_124_CHARS_LONG_STRING_\r\n```\r\nwhich results in GitLab throwing\r\n```\r\nThe redirect URI included is not valid.\r\n```\r\n\r\nI guess this happens because the `redirect_uri` query parameter in the GitLab SSO request points to HTTP while the provided application ID points to HTTPS.\r\n\r\nI came to the result, as described in the issue, that the Mattermost API which inits a redirect to GitLab doesn't build the correct uri - more specific the protocol is wrong.\r\n\r\nProviding the correct URL to Mattermost (using HTTPS) in `Settings > General > Configuration` will result in a correct URI."}}
{"actor":{"display_login":"jdoubleu"}}