{"action":"closed","issue":{"url":"https://api.github.com/repos/mattermost/platform/issues/3944","repository_url":"https://api.github.com/repos/mattermost/platform","labels_url":"https://api.github.com/repos/mattermost/platform/issues/3944/labels{/name}","comments_url":"https://api.github.com/repos/mattermost/platform/issues/3944/comments","events_url":"https://api.github.com/repos/mattermost/platform/issues/3944/events","html_url":"https://github.com/mattermost/platform/issues/3944","id":174894490,"number":3944,"title":"Mattermost generates wrong redirect uri for SSO authentication","user":{"login":"jdoubleu","id":11274444,"avatar_url":"https://avatars.githubusercontent.com/u/11274444?v=3","gravatar_id":"","url":"https://api.github.com/users/jdoubleu","html_url":"https://github.com/jdoubleu","followers_url":"https://api.github.com/users/jdoubleu/followers","following_url":"https://api.github.com/users/jdoubleu/following{/other_user}","gists_url":"https://api.github.com/users/jdoubleu/gists{/gist_id}","starred_url":"https://api.github.com/users/jdoubleu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdoubleu/subscriptions","organizations_url":"https://api.github.com/users/jdoubleu/orgs","repos_url":"https://api.github.com/users/jdoubleu/repos","events_url":"https://api.github.com/users/jdoubleu/events{/privacy}","received_events_url":"https://api.github.com/users/jdoubleu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-09-03T12:26:47Z","updated_at":"2016-09-14T18:17:42Z","closed_at":"2016-09-14T18:17:42Z","body":"Maybe it's a bit late but the bug still exists.\r\n\r\nThere was a long issue about a bug where singing-in into Mattermost through GitLab doesn't work if Mattermost is behind a reverse proxy and this proxy communicates with HTTP with Mattermost while the user is facing the page with HTTPS (because the proxy support SSL). You can read it [here](https://github.com/mattermost/platform/issues/1899).\r\n\r\nFirst of all:\r\n\r\n#### Summary\r\nSingin-in/Authenticating via SSO with GitLab won't work because the generated URI contains the wrong protocol if Mattermost ist behind a proxy, communicating with HTTP, and the page URL isn't set in Mattermost's settings.\r\n\r\n#### Steps to reproduce\r\n* Run Mattermost behind a reverse proxy,\r\n* let the proxy communicate with Mattermost via HTTP,\r\n* configure the proxy to support HTTPS for the user,\r\n* enable SSO with GitLab,\r\n* _finally_: try to log-in\r\n\r\n#### Expected behavior\r\nAfter clicking the SSO button on Mattermost, it will redirect me to GitLab where I have to login-in and authorize the Application to use my account data. After authorizing GitLab should redirect me to Mattermost where I'm logged in now.\r\n\r\n#### Observed behavior\r\nAfter clicking the SSO button GitLab will fail (with the error message: `The redirect URI included is not valid.`) due to the fact, that the `redirect_uri` query param doesn't match the provided `client_id`.\r\n\r\n#### Possible fixes\r\nOne simple fix might be to set the page url of Mattermost in its settings.\r\n\r\n\r\nI've inspected the code and I wanted to share my results here.\r\n\r\nClicking the GitLab button on the log-in page of Mattermost will redirect me to `/api/v3/oauth/gitlab/login`, this API call with initiate a 302 redirect to GitLab `https://gitlab.example.com/oauth/authorize?response_type=code&client_id=_64_length_string&redirect_uri=http%3A%2F%2Fmattermost.example.com%2Fsignup%2Fgitlab%2Fcomplete&state=_another_long_string`.\r\n\r\nThis redirect is managed inside the `api/oauth.go` file, where [on line 727]((https://github.com/mattermost/platform/blob/master/api/oauth.go#L727)) the link is generated.\r\n\r\nThe function `GetSiteUrl` in [`api/context.go`, line 462](https://github.com/mattermost/platform/blob/master/api/context.go#L462) gets called which only returns the actual site url.\r\n\r\nThe current site url is set in the [`ServeHTTP` function in the `context.go` file](https://github.com/mattermost/platform/blob/master/api/context.go#L102), on [line 145](https://github.com/mattermost/platform/blob/master/api/context.go#L145) this will set the url set by the user, if it exists, or, if not, generate it with the protocol and host.\r\n\r\nTo get the protocol, this function calls the [`GetProtocol` function in `context.go` on line 267](https://github.com/mattermost/platform/blob/master/api/context.go#L267).\r\n\r\nAlthough this function tries to get the `X-Forwarded-Proto` (client header call on line 268, using the [`HEADER_FORWARDED_PROTO`](https://github.com/mattermost/platform/blob/master/model/client.go#L28) constant) it get's the wrong protocol.\r\n\r\nMy proxy serves the `X-Forwarded-Proto` header correctly to Mattermost.\r\nI didn't test what went wrong in the `GetProtocol` function.\r\n\r\n\r\nAlso one thing I want to point out is that there is a newer standardized form of the `Forwared` headers (see [RFC 7239](https://tools.ietf.org/html/rfc7239)) which should be recognized."}}
{"actor":{"display_login":"lfbrock"}}