Community

SSO Authentication - Https - NGINX configuration

Technical Support
  • H.urnaH
    H.urnaH
    #1

    Hi folks,

    I am currently struggling on using sso plugins with my nodebb instance (online).
    I have done quite some researches here and from the web, but did not get any answer.
    Still, I saw several topics about the subject.
    Thanks for having a look, and hope it could help others too.

    I handle SSL using a nginx reverse-proxy behind all my nodes applications and here are the errors found :
    SSO-Google
    Oops! Looks like something went wrong!
    /auth/google/callback
    Bad Request

    SSO-GIT
    Oops! Looks like something went wrong!
    /auth/github/callback
    The redirect_uri MUST match the registered callback URL for this application.

    ... and same kind of error for FB.

    Concerning the App configuration it seems well configured with an Https callback URL:
    https://-.-.io/auth/github/callback
    https://-.-.io as homepage.

    My NGINX configuration try to pass all needed information within the header :
    "
    proxy_pass http://localhost:8080;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Port 443;
    "

    And finally the traces I think the problem comes from, the (it's not the case for this nodeBB forum)

    Github 302 (OK) :
    (mine)
    GET /auth/github HTTP/1.1
    Host: community.-.io

    (nodebb)
    GET /auth/github HTTP/1.1
    Host: community.nodebb.org

    Authorize (PROBLEM) :
    (mine)
    GET /login/oauth/authorize?response_type=code&redirect_uri=http%3A%2F%2Fcommunity.-.io%2Fauth%2Fgithub%2Fcallback&s...
    HTTP/1.1
    Host: github.com

    (nodeBB)
    GET /login/oauth/authorize?response_type=code&redirect_uri=https%3A%2F%2Fcommunity.nodebb.org%2Fauth%2Fgithub%2Fcallback&... HTTP/1.1
    Host: github.com

    Why am I loosing the S from the protocol ?!

    Thank you for your help.
    Kind regards.
    Hybesis

    0
  • H.urnaH
    H.urnaH
    #2

    Finally found a topic with good explanation an answers:

    Didn't expect the config.json would influence such requests.

    Kind regards.

    0

Suggested Topics

  • crazycellsC

    Email delivery problem to users signed up with Facebook SSO

    Unsolved Technical Support
    1 Votes
    1 Posts
    113 Views

    crazycellsC

    When users sign up using Facebook SSO , Facebook creates a random-numbered email address for them such as [email protected]

    I think a similar problem was already reported here: https://community.nodebb.org/topic/5985/facebook-sso-plugin-email-issue

    However, all emails sent to these kinds of addresses are returning back to us. This was already happening, but it was not bothering us so far 😄 unfortunately, recently we started to have a lot of "Delivery Status Notification (Failure)" emails... so, we would like to solve this.

    Address not found
    Your message wasn't delivered to [email protected] because the domain facebook.com couldn't be found. Check for typos or unnecessary spaces and try again.

    And on the Facebook postmaster page, we can confirm the problem as "RCP-P1 The attempted recipient address does not exist."

    Since the forum sees these accounts as valid and activated, it keeps trying to send an email at any action that causes email delivery. And of course, all emails are being failed to be delivered and returned back to us.

    Any suggestion?

  • gotwfG

    nodebb, nginx, and modsecurity?

    Technical Support
    2 Votes
    5 Posts
    510 Views

    gotwfG

    Maybe not a lot of interest in this due to complexity of deploying/configuring ModSecurity, combined w/absence of nodebb stack specific rulesets. Security is difficult so not much can be done about the deploy/config aspects but ModSecurity devs are starting to focus some efforts on the latter.

    For those interested, and willing to roll up their sleeves, development of node.js targeted attack ruleset is slated for next release of OWASP CRS, scheduled for Sept. 2019. More info here:

    https://github.com/SpiderLabs/owasp-modsecurity-crs/pull/1487#issuecomment-519071541

    P.S.; Obviously ModSecurity can be deployed on Apache setups as well but my sense is that Nginx is the overwhelming favorite w/the nodebb community and I didn't want to start a new thread.

  • GeferonG

    Using any sso plugin results in 404

    Technical Support
    0 Votes
    9 Posts
    619 Views

    GeferonG

    @gorgiselkov I believe that one might not be working because it's a skeleton plugin, and not an actual SSO auth (as stated on github page), unless you've configured it yourself but, it doesn't seem like it.

  • xiduiX

    restart is very slow even if restart nginx

    Technical Support
    0 Votes
    1 Posts
    1076 Views

    xiduiX

    Every time I restart nodebb, the site will down for about 3 minutes. At first I doubted that the nodebb may have some thing to initialize.
    Then I found that even if if restart nginx(not reload), this issue may also occur.

    During this 3 minutes, the mongodb and 3 node process eat 100% CPU and most of the memory. The 3 minutes depends on the machine, 2core-4G machine will take 3 minutes and 4core-8G machine will take 1 minutes.

    I wonder what was nodebb doing during that time?

  • SergioNGS

    nodebb-plugin-emailer-local configuration or usage problems

    Technical Support
    0 Votes
    13 Posts
    6193 Views

    SergioNGS

    Final update, it worked on the production server!! so now our forum is working properly sending emails the Linux way on a Windows Server OS, quite nice I would say, just as a side note our forum is actually really small in number of users, as it is an internal forum, so I can't assure this setup will work out to other forum's expectations or needs, also I would like to add that this shouldn't be the way to do it on Windows as it is kind of a weird way to handle it so in later versions it would be nice to see it reworked or polished for Windows environments (especially because it looks like the program used to simulate sendmail on Windows is no longer receiving maintenance).

| | | |
Copyright © 2023 NodeBB | Contributors