Unable to login after upgrade to 1.15

[mooreds]

I tried to upgrade from 1.13.x to 1.15.x. I upgrade from 1.13.x to 1.14.x, and did a backup and rebuild at 1.14.x. Everything looked good. Then I upgraded to 1.15.x and now can't login.

We were using an OIDC plugin and a custom theme, but I deactivated those (and stopped, built and restarted nodebb), and I still can't login.

The screen is just blank when I click on the 'login' link.

I don't see any log messages. Here's the entire log file after a stop:

2020-11-30T22:35:21.359Z [4567/27418] - warn: You have no mongo username/password setup!
2020-11-30T22:35:21.770Z [4567/27418] - info: [socket.io] Restricting access to origin: https://fusionauth.io:*
2020-11-30T22:35:21.899Z [4567/27418] - error: [emailer] Failed to build custom email templates
Error: EACCES: permission denied, open '/var/www/forum/build/public/templates/emails/banned.js'
2020-11-30T22:35:22.230Z [4567/27418] - warn:    [plugins/nodebb-theme-persona] The plugin.json field "library" is deprecated. Please use the package.json field "main" instead.
2020-11-30T22:35:22.411Z [4567/27418] - info: [api] Adding 1 route(s) to `api/v3/plugins`
2020-11-30T22:35:22.440Z [4567/27418] - info: Routes added
2020-11-30T22:35:22.451Z [4567/27418] - info: NodeBB Ready
2020-11-30T22:35:22.453Z [4567/27418] - info: Enabling 'trust proxy'
2020-11-30T22:35:22.456Z [4567/27418] - info: NodeBB is now listening on: 0.0.0.0:4567

I see no error messages in the developer tools console (I'm using an incognito window in microsoft edge and firefox).

The theme is persona at version 10.2.88.

I looked at the github issues for nodebb and in the community forum and didn't find anything about this error.

Any pointers on how to where to look next would be appreciated.

[mooreds]

It's weird because if I enable the oidc plugin ( https://github.com/FusionAuth/nodebb-plugin-fusionauth-oidc ) and then visit https://fusionauth.io/community/forum/login?local=0 then I can login just fine. It's just the default login link (/login) which is busted.

[mooreds]

Hmmm. If I enable the oidc plugin, I see this:

"%5Bobject%20Object%5D"

as the response from https://fusionauth.io/community/forum/api/login?_=16...

[PitaJ]

Does registered-users have the local login privilege?

[mooreds]

@pitaj Nope, they don't.

That makes sense as to why the login form wasn't showing up when the OIDC plugin was disabled.

Thanks!

We ended up rolling back to 1.14.x which works just fine with the OIDC plugin.

[PitaJ]

@mooreds so what's stopping you from upgrading? The OIDC plugin is broken on v1.15.x? Probably best to upgrade that to be compatible as old versions of NodeBB aren't maintained for long.

[mooreds]

Yes, the OIDC plugin is busted on 1.15. I investigated a bit, but wasn't able to find the issue. Will have to dig in more, as I do want to get to the latest version to avoid issues.

[rcauquil]

@PitaJ @mooreds
We are upgrading to 1.15.3 also and we are also experiencing the "%5Bobject%20Object%5D" issue.

We are using this plugin for login "nodebb-plugin-jwt-oauth2".

It seems that we are getting this here:

helpers.redirect = function (res, url, permanent) {
	if (res.locals.isAPI) {
		res.set('X-Redirect', encodeURI(url)).status(200).json(encodeURI(url));
	} else {
		const redirectUrl = url.startsWith('http://') || url.startsWith('https://') ?
			url : relative_path + url;
		res.redirect(permanent ? 308 : 307, encodeURI(redirectUrl));
	}
};

it's trying to encode this: { external: /path }

which is called from here:

if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
    if (res.locals.isAPI) {
        return helpers.redirect(res, {
	    external: nconf.get('relative_path') + data.authentication[0].url,
        });
    }
return res.redirect(nconf.get('relative_path') + data.authentication[0].url);
}

We are experiencing this only if you have at least disabled local registration or local login for registered user

It results in blocking the "Alternate Login" button from login page

edit: spelling

[baris]

@romain-cauquil

Can you modify the code and try with this

if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
    if (res.locals.isAPI) {
        const url = nconf.get('relative_path') + data.authentication[0].url;
        return res.set('X-Redirect', encodeURI(url)).status(200).json(encodeURI(url));
    }
    return res.redirect(nconf.get('relative_path') + data.authentication[0].url);
}

Let me know if that works. helpers.redirect doesn't support a object so not sure why it's being used there.

[baris]

https://github.com/NodeBB/NodeBB/issues/9032

barisusakli created this issue in NodeBB/NodeBB

closed helpers.redirect doesn't work for sso plugins on /api/login #9032

[baris]

@Romain-CAUQUIL @mooreds this should be fixed on master now, let me know if you have any issues. The fix is here https://github.com/NodeBB/NodeBB/commit/6f68f4d20ad2c25e3a6aae7fd805f8d6362e69de

0 barisusakli committed to NodeBB/NodeBB

fix: #9032, fix login redirect for sso plugins

[rcauquil]

@baris Perfect thank you it has fixed this issues.

[rcauquil]

@baris @PitaJ we are still experiencing issues. it seems that the bug you have fixed was here since a long time.

We are using 1.13.2 in production and the redirection to our sso service is working great (even if the bug you have fixed in 1.15.4 is in it)

1.13.2

Here you can also see that X-Redirect was already broken

1.15.4

But in 1.15.4 running locally we are not redirected to it unless we reload the page.

Note

In 1.13.2 it's calling /auth/pycom-sso
and in 1.15.4 it's calling **/api/**auth/pycom-sso

I'm investigating more on this.
Thank you

[baris]

I think the issue here is that the redirect change is now trying to go to the sso page via ajaxify and trying to load /api/auth/pycom-sso which doesn't exist.

I am guessing only /auth/pycom-sso is created by the sso plugin? What does the plugin return in the data.authentication[0].url field?

I think we can't use helpers.redirect here and will have to use a full redirect and revert my change. Try this fix please

if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
	const url = data.authentication[0].url;
	const redirectUrl = url.startsWith('http://') || url.startsWith('https://') ?
		url : nconf.get('relative_path') + url;
	return res.redirect(307, encodeURI(redirectUrl));
}

Let me know if this works?

[rcauquil]

@baris said in Unable to login after upgrade to 1.15:

if (!data.allowLocalLogin && !data.allowRegistration && data.alternate_logins && data.authentication.length === 1) {
const url = data.authentication[0].url;
const redirectUrl = url.startsWith('http://') || url.startsWith('https://') ?
url : nconf.get('relative_path') + url;
return res.redirect(307, encodeURI(redirectUrl));
}

no I'm stuck with an infinite spinner

[baris]

What is the value of the redirect url?

[rcauquil]

@baris /auth/pycom-sso

[baris]

Thanks I am working on a fix.

[rcauquil]

@baris thank you

[baris]

@rcauquil Please apply the changes here https://github.com/NodeBB/NodeBB/commit/5d00b0895b0db961775b22ba6fff0b52fa7c4a0b

It will go back to the 1.14.x version of the redirect but also fix the "%5Bobject%20Object%5D" issue that was mentioned earlier in this topic.

Let me know if it works now.

0 barisusakli committed to NodeBB/NodeBB

fix: sso redirect on /login & /api/login