Hey guys, I´m trying to setup OAUTH2 since 2 days, and have problems. I configured everything according to the documentation, but I´m getting this all the time (oauth2_basic) Authentication failure! invalid_scope: OmniAuth::Strategies::OAuth2::CallbackError, invalid_scope | Unknown/invalid scope(s) Started GET "/auth/failure?message=invalid_scope&origin= %2Flatest&strategy=oauth2_basic" for 10.153.107.106 at 2024-11-27 05:30:33 +0000 Processing by Users::OmniauthCallbacksController#failure as HTML Parameters: {"message"=>"invalid_scope", "origin"=>" /latest", "strategy"=>"oauth2_basic"} My config in the board (regarding scopes) is thus: [The image shows a screenshot of an authorization options page with a request for authorization for email and profile. (Captioned by AI)] The IdP is configured like this: [image] Anyone have a hint, how to debug this a bit further: Cool curls, with which I cound test, or better debug output (already turned on the rich debugging option) ? Getting nuts about this :frowning: Thanks and cheers! WS UPDATE: Just set the options back to just “scope” [The image depicts a screenshot of an online form with a text box prompting the user to "scope" and a text box below it for "When authorizing request these options". (Captioned by AI)] but wasn´t working :frowning:

Hold on … You actually were right, and I stupid :frowning: Wrong setting … It works now !

When I issue the call with an curl curl --request POST \ --url https:// /auth/oauth2/realms/root/realms/ /access_token \ --header 'content-type: application/x-www-form-urlencoded' \ --data client_id= \ --data client_secret= \ --data grant_type=authorization_code \ --data code= \ --data redirect_uri=https:// /auth/oauth2_basic/callback from within the disource docker container I get this { "access_token": " ", "refresh_token": " ", "scope": "openid profile email", "id_token": " ", "token_type": "Bearer", "expires_in": 7199 } May this be a problem because of this ? [image] This fields aren´t in the response :frowning:

I am very interested in the topic b/c I am researching on the amount of effort that would go into my first discourse page for my neighborhood and then gradually moving into my kids schools. I am overloaded with notifications from all of the different platforms. Reducing friction to the page is critical so I would like to offer some help. I am a novice at ruby so l can only offer some resources I found and ideas about the resources. You might have already looked at this but you might want to check out the repo on github for discourse-openid-connect https://github.com/discourse/discourse-openid-connect The repo has 37 contributors and I would imagine one of them would be able to help you answer your question. I hope this helps b/c this is a great quesiton.

Hey @thecatfix , looks promissing. I´ll try it out at once and give feedback asap. Unfortunately I´ve got no time today. Perhaps I´ll be able to work on it on the weekend. Great thanks and have a great weekend!

Hey, couldn´t wait and tested it today, but somehow the guys in our EAM department messed this discovery up. It´s not working and I´m getting invalid client - authentication failed despite being 1000 % positive, that the credentials work (tested with curls) So I´m back to the start. The interesting thing is, that I´m getting an timeoutError all the time for the request to the authorize endpoint, and it´s coming quite fast. Faraday::TimeoutError (Net::ReadTimeout with # ) Found this, and I´m curious, if something like that is also possible in discourse ? [doctorjnupe] Faraday::Error::TimeoutError (Timeout::Error): ruby, ruby-on-rails-3, oauth, warden asked by doctorjnupe on 03:32AM - 21 Jun 13 UTC I´m not a Ruby guy at all, so I´ll need help. I want to debug every single request being handled on discourse side. Is that possible ? Also thought about installing a local proxy to intercept the calls, but before going into this I wanted to ask if there are easier methods :slight_smile:

[image] Wurzelseppi: I want to debug every single request being handled on discourse side. Do you want to view the raw HTTP traffic or be able to jump into the code?

The raw traffic … requests being sent with headers and payload … is that possible somehow ?

The easiest way to do it is from inside the container; you can intercept and print requests between nginx and Discourse by entering the container and running: apt-get update && apt-get -y install scapy scapy # at the scapy prompt, paste in: class Callback: def __init__(self): self.last = None def prn(self, p): if p != self.last: # pcaps on lo capture twice self.last = p p.hide_defaults() print(repr(p)) # this line prints the packet, keep it or leave it if scapy.packet.Raw in p.layers(): try: print(p.load.decode()) except: print(p.load) sniff(filter="port 3000", iface="lo", prn=Callback().prn)

This is huge, thanks … was looking exact for such a tool ! Hmmm… but it seems that discourse is getting the callback and then … In my understanding it should then contact the userinfoendpoint and get the userinfo with the retrieved code, but I´m getting an HTTP 500 GET /auth/oauth2_basic/callback?code=_B1HRB1e6kZKc8nuGLkzGC8&iss=https%3A%2F%2F %3A443%2Fauth%2Foauth2%2Frealms%2Froot%2Frealms%2Fintranetrealm&state=544801ae7e8262ea1667ea7531487f28e83aae232d5182b4&client_id=eadaa55a-1697-494a-8fg5-bb1137c68caa HTTP/1.0 Host: X-Request-Start: t=1732956951.485 X-Real-IP: 10.111.101.84 X-Forwarded-For: 10.131.101.84 X-Forwarded-Proto: https Connection: close cache-control: max-age=0 upgrade-insecure-requests: 1 user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 sec-fetch-site: same-site sec-fetch-mode: navigate sec-fetch-user: ?1 sec-fetch-dest: document sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" referer: https://discourseHost/ accept-encoding: gzip, deflate, br, zstd accept-language: de-DE,de;q=0.9 priority: u=0, i cookie: lbwdn=01; win=teUNUPSc8oibB...... e[0m<e[0me[31me[1mEthere[0m e[34mdste[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34msrce[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34mtypee[0me[0m=e[0me[35mIPv4e[0m e[0m|e[0me[0m<e[0me[31me[1mIPe[0m e[34mihle[0me[0m=e[0me[35m5e[0m e[34mlene[0me[0m=e[0me[35m52e[0m e[34mide[0me[0m=e[0me[35m7742e[0m e[34mflagse[0me[0m=e[0me[35mDFe[0m e[34mfrage[0me[0m=e[0me[35m0e[0m e[34mttle[0me[0m=e[0me[35m127e[0m e[34mprotoe[0me[0m=e[0me[35mtcpe[0m e[34mchksume[0me[0m=e[0me[35m0xdf83e[0m e[34me[4me[1msrce[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[34me[4me[1mdste[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[0m|e[0me[0m<e[0me[31me[1mTCPe[0m e[34msporte[0me[0m=e[0me[35m3000e[0m e[34mdporte[0me[0m=e[0me[35m33574e[0m e[34mseqe[0me[0m=e[0me[35m271589520e[0m e[34macke[0me[0m=e[0me[35m3955524768e[0m e[34mdataofse[0me[0m=e[0me[35m8e[0m e[34mflagse[0me[0m=e[0me[35mAe[0m e[34mwindowe[0me[0m=e[0me[35m499e[0m e[34mchksume[0me[0m=e[0me[35m0xfe28e[0m e[34moptionse[0me[0m=e[0me[35m[('NOP', None), ('NOP', None), ('Timestamp', (3962821542, 3962821542))]e[0m e[0m|e[0me[0m>e[0me[0m>e[0me[0m>e[0m e[0m<e[0me[31me[1mEthere[0m e[34mdste[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34msrce[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34mtypee[0me[0m=e[0me[35mIPv4e[0m e[0m|e[0me[0m<e[0me[31me[1mIPe[0m e[34mihle[0me[0m=e[0me[35m5e[0m e[34mlene[0me[0m=e[0me[35m281e[0m e[34mide[0me[0m=e[0me[35m55898e[0m e[34mflagse[0me[0m=e[0me[35mDFe[0m e[34mfrage[0me[0m=e[0me[35m0e[0m e[34mttle[0me[0m=e[0me[35m127e[0m e[34mprotoe[0me[0m=e[0me[35mtcpe[0m e[34mchksume[0me[0m=e[0me[35m0x2282e[0m e[34me[4me[1msrce[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[34me[4me[1mdste[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[0m|e[0me[0m<e[0me[31me[1mTCPe[0m e[34msporte[0me[0m=e[0me[35m3000e[0m e[34mdporte[0me[0m=e[0me[35m33530e[0m e[34mseqe[0me[0m=e[0me[35m491394e[0m e[34macke[0me[0m=e[0me[35m1852886175e[0m e[34mdataofse[0me[0m=e[0me[35m8e[0m e[34mflagse[0me[0m=e[0me[35mPAe[0m e[34mwindowe[0me[0m=e[0me[35m507e[0m e[34mchksume[0me[0m=e[0me[35m0xff0de[0m e[34moptionse[0me[0m=e[0me[35m[('NOP', None), ('NOP', None), ('Timestamp', (3962823893, 3962816870))]e[0m e[0m|e[0me[0m e[0me[0m>e[0me[0m>e[0me[0m>e[0m HTTP/1.1 500 Internal Server Error Date: Sat, 30 Nov 2024 08:55:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 658 X-Request-Id: 7f4bafa0-7590-4b9b-8b8d-70a4fa1ae6c5 X-Runtime: 10.078459 ..... e[0m<e[0me[31me[1mEthere[0m e[34mdste[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34msrce[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34mtypee[0me[0m=e[0me[35mIPv4e[0m e[0m|e[0me[0m<e[0me[31me[1mIPe[0m e[34mihle[0me[0m=e[0me[35m5e[0m e[34mlene[0me[0m=e[0me[35m52e[0m e[34mide[0me[0m=e[0me[35m15439e[0m e[34mflagse[0me[0m=e[0me[35mDFe[0m e[34mfrage[0me[0m=e[0me[35m0e[0m e[34mttle[0me[0m=e[0me[35m127e[0m e[34mprotoe[0me[0m=e[0me[35mtcpe[0m e[34mchksume[0me[0m=e[0me[35m0xc172e[0m e[34me[4me[1msrce[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[34me[4me[1mdste[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[0m|e[0me[0m<e[0me[31me[1mTCPe[0m e[34msporte[0me[0m=e[0me[35m33574e[0m e[34mdporte[0me[0m=e[0me[35m3000e[0m e[34mseqe[0me[0m=e[0me[35m3955524768e[0m e[34macke[0me[0m=e[0me[35m271589749e[0m e[34mdataofse[0me[0m=e[0me[35m8e[0m e[34mflagse[0me[0m=e[0me[35mAe[0m e[34mwindowe[0me[0m=e[0me[35m511e[0m e[34mchksume[0me[0m=e[0me[35m0xfe28e[0m e[34moptionse[0me[0m=e[0me[35m[('NOP', None), ('NOP', None), ('Timestamp', (3962831618, 3962831618))]e[0m e[0m|e[0me[0m>e[0me[0m>e[0me[0m>e[0m e[0m<e[0me[31me[1mEthere[0m e[34mdste[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34msrce[0me[0m=e[0me[35m00:00:00:00:00:00e[0m e[34mtypee[0me[0m=e[0me[35mIPv4e[0m e[0m|e[0me[0m<e[0me[31me[1mIPe[0m e[34mihle[0me[0m=e[0me[35m5e[0m e[34mlene[0me[0m=e[0me[35m710e[0m e[34mide[0me[0m=e[0me[35m7744e[0m e[34mflagse[0me[0m=e[0me[35mDFe[0m e[34mfrage[0me[0m=e[0me[35m0e[0m e[34mttle[0me[0m=e[0me[35m127e[0m e[34mprotoe[0me[0m=e[0me[35mtcpe[0m e[34mchksume[0me[0m=e[0me[35m0xdcefe[0m e[34me[4me[1msrce[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[34me[4me[1mdste[0me[0m=e[0me[35me[4me[1m127.0.0.1e[0m e[0m|e[0me[0m<e[0me[31me[1mTCPe[0m e[34msporte[0me[0m=e[0me[35m3000e[0m e[34mdporte[0me[0m=e[0me[35m33574e[0m e[34mseqe[0me[0m=e[0me[35m271589749e[0m e[34macke[0me[0m=e[0me[35m3955524768e[0m e[34mdataofse[0me[0m=e[0me[35m8e[0m e[34mflagse[0me[0m=e[0me[35mPAe[0m e[34mwindowe[0me[0m=e[0me[35m512e[0m e[34mchksume[0me[0m=e[0me[35m0xbbe[0m e[34moptionse[0me[0m=e[0me[35m[('NOP', None), ('NOP', None), ('Timestamp', (3962831618, 3962831618))]e[0m e[0m|e[0me[0m \n \n \n Oops - Error 500 \n \n \n \n Oops \n The software powering this discussion forum encountered an unexpected problem. We apologize for the inconvenience. \n Detailed information about the error was logged, and an automatic notification generated. We\'ll take a look at it. \n No further action is necessary. However, if the error condition persists, you can provide additional detail, including steps to reproduce the error, by posting a discussion topic in the site\'s feedback category. \n \n \n'e[0m e[0m|e[0me[0m>e[0me[0m>e[0me[0m>e[0me[0m>e[0m Oops - Error 500 ..... In the logs it prints these lines [A screenshot showing a networking error with a timeout, including HTTP headers and error details. (Captioned by AI)]

It seems to me, that discourse has problems coping with the callback, and now I´d need an deeper insight what happens behind the scenes in discourse. I don´t get any hints in the logs despite having switched on every debug mode I know of. Hmmm, really stuck with this and it´s frustrating :frowning:

OAUTH2 basic - a nightmare :-(

Product Support SSO

Wurzelseppi December 3, 2024, 2:38pm 18

Hold on … You actually were right, and I stupid

Wrong setting …

It works now !

Topic		Replies	Views
Error using discourse-oauth2-basic plugin with NeonCRM SSO oauth2	28	5355	February 12, 2020
Discourse OAuth2 Basic Plugin official , oauth2 , auth-plugins , included-in-core	30	68314	July 24, 2025
Configure sign up and log in with Auth0 using the OAuth2 Basic Plugin Integrations sso , oauth2 , auth-plugins , how-to	73	21080	December 16, 2025
Sorry, there was an error authorizing your account SSO oauth2	22	7510	December 6, 2024
OAuth account creation fails due to CSRF detection immediately after logging into Auth0 on same browser SSO oauth2	7	2866	January 17, 2023

OAUTH2 basic - a nightmare :-(

Related topics