redirect_uri: https:///auth/oauth2_basic/callback
```
ending in
But as the authorize call getting the code went throught, there can´t be any Network issue, right ?
---
When I issue the call with an curl
```plaintext
curl --request POST \
--url https:///auth/oauth2/realms/root/realms//access_token \
--header 'content-type: application/x-www-form-urlencoded' \
--data client_id= \
--data client_secret= \
--data grant_type=authorization_code \
--data code= \
--data redirect_uri=https:///auth/oauth2_basic/callback
```
from within the disource docker container I get this
```plaintext
{
"access_token": "",
"refresh_token": "",
"scope": "openid profile email",
"id_token": "",
"token_type": "Bearer",
"expires_in": 7199
}
```
May this be a problem because of this ?
This fields aren´t in the response ☹
---
no one ? ☹
---
I am very interested in the topic b/c I am researching on the amount of effort that would go into my first discourse page for my neighborhood and then gradually moving into my kids schools. I am overloaded with notifications from all of the different platforms.
Reducing friction to the page is critical so I would like to offer some help. I am a novice at ruby so l can only offer some resources I found and ideas about the resources.
You might have already looked at this but you might want to check out the repo on github for discourse-openid-connect
[https://github.com/discourse/discourse-openid-connect](https://github.com/discourse/discourse-openid-connect)
The repo has 37 contributors and I would imagine one of them would be able to help you answer your question.
I hope this helps b/c this is a great quesiton.
---
Hey @thecatfix ,
looks promissing. I´ll try it out at once and give feedback asap.
Unfortunately I´ve got no time today. Perhaps I´ll be able to work on it on the weekend.
Great thanks and have a great weekend!
---
Hey,
couldn´t wait and tested it today, but somehow the guys in our EAM department messed this discovery up. It´s not working and I´m getting invalid client - authentication failed despite being 1000 % positive, that the credentials work (tested with curls)
So I´m back to the start.
The interesting thing is, that I´m getting an timeoutError all the time for the request to the authorize endpoint, and it´s coming quite fast.
```plaintext
Faraday::TimeoutError (Net::ReadTimeout with #)
```
Found this, and I´m curious, if something like that is also possible in discourse ?
>
I´m not a Ruby guy at all, so I´ll need help.
I want to debug every single request being handled on discourse side. Is that possible ?
Also thought about installing a local proxy to intercept the calls, but before going into this I wanted to ask if there are easier methods 🙂
---
> [@Wurzelseppi](#):
>
> I want to debug every single request being handled on discourse side.
Do you want to view the raw HTTP traffic or be able to jump into the code?
---
The raw traffic …
requests being sent with headers and payload …
is that possible somehow ?
---
The easiest way to do it is from inside the container; you can intercept and print requests between nginx and Discourse by entering the container and running:
```python
apt-get update && apt-get -y install scapy
scapy
# at the scapy prompt, paste in:
class Callback:
def __init__ (self):
self.last = None
def prn(self, p):
if p != self.last: # pcaps on lo capture twice
self.last = p
p.hide_defaults()
print(repr(p)) # this line prints the packet, keep it or leave it
if scapy.packet.Raw in p.layers():
try:
print(p.load.decode())
except:
print(p.load)
sniff(filter="port 3000", iface="lo", prn=Callback().prn)
```
---
This is huge, thanks … was looking exact for such a tool !
Hmmm… but
it seems that discourse is getting the callback and then …
In my understanding it should then contact the userinfoendpoint and get the userinfo with the retrieved code, but I´m getting an HTTP 500
```plaintext
GET /auth/oauth2_basic/callback?code=_B1HRB1e6kZKc8nuGLkzGC8&iss=https%3A%2F%2F%3A443%2Fauth%2Foauth2%2Frealms%2Froot%2Frealms%2Fintranetrealm&state=544801ae7e8262ea1667ea7531487f28e83aae232d5182b4&client_id=eadaa55a-1697-494a-8fg5-bb1137c68caa HTTP/1.0
Host:
X-Request-Start: t=1732956951.485
X-Real-IP: 10.111.101.84
X-Forwarded-For: 10.131.101.84
X-Forwarded-Proto: https
Connection: close
cache-control: max-age=0
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Google Chrome";v="131", "Chromium";v="131", "Not_A Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
referer: https://discourseHost/
accept-encoding: gzip, deflate, br, zstd
accept-language: de-DE,de;q=0.9
priority: u=0, i
cookie: lbwdn=01; win=teUNUPSc8oibB......
e[0me[0me[0m>e[0me[0m>e[0m
e[0me[0me[0m>e[0me[0m>e[0me[0m>e[0m
HTTP/1.1 500 Internal Server Error
Date: Sat, 30 Nov 2024 08:55:53 GMT
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 658
X-Request-Id: 7f4bafa0-7590-4b9b-8b8d-70a4fa1ae6c5
X-Runtime: 10.078459
.....
e[0me[0me[0m>e[0me[0m>e[0m
e[0m\n\n\n Oops - Error 500 \n \n\n\n Oops
\n The software powering this discussion forum encountered an unexpected problem. We apologize for the inconvenience.
\n Detailed information about the error was logged, and an automatic notification generated. We\'ll take a look at it.
\n No further action is necessary. However, if the error condition persists, you can provide additional detail, including steps to reproduce the error, by posting a discussion topic in the site\'s feedback category.
\n\n\n'e[0m e[0m|e[0me[0m>e[0me[0m>e[0me[0m>e[0me[0m>e[0m
Oops - Error 500
.....
```
In the logs it prints these lines
---
It seems to me, that discourse has problems coping with the callback, and now I´d need an deeper insight what happens behind the scenes in discourse.
I don´t get any hints in the logs despite having switched on every debug mode I know of.
Hmmm, really stuck with this and it´s frustrating ☹
---
Hey guys,
I´m much farther now 🙂
It had to do with our EAM infrastructure …
Now I have the next problem, though 😃
My userinfotoken looks like that:
```plaintext
{
"company-i": "A1",
"accounting-code": "5806",
"given_name": "Mister",
"family_name": "Bean",
"name": "Mister Bean",
"departmentnumber": "Covert Operations",
"salutation": "Dude",
"description": "Some description",
"preferredlanguage": "DE",
"inumber": "723jfio-7zwe8489",
"employeenumber": "36484332",
"employeetype": "BigCompany",
"uid": "f57383",
"adupn": "f57383@europe.bigcom.corp",
"uniqueuid": "f57383",
"uniqueuidq": "f57383",
"loginname": "f57383",
"email": "Mister.Bean@bigcom.corp",
"sub": "f57383",
"subname": "f57383"
}
```
And I´m getting this error in logs:
```plaintext
ActiveRecord::NotNullViolation (PG::NotNullViolation: ERROR: null value in column "provider_uid" of relation "user_associated_accounts" violates not-null constraint
DETAIL: Failing row contains (6, oauth2_basic, null, null, 2024-12-03 13:06:49.831182, {"name": "Mister Bean", "email": "Mister.Bean@bigcom.corp", "user..., {"token": "dszghsdhsdfoph", "expires": true, "expir..., {}, 2024-12-03 13:06:49.831362, 2024-12-03 13:06:49.831362).
```
Discourse doesn´t seem to be able, to map the answer from userinfoendpoint to it´s internal names.
I´ve tried to set this up over ui:
but probably wrongly
Could anyone give me a hint how to set this up ?
Thanks and Cheers,
WS
---
> [@Wurzelseppi](#):
>
> ```plaintext
> ActiveRecord::NotNullViolation (PG::NotNullViolation: ERROR: null value in column "provider_uid" of relation "user_associated_accounts" violates not-null constraint
>
> ```
Is `oauth2 json user id path` filled?
Do make sure these values are set: [https://meta.discourse.org/t/configure-sign-up-and-log-in-with-auth0-using-the-oauth2-basic-plugin/64633#configure-discourse-3](https://meta.discourse.org/t/configure-sign-up-and-log-in-with-auth0-using-the-oauth2-basic-plugin/64633#configure-discourse-3).
---
Hi there,
thanks for answering.
It seems my provider doesn´t send provider\_name and provider\_uid field, and therefore discourse tries to create the entry without that and get an NotNull violation.
But, isn´t that the responsibility of the plugin (oauth2\_basic) to fill these values (if none are coming from remote IdP) ?
I´d expect somethiung line
provider\_name: “oauth2\_basic”
provider\_uid: “1234”
Used automatically with every userlogin… ☹
---
The provider\_name is fixed to `oauth2_basic` and the provider\_uid would be whatever you fill in `oauth2 json user id path`.
You just have to set that site setting to the path of the id based on what your provider returns. The plugin uses this json path to fill in the provider\_uid, so if it’s currently empty or a path that doesn’t exist, the value will be nil.
From your json above it looks like the value should be `sub`.
---
> [@Wurzelseppi](#):
>
> ```plaintext
> "email": "Mister.Bean@bigcom.corp",
> "sub": "f57383",
> "subname": "f57383"
>
> ```
But I did that…
You are right, the path should be “sub”, but I configured that here
---
Hold on … You actually were right, and I stupid ☹
Wrong setting …
It works now !
---
Is there a way to save these setting to somewhere 😃
make an backup of just the config settings ?
Are they in the database ?
---
That’s great.
All site settings are saved in the database. Assuming you have rails console access, the following should show you a list of the settings.
```plaintext
SiteSetting.where("name LIKE 'oauth2_%'").pluck(:name, :value)
```
You can also just create a backup.
[Next page](https://meta.discourse.org/t/oauth2-basic-a-nightmare/338662.md?page=2)