[Invalid] Omniauth callback does not support POST, only GET

[tarek (Tarek Loubani)]

Hello all,

I am trying to implement OAuth2 Basic with @dashohoxha’s Drupal plugin oauth2_loginprovider.

I get an error during the callback:

@tarek

In the DRUPAL system’s apache logs, the following error appears:DRUPAL x.x.x.x - - [04/May/2016:00:19:42 -0000] “GET /oauth2/user/profile HTTP/1.1” 404 4382 “-” “Ruby”

As @dashohoxha noted, it appears that the error is related to GET instead of POST:

@dashohoxha

In the Drupal logs you have GET /oauth2/user/profile HTTP/1.1, but the homepage of oauth2_loginprovider explicitly says that you need a POST request:

clients can access the user profile with a POST request at: https://server.example.org/oauth2/user/profile (after being authenticated and having an access_token).

As I looked, there appears to be no way to change this behaviour via plugin. Any ideas?

tarek : )

[tarek (Tarek Loubani)]

It appears this is the offending line, which would make it a problem of OAuth2 Basic and not callback in general.

From discourse-oauth2-basic/plugin.rb:53:in 'fetch_user_details':

user_json = JSON.parse(open(user_json_url, 'Authorization' => "Bearer #{token}" ).read)

From trying to debug this on IRC, it appears that:

[12:31:56] <jmarinelli> open-uri only supports GET
[12:32:42] <jmarinelli> look into HTTParty, or Net::HTTP if you don't want to add dependencies
[12:32:55] <havenwood> You could use Net::HTTP from the stdlib but it's a bit unwieldy. I'd suggest HTTP.rb for a gem: https://github.com/httprb/http#readme

I will post this all to the OAuth2 Basic site. How do I close this topic?

tarek : )