# OpenIdAuthenticator plugin fails

**URL:** https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186
**Category:** Development
**Created:** [February 26, 2019, 11:19pm UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186 "2019-02-26T23:19:46Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![VojtechMyslivec](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vojtechmyslivec/32/111148_2.png) [@VojtechMyslivec](https://meta.discourse.org/u/VojtechMyslivec)
#### Post date: [February 26, 2019, 11:19pm UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186/1 "2019-02-26T23:19:46Z")

</div>

Hello,

I use simple _Auth_ plugin based on `OpenIdAuthenticator` called [discourse-mojeid](https://github.com/CZ-NIC/discourse-mojeid). It worked for both registration and login until _Discourse version 2.1.6_, however after upgrade to _Discourse 2.2.1_ I can not use it for neither login nor registration.

As a user trying to login to Discourse, I can click on “MojeID” login method, pop-up window appears, it redirects me to specified OpenID provider where I can successfully login and then when the browser redirects back to Discourse, I get only an error message:

```plaintext
Sorry, there was an error authorizing your account. Perhaps you did not approve authorization?

```

> **Screenshots**
>
> ![Screenshot%20from%202019-02-27%2000-13-15](https://global.discourse-cdn.com/meta/original/3X/3/4/34b70159c67c73961a076168ad6816fc910fdd1a.png)
> 
> ![Screenshot%20from%202019-02-27%2000-13-31](https://global.discourse-cdn.com/meta/original/3X/8/9/894e088fe7169fda49da71de950605fda2589070.png)

As an admin, I see this error in Discourse _logs_ with info:

```plaintext
(mojeid) Authentication failure! invalid_credentials encountered.

```

The _env_ tab contains information about POST request causing the error and it includes proper OpenID parameters and values from my OpenID account. The baktrace tab contains:

> **Full backtrace**
>
> ```plaintext
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/logster-2.0.1/lib/logster/logger.rb:101:in `add_with_opts'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/logster-2.0.1/lib/logster/logger.rb:52:in `add'
> /usr/local/lib/ruby/2.5.0/logger.rb:545:in `error'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:163:in `log'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:488:in `fail!'
> /var/www/discourse/lib/auth/open_id_authenticator.rb:98:in `callback_phase'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:238:in `callback_call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:189:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:192:in `call!'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/strategy.rb:169:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/omniauth-1.9.0/lib/omniauth/builder.rb:64:in `call'
> /var/www/discourse/lib/middleware/omniauth_bypass_middleware.rb:30:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/tempfile_reaper.rb:15:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/conditional_get.rb:38:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/head.rb:12:in `call'
> /var/www/discourse/lib/content_security_policy/middleware.rb:12:in `call'
> /var/www/discourse/lib/middleware/anonymous_cache.rb:216:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/session/abstract/id.rb:232:in `context'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/session/abstract/id.rb:226:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/cookies.rb:670:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/callbacks.rb:28:in `block in call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/activesupport-5.2.2/lib/active_support/callbacks.rb:98:in `run_callbacks'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/callbacks.rb:26:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/debug_exceptions.rb:61:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/show_exceptions.rb:33:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/logster-2.0.1/lib/logster/middleware/reporter.rb:30:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/railties-5.2.2/lib/rails/rack/logger.rb:38:in `call_app'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/railties-5.2.2/lib/rails/rack/logger.rb:28:in `call'
> /var/www/discourse/config/initializers/100-quiet_logger.rb:16:in `call'
> /var/www/discourse/config/initializers/100-silence_logger.rb:29:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/remote_ip.rb:81:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/request_id.rb:27:in `call'
> /var/www/discourse/lib/middleware/enforce_hostname.rb:17:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/method_override.rb:22:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/actionpack-5.2.2/lib/action_dispatch/middleware/executor.rb:14:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/sendfile.rb:111:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-mini-profiler-1.0.1/lib/mini_profiler/profiler.rb:171:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/message_bus-2.2.0.pre.1/lib/message_bus/rack/middleware.rb:57:in `call'
> /var/www/discourse/lib/middleware/request_tracker.rb:182:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/railties-5.2.2/lib/rails/engine.rb:524:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/railties-5.2.2/lib/rails/railtie.rb:190:in `public_send'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/railties-5.2.2/lib/rails/railtie.rb:190:in `method_missing'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/urlmap.rb:68:in `block in call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/urlmap.rb:53:in `each'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/rack-2.0.6/lib/rack/urlmap.rb:53:in `call'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/unicorn-5.4.0/lib/unicorn/http_server.rb:606:in `process_client'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/unicorn-5.4.0/lib/unicorn/http_server.rb:701:in `worker_loop'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/unicorn-5.4.0/lib/unicorn/http_server.rb:549:in `spawn_missing_workers'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/unicorn-5.4.0/lib/unicorn/http_server.rb:142:in `start'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/gems/unicorn-5.4.0/bin/unicorn:126:in `<top (required)>'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/bin/unicorn:23:in `load'
> /var/www/discourse/vendor/bundle/ruby/2.5.0/bin/unicorn:23:in `<main>'
> 
> ```

If I get the backtrace right, it leads to `strategy.callback_phase` from [open\_id\_authenticator.rb](https://github.com/discourse/discourse/blob/v2.2.1/lib/auth/open_id_authenticator.rb#L98).

I have also tried Discourse _2.3.0-beta2_ but it does not help to solve this issue.

OpenID provider points me to verification of OpenID request on the Discourse side. According to their support line, everything is ok on their side (which I can confirm as I can login with this provider to other services).

Does anyone have an idea why Discourse does not accept OpenID request and why it fails to login?

---

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [February 26, 2019, 11:41pm UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186/2 "2019-02-26T23:41:47Z")

</div>

We have added CSRF protection to the OpenIDAuthenticator. That means that it sets the callback url to `https://your.forum/auth/openid/callback?state=xxxxxxxxx` (where xxxxx is randomly generated). The OpenID provider needs to redirect back to exactly that same URL. In theory this should work fine, and worked without changes on the one “official” openID integration (Yahoo).

Note that “OpenID 2.0” has been declared obsolete, and it’s very likely we will remove it from Discourse soon. The best thing would be to move to a more modern specification like OpenID Connect.

It looks like mojeID supports this new standard, so you could try the [Discourse OpenID Connect (OIDC)](https://meta.discourse.org/t/openid-connect-authentication-plugin/103632)

---

<div class="post-metadata">

### Author: ![VojtechMyslivec](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/vojtechmyslivec/32/111148_2.png) [@VojtechMyslivec](https://meta.discourse.org/u/VojtechMyslivec)
#### Post date: [February 27, 2019, 12:02am UTC](https://meta.discourse.org/t/openidauthenticator-plugin-fails/110186/3 "2019-02-27T00:02:53Z")

</div>

Thanks for the quick reply.

I can see `?state=xxx` included in URLs in Discourse logs.

I will try to use OpenID connect plugin so..

**Edit** : I have switched the plugin to [OpenID Connect Authentication Plugin](https://meta.discourse.org/t/openid-connect-authentication-plugin/103632) you proposed and configured it to works with mojeID. Thanks 👍