Forest Admin "Please verify that you amin is set up correctly"

berkos · March 26, 2021, 10:47am

Expected behavior

When using the correct FOREST_ENV_SECRET I am expecting to work.

Please describe here the behavior you are expecting.

Actual behavior

Screenshot 2021-03-26 at 10.41.01

On Browser console BE server raises a 500 when trying to access.

/forest/authentication/callback?error=UnauthorizedToAccessClientError&error_description=You are not allowed to access to this client&state={“renderingId”=>85890}

Please include any relevant log snippets, if necessary.

I’ve used the FOREST_ENV_SECRET
Generated a random auth_secret and used it.
Set the correct application_url
and used

curl -H "Content-Type: application/json" -H "Authorization: Bearer FOREST_ENV_SECRET" -X POST  -d '{"token_endpoint_auth_method": "none", "redirect_uris": ["APPLICATION_URL/forest/authentication/callback"]}' https://api.forestadmin.com/oidc/reg

To generate a token

Please provide any relevant information about your setup.

Package Version:6.1.1
Rails 6.1.3
Database Dialect:Postgres
Database Version: 12

GuillaumeGautreau · March 26, 2021, 10:51am

Hello @berkos,

Just to be sure, did you use this request by replacing FOREST_ENV_SECRET inside the header Authorization: Bearer FOREST_ENV_SECRET by its actual value?

Can you send me by DM the last characters of the env secret you used, along with your project and environment names?

GuillaumeGautreau · March 26, 2021, 10:55am

Also, can you share with me in DMs the client id that you generated?

GuillaumeGautreau · March 26, 2021, 12:35pm

Ok, so to sum up after several private messages:

Your generated client_id seems good
After checking the request sent by the browser to https://api.forestadmin.com/oidc/auth it appears that the provided client_id at this stage is not correct.

So there is probably a configuration problem on your agent. You have to provide this new client id value to your application, as stated in the docs.

berkos · March 26, 2021, 12:36pm

Yes, this has happened. We identified that the server has the latest client_id. Forest App (Browser) seems to be sending an old value. Is there a chance you are caching it on your side?

GuillaumeGautreau · March 26, 2021, 12:40pm

In fact, this client id sent by the browser is the one that your application provides to the browser. The authentication is done in multiple steps:

The browser contacts youserver/forest/authentication
Your server responds with a url to contact on the forest admin api: http://api.forestadmin.com/oidc/auth?client_id=XXX&[OTHER-PARAMS]
The browser contacts the Forest Admin server on this URL
The Forest Admin server authenticates the user that makes this call and returns an url on your server yourserver/forest/authentication/callback with a special code to finish the authentication process
The browser contacts your server at the provided URL
Your server checks the code and then creates a JWT that will authenticate the user on your server

You can see an incorrect clientId at step 2 because your server sends it to the browser. So I’m pretty sure that the configuration of your server is incorrect for this environment.

berkos · March 26, 2021, 12:45pm

Thanks very much for explaining the detailed communication between Forest and Server. That will help for future debugging.

berkos · March 26, 2021, 2:49pm

Hi @GuillaumeGautreau .
I went all they way creating a new client_id. I can verify in a rails console of that environment I am getting
The new client_id which I just generated by checking ForestLiana.forest_client_id . However the server from the Forest liana gem keeps sending an other value which is nowhere in an ENV variable or credentials.

I had a look on the source and looks like there is some caching on your side using Rails.cache

github.com

ForestAdmin/forest-rails/blob/3fb83d17e2cfa8aa6148f90eba1f62748e938135/app/services/forest_liana/oidc_client_manager.rb#L25


        registration_endpoint: configuration['registration_endpoint']
      })
    else
      client_credentials = { 'client_id' => ForestLiana.forest_client_id }
    end

    client_data = { :client_id => client_credentials['client_id'], :issuer => configuration['issuer'] }
    Rails.cache.write(callback_url, client_data)
  end

  OpenIDConnect::Client.new(
    identifier: client_data[:client_id],
    redirect_uri: callback_url,
    host: "#{client_data[:issuer].sub(/^https?\:\/\/(www.)?/,'')}",
    authorization_endpoint: '/oidc/auth',
    token_endpoint: '/oidc/token',
  )
rescue => error
  Rails.cache.delete(callback_url)
  raise error
end

Apart from that I can see that my Rails.cache.read(callback_url) is present for that given url which means you are returning to me an old (deleted client) that does not exist anymore.

Only if that (Rails.cache.read(callback_url) ) does not return a value you will only then try to generate this again using my ForestLiana.forest_client_id, here forest-rails/oidc_client_manager.rb at 3fb83d17e2cfa8aa6148f90eba1f62748e938135 · ForestAdmin/forest-rails · GitHub

Am I following this correctly?

Thanks

GuillaumeGautreau · March 26, 2021, 2:56pm

Hi @berkos,

You are totally right, the client id is currently first retrieved from the cache, and only if it has not been found the application reads from the environment variable.

We will work on a fix to avoid this kind of mismatch between the client id and the env variable if provided.

In the meantime, is it possible for you to clear this cache entry? It will probably fix your problem.

berkos · March 26, 2021, 3:04pm

Yes I did that and fixed the issue. Going forward, I think it would nice your cache_key to be a combination of the callback_url and the client_id.

Thanks

GuillaumeGautreau · March 26, 2021, 3:06pm

You are totally right, we will work on a fix that will probably work this way.

GuillaumeGautreau · April 19, 2021, 2:12pm

Just for information, forest-rails version 6.3.1 fixed this issue by adding bot the callback url and the environment secret to the cache key.

Topic		Replies	Views
Upgrading to v7 - Can't log in Help me! setup	7	546	March 23, 2021
Sept 30, 2021 - Trouble logging in News & Announcements	0	1023	September 30, 2021
Authentication error after migrating to forest-express-sequelize v7 Help me!	19	3268	July 7, 2021
Cannot Access to ForestAdmin - /forest/authentication/callback is returning a 500 Help me!	4	539	October 4, 2021
Forest cannot authenticate the user for this request in prod and localhost Help me!	4	248	August 17, 2023

Forest Admin "Please verify that you amin is set up correctly"

Expected behavior

Actual behavior

Related Topics