My FB app is public (green dot) and is working perfectly fine for admins and developers. However, authentication fails when a non user tries to login.
FB app screenshot: http://imgur.com/r25vyjH
Interestingly, non-developer users are able to reach the permissions screen, but are not able to login using FB. I am using only the approved permissions:
scope: 'email, public_profile, user_friends, user_birthday'
I am on rails + devise + omniauth + omniauth-facebook.
In code, it redirects to OmniauthCallbacksController#failure. I tried creating failure action to see what's happening, but it is not giving me any message. Not sure how to debug this.
I am using following:
gem 'devise', '3.4.1'
gem 'omniauth', '1.2.2'
gem 'omniauth-facebook', '2.0.0'
Here is what I see in production.log:
I, [2015-05-01T17:55:39.141944 #2341] INFO -- : Started GET "/users/auth/facebook" for 122.167.223.121 at 2015-05-01 17:55:39 +0000
I, [2015-05-01T17:55:39.706464 #2341] INFO -- : Started GET "/users/auth/facebook/callback?code=AQC5ypphUjqzOquyD4HMWFvaCZjvMfahg5Y_...fljWMCh&state=0857ab97a79206c582b2b7b5391d99cda7b5d4e5ba2f730e" for 122.167.223.121 at 2015-05-01 17:55:39 +0000
I, [2015-05-01T17:55:41.231336 #2341] INFO -- : Processing by OmniauthCallbacksController#failure as HTML
I, [2015-05-01T17:55:41.231394 #2341] INFO -- : Parameters: {"code"=>"AQC5ypphUjqzOquyD4HMWFvaCZjvMfahg5Y...MCh", "state"=>"0857ab97a79206c582b2b7b5391d99cda7b5d4e5ba2f730e"}
I, [2015-05-01T17:55:41.232699 #2341] INFO -- : Redirected to http://www.oyelife.com/
I, [2015-05-01T17:55:41.232832 #2341] INFO -- : Completed 302 Found in 1ms (ActiveRecord: 0.0ms)
Help appreciated.
Figured this out myself after more tinkering.
Seems like callback URL must also be listed in Settings > Advanced > OAuth Settings > Valid OAuth redirect URIs. It works without it for developers, but is required for public.
Would be better if Facebook mentions this somewhere.
Related
I've looked through various similar issues and responses but to no avail. Sorry if this is obvious but OAuth is not my area of expertise.
I'm running Rails 5.2 with Ruby 2.74 and Devise. I have SSO set up with Facebook and it works fine. I'm trying to get it working with ClassLink, but I'm stuck. When clicking on our ClassLink dashboard icon (ClassLink website), it opens a new browser window to our site, as it should, but fails to log in as that user. A user with the same email is set up on both ends. The server error is
15:14:51 web.1 | D, [2022-09-01T15:14:51.715485 #1139413] DEBUG -- omniauth: (classlink) Callback phase initiated.
15:14:51 web.1 | E, [2022-09-01T15:14:51.720435 #1139413] ERROR -- omniauth: (classlink) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
The Omniauth-Classlink Gem calls for a devise.rb entry of
config.omniauth :class_link,
'your-classlink-access-key',
'your-classlink-secret',
strategy_class: 'OmniAuth::Strategies::ClassLink'
but with that last parameter (strategy_class), the server won't start and exits with an error:
NoMethodError: undefined method `new' for "OmniAuth::Strategies::ClassLink":String
so I'm leaving that off since it wasn't required for my working Facebook SSO.
On the failed login I'm getting the following log entry:
Processing by Users::OmniauthCallbacksController#failure as HTML
Parameters: {"code"=>"c166206446884317a72fa1c03772a2b622c9135c526e7a", "response_type"=>"code"}
Redirected to https://dtest.pagekite.me/?locale=en
Filter chain halted as :authorize rendered or redirected
Completed 302 Found in 8ms (ActiveRecord: 0.0ms)
The domain registered on ClassLink matches our server and the callback url is correct. The permissions, routes, callback function, etc. all look OK to me (again, pretty much identical to Facebook). Any suggestions on where I might look next?
Thanks.
It sounds like you have a few different problems going on here.
15:14:51 web.1 | D, [2022-09-01T15:14:51.715485 #1139413] DEBUG -- omniauth: (classlink) Callback phase initiated. 15:14:51 web.1 | E, [2022-09-01T15:14:51.720435 #1139413] ERROR -- omniauth: (classlink) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
In the request phase, you receive a state parameter with a random value. The omniauth-oauth2 strategy (from which the omniauth-classlink strategy is subclassed) stores this value in the session. In the callback phase, you again receive a state parameter and it must match the one received in the request phase. This error almost always means there is something wrong with your session
NoMethodError: undefined method `new' for "OmniAuth::Strategies::ClassLink":String
The value of the strategy_class option should be the class name constant. Removing the quotes should fix it.
Processing by Users::OmniauthCallbacksController#failure as HTML Parameters: {"code"=>"c166206446884317a72fa1c03772a2b622c9135c526e7a", "response_type"=>"code"} Redirected to https://dtest.pagekite.me/?locale=en Filter chain halted as :authorize rendered or redirected Completed 302 Found in 8ms (ActiveRecord: 0.0ms)
This is Devise trying to authorize the callback request when it should not be. Is your Users::OmniauthCallbacksController calling authenticate_user! in a before action or inheriting that behavior from a parent class?
I am building rails and google oauth for a project. Right now, it is a very straight forward set up
# gemfile
gem 'rails', '~> 5.2.3'
gem 'administrate'
gem 'devise', github: 'heartcombo/devise', branch: 'ca-omniauth-2'
gem 'omniauth-google-oauth2'
gem 'dotenv-rails', groups: [:development, :test]
gem 'google-api-client', require: 'google/apis/calendar_v3'
gem 'omniauth-rails_csrf_protection'
# devise.rb
config.omniauth :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], {
access_type: "offline",
prompt: "consent",
select_account: true,
scope: 'userinfo.email, calendar, openid',
provider_ignores_state: true
}
and then I have my code working for auth'ing with Google and logging users into devise.
I am using google calendar for a scope, which is now as of 2021 considered a sensitive scope, and because of that I have to add test users to the google project to get it to work. Currently in my google set up, I have 2 users white-listed as allowed users to use the app.
Right now, 1 user is able to log into the app just fine. They go to the page, auth with google, accept permissions, and google logs them in.
For 1 other user, google does not work. They go to the page, attempt to auth with google, and get a page back that says
SOMETHING WENT WRONG
sorry, something went wrong there. Try again.
and then are redirected to the google error page that says
400. That's an error
The server cannot process the request because it is malformed. It should not be retried.
That's all we know.
I'm not able to figure this out, because it is working perfectly for 1 user and not for the other. The only thing I can think of is looking in the heroku logs. I was able to find requests for both users.
Here are the logs for a successful login
2021-01-26T19:15:49.316985+00:00 app[web.1]: I, [2021-01-26T19:15:49.316862 #4] INFO -- : [c8194f6f-6cc9-4d1c-8ea2-9439d4a3f758] Started POST "/admin_users/auth/google_oauth2" for 108.80.197.86 at 2021-01-26 19:15:49 +0000
2021-01-26T19:15:49.317524+00:00 app[web.1]: D, [2021-01-26T19:15:49.317454 #4] DEBUG -- omniauth: (google_oauth2) Request phase initiated.
2021-01-26T19:15:49.331305+00:00 heroku[router]: at=info method=POST path="/admin_users/auth/google_oauth2" host=<host> request_id=c8194f6f-6cc9-4d1c-8ea2-9439d4a3f758 fwd="108.80.197.86" dyno=web.1 connect=1ms service=16ms status=302 bytes=1662 protocol=https
2021-01-26T19:15:59.988809+00:00 app[web.1]: I, [2021-01-26T19:15:59.988635 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Started GET "/admin_users/auth/google_oauth2/callback?state=<state>&code=<code>&scope=email%20https://www.googleapis.com/auth/calendar%20https://www.googleapis.com/auth/userinfo.email%20openid&authuser=0&prompt=consent" for 108.80.197.86 at 2021-01-26 19:15:59 +0000
2021-01-26T19:15:59.989574+00:00 app[web.1]: D, [2021-01-26T19:15:59.989451 #4] DEBUG -- omniauth: (google_oauth2) Callback phase initiated.
2021-01-26T19:16:00.159852+00:00 app[web.1]: I, [2021-01-26T19:16:00.159697 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Processing by AdminUsers::OmniauthCallbacksController#google_oauth2 as HTML
2021-01-26T19:16:00.159977+00:00 app[web.1]: I, [2021-01-26T19:16:00.159863 #4] INFO -- : [cb1c461a-de2d-47cf-97d7-c5c594dcedc2] Parameters: {"state"=>"<state>", "code"=>"<code>", "scope"=>"email https://www.googleapis.com/auth/calendar https://www.googleapis.com/auth/userinfo.email openid", "authuser"=>"0", "prompt"=>"consent"}
Here are the logs for an unsuccessful login
2021-01-26T14:16:32.326486+00:00 app[web.1]: I, [2021-01-26T14:16:32.326382 #4] INFO -- : [545e059b-7f9b-4687-8b0e-b9f7479625e2] Started POST "/admin_users/auth/google_oauth2" for 107.203.102.116 at 2021-01-26 14:16:32 +0000
2021-01-26T14:16:32.326882+00:00 app[web.1]: D, [2021-01-26T14:16:32.326810 #4] DEBUG -- omniauth: (google_oauth2) Request phase initiated.
2021-01-26T14:16:32.331603+00:00 heroku[router]: at=info method=POST path="/admin_users/auth/google_oauth2" host=<host> request_id=545e059b-7f9b-4687-8b0e-b9f7479625e2 fwd="107.203.102.116" dyno=web.1 connect=0ms service=9ms status=302 bytes=1674 protocol=https
So in looking at the logs, the unsuccessful request just stops after the user hits the google button and google seems like it's not calling back the request.
Why would it be working for 1 user, and not working for another?
Any help is much appreciated
This was resolved. the problem was the other user was using a google provided email that was not a gmail i.e. a email#domain.com email address. even though it is controlled by google, it seems like you need a gmail to auth. we switched to a gmail email and it worked fine.
I have a Rails app that works perfectly in development. I have deployed to the server and the app loads and correctly shows its landing and about pages. However, when I go to a page with Action Cable, the server blocks. The last request out from the web page is Action Cable related, and further page actions (form submission, and even reloads) and not responded to.
I have isolated it to the server as attempting to load the site's main page from another browser does not work. Closing the tab where the request to Action Cable was first made results in the other page loading immediately (and all of the pending requests from the first page suddenly being processed).
I do not see any errors in production.log, but here is the part leading up to the hang:
I, [2018-01-24T21:12:38.601260 #9840] INFO -- : [86b3fcc1-cebd-4d70-99ff-b6f9f147bc00] Rendered collection of skill_checks/_skill_check.html.erb [5 times] (16.7ms)
I, [2018-01-24T21:12:38.601352 #9840] INFO -- : [86b3fcc1-cebd-4d70-99ff-b6f9f147bc00] Rendered rooms/show.html.erb within layouts/application (26.6ms)
I, [2018-01-24T21:12:38.602314 #9840] INFO -- : [86b3fcc1-cebd-4d70-99ff-b6f9f147bc00] Completed 200 OK in 32ms (Views: 26.7ms | ActiveRecord: 1.8ms)
I, [2018-01-24T21:12:38.740061 #9840] INFO -- : [5a06a7d8-a4a5-4ab4-8287-377dfa3447fe] Started GET "/cable" for 65.99.102.74 at 2018-01-24 21:12:38 +0000
I, [2018-01-24T21:12:38.740860 #9840] INFO -- : [5a06a7d8-a4a5-4ab4-8287-377dfa3447fe] Started GET "/cable/" [WebSocket] for 65.99.102.74 at 2018-01-24 21:12:38 +0000
I, [2018-01-24T21:12:38.740970 #9840] INFO -- : [5a06a7d8-a4a5-4ab4-8287-377dfa3447fe] Successfully upgraded to WebSocket (REQUEST_METHOD: GET, HTTP_CONNECTION: upgrade, HTTP_UPGRADE: websocket)
I, [2018-01-24T21:12:38.794498 #9840] INFO -- : RoomsChannel is transmitting the subscription confirmation
I, [2018-01-24T21:12:38.795245 #9840] INFO -- : RoomsChannel is streaming from room_helloworld
Once I close the offending tab, load continues (in this case, of a javascript request that was triggered on page reload) as follows:
I, [2018-01-24T21:15:55.109087 #9840] INFO -- : Finished "/cable/" [WebSocket] for 65.99.102.74 at 2018-01-24 21:15:55 +0000
I, [2018-01-24T21:15:55.109342 #9840] INFO -- : RoomsChannel stopped streaming from room_helloworld
I, [2018-01-24T21:15:55.110922 #9840] INFO -- : [2cf5cc53-2f44-42a9-be30-496bb80646a0] Started GET "/rooms/helloworld?update=true" for 65.99.102.74 at 2018-01-24 21:15:55 +0000
I, [2018-01-24T21:15:55.112841 #9840] INFO -- : [2cf5cc53-2f44-42a9-be30-496bb80646a0] Processing by RoomsController#show as HTML
I've truncated the remainder; there were no failures or anything else of interest in there.
I do have a redis server running on the same server and have put its port information into config/cable.yml under the production: section.
I believe that Rails can see it as I haven't seen any errors. Additionally, to verify this I connected to redis through redis-cli and subscribed to a channel, and then through the Rails console sent a broadcast message to that channel and verified receipt.
Update: I've tried a few different builds to isolate the issue. Here's what I now know:
I removed my only call to ActionCable.server.broadcast, so that isn't the source of the block.
I added javascript console logs to connected, disconnected, and received. The client does successfully subscribe.
I tried a build where I removed the App.cable.subscriptions.create from the client. While there is no websocket connection in this case (as you would expect), the server does not block/hang.
Given the above, I am certain this has to do with ActionCable, though I'm not sure if it has anything to do with my redis configuration.
This turned out the be the behaviour you get if you haven't set the following lines inside of your nginx conf file (inside of the server section):
location /cable {
passenger_app_group_name your_app_websocket;
passenger_force_max_concurrent_requests_per_process 0;
}
where, if your app name is "chat", the first line would read:
passenger_app_group_name chat_action_cable
Which, frankly, I'm not sure where is defined, but it may be part of the Rails magic.
I've all of a sudden started getting this error when creating users in my app. Emails were working before I left for vacation, now I come back and this is what my tech support gives me! Ugh.
So, I make a user, and I get redirected to my admin panel with the following error in a flash notice: getaddrinfo: name or service not known. The user isn't created.
Looking at the logs, it looks like everything worked fine:
I, [2016-04-12T08:01:52.089647 #11555] INFO -- : Started POST "/admin/user/new" for 72.238.202.193 at 2016-04-12 08:01:52 -0500
I, [2016-04-12T08:01:52.092114 #11555] INFO -- : Processing by RailsAdmin::MainController#new as HTML
I, [2016-04-12T08:01:52.092259 #11555] INFO -- : Parameters: {"utf8"=>"✓", "authenticity_token"=>"vxhuTwXhQo6nYrskQcYH9W56Ej95LgzEbs8cnkjXQI4=", "user"=>{"company_id"=>"35", "username"=>"myuser#thedomain.com", "first_name"=>"Test", "last_name"=>"User", "full_name"=>"Test User", "time_zone"=>"Central Time (US & Canada)", "email"=>"myuser#thedomain.com", "phone_number"=>"", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]", "reset_password_sent_at"=>"[FILTERED]", "remember_created_at"=>"", "sign_in_count"=>"0", "current_sign_in_at"=>"", "last_sign_in_at"=>"", "current_sign_in_ip"=>"", "last_sign_in_ip"=>"", "authentication_token"=>"", "enable_notifications"=>"1", "confirmation_token"=>"MBrmpsD6Wtf1VBrhtDyc", "confirmed_at"=>"", "confirmation_sent_at"=>"April 12, 2016 10:00", "unconfirmed_email"=>"myuser#thedomain.com", "terms_accepted"=>"1", "cancel_subscription"=>"0", "on_trial"=>"0", "is_account_owner"=>"1", "role_ids"=>["", "", "2"]}, "return_to"=>"https://www.myserver.com/admin/user?sort=created_at&sort_reverse=false", "_save"=>"", "model_name"=>"user"}
I, [2016-04-12T08:01:52.212064 #11555] INFO -- : Rendered devise/mailer/confirmation_instructions.html.erb (1.6ms)
I, [2016-04-12T08:01:52.340343 #11555] INFO -- :
Sent mail to myuser#thedomain.com (9.3ms)
I've filtered the email address but, rest assured, it's a valid email.
I'm using EC2 to host my application, so I can't edit /etc/resolv.conf since any changes will be overridden.
I've run nslookup to make sure the server can find the domain MX records, which it does using the nameserver specified in /etc/resolv.conf.
What else can I do to troubleshoot this issue?
I used a recommendation I ran across on another blog to use Ruby's version of Resolv instead of the libc library with Ubuntu. So, I added the following line to an initializer: require resolv-replace.rb.
Now my error is a little more descriptive: Hostname not known: smtp.sendgrid.net, so I checked config/environments/production.rb and it turns out I had a trailing space at the end of my host line. Removed it and all is working now!
I'm using Devise + Omniauth (actually omniauth-foursquare, the foursquare OAuth2 strategy) in my Rails app.
Upon signing in, I keep being redirected to my app (/users/sign_in#=) with the following error:
Could not authenticate you from Foursquare because "Csrf detected"
Any insights?
This is what I see last in the console:
I, [2014-10-19T19:43:38.947771 #2] INFO -- omniauth: (foursquare) Request phase initiated.
Started GET "/users/auth/foursquare" for 142.255.113... at 2014-10-19 19:43:38 +0000
Parameters: {"code"=>"2MZGM413...", "state"=>"1ba1cec3beb4..."}
Processing by Devise::SessionsController#new as HTML
Started GET "/users/auth/foursquare/callback?code=2MZGM413...&state=1ba1cec3beb4..." for 142.255.113... at 2014-10
I, [2014-10-19T19:43:39.378477 #2] INFO -- omniauth: (foursquare) Callback phase initiated.
E, [2014-10-19T19:43:39.378660 #2] ERROR -- omniauth: (foursquare) Authentication failure! csrf_detected: OmniAuth::Strategies::OAuth2::CallbackError, csrf_detected | CSRF detected
As far as I can tell, my troubles started when I received a "cookie overflow" erorr and switched to session_storing: (session_store.rb)
Rails.application.config.session_store :active_record_store, key: '_APPNAME_session', domain: 'DOMAIN.com'
Thanks!
If you inspect the source for your app, you'll see that the generated HTML includes the CSRF meta tags in the HEAD element (i.e. csrf-token and csrf-param). Most likely, one of your layouts/views is calling the csrf_meta_tags method. Try removing it to see if it works, and then consider creating a separate layout without it for forms that won't need it. Other people with more experience on frontend rails could chime in here with best practices.