As stipulated in RFC8252 (https://datatracker.ietf.org/doc/html/rfc8252#section-7.3)
7.3. Loopback Interface Redirection Native apps that are able to open a port on the loopback network interface without needing special permissions (typically, those on desktop operating systems) can use the loopback interface to receive the OAuth redirect. Loopback redirect URIs use the "http" scheme and are constructed with the loopback IP literal and whatever port the client is listening on. That is, "http://127.0.0.1:{port}/{path}"; for IPv4, ... The authorization server MUST allow any port to be specified at the time of the request for loopback IP redirect URIs, to accommodate clients that obtain an available ephemeral port from the operating system at the time of the request. Hence, as I understand it, CAS should properly redirect an OIDC Dynamicly created service with a serviceId of "http://127.0.0.1"; while a client later valides the url with "http://127.0.0.1:40709"; ownCloud Client Desktop log 11-22 14:17:39:760 [ debug sync.credentials.oauth ] [ isUrlValid ]: Checking URL for validity: QUrl("https://secure.redacted.com/cas/oidc/oidcAuthorize?response_type=code&client_id=EypOKlThOZe6FDMnXPvwnefV5vwaEg2fO2Y9&redirect_uri=http://127.0.0.1:40709&code_challenge=wvuB6-9PdhJaV-vwsig3ILw2BWAigICoQ6MtnaughEE&code_challenge_method=S256&scope=openid offline_access email profile&prompt=select_account consent&state=IXo0lpOqYtZMLLB_DVBTrvAyElWR5xZyFwsH5-2WhZA%3D&login_hint=someone&user=someone") CAS server log: 2021-11-22 14:17:42,568 ERROR [org.apereo.cas.support.oauth.util.OAuth20Utils] - <Unsupported [redirect_uri]: [http://127.0.0.1:40709] does not match what is defined for registered service: [http://127.0.0.1]. Service is considered unauthorized. Verify the service matching strategy used in theservice definition is correct and does in fact match the client [http://127.0. 0.1:40709]> On Thursday, November 11, 2021 at 8:45:40 AM UTC-5 G Lalonde wrote: > This latest release (RC2) has fixed the issue with the missing > "client_secret_expires_at" field but unfortunately the JSON service > definition created by the client registration (i.e. ownCloud Desktop > client) is created with a serviceId of "http://127.0.0.1"; but the > redirected_uri always includes a random port number. Since I don't control > the service definition creation (the client does), I can't get the > serviceId to be "http://127.0.0.1:.*"; which CAS will properly redirect. Is > there a CAS configuration setting to relax the serviceId matching or is > this an OIDC client issue? > > Currently using: cas.authn.oidc.core.dynamic-client-registration-mode=OPEN > > CAS server log: > > 2021-11-10 15:36:20,204 WARN > [org.apereo.cas.services.resource.AbstractResourceBasedServiceRegistry] - > <[ownCloud2.9.1(build5500)-1636576580202.json] does not match the > recommended pattern [(\w+-)+(\d+)\.json]. While CAS tries to be forgiving > as much as possible, it's recommended that you rename the file to match the > requested pattern to avoid issues with duplicate service loading. Future > CAS versions may try to strictly force the naming syntax, refusing to load > the file.> > 2021-11-10 15:36:20,794 ERROR > [org.apereo.cas.support.oauth.util.OAuth20Utils] - <Unsupported > [redirect_uri]: [http://127.0.0.1:40839] does not match what is defined > for registered service: [http://127.0.0.1]. Service is considered > unauthorized. Verify the service matching strategy used in the service > definition is correct and does in fact match the client [ > http://127.0.0.1:40839]> > > ownCloud Desktop client log: > > 11-10 15:36:20:107 [ info sync.httplogger ]: > "5b22ff68-93f0-4588-80b7-31b01bba9218: > Request: POST https://secure.redacted.com/cas/oidc/register Header: { > Content-Type: application/json, User-Agent: Mozilla/5.0 (Linux) > mirall/2.9.1 (build 5500) (ownCloud, ubuntu-5.4.154-0504154-generic > ClientArchitecture: x86_64 OsArchitecture: x86_64), Accept: */*, > X-Request-ID: 5b22ff68-93f0-4588-80b7-31b01bba9218, Original-Request-ID: > 5b22ff68-93f0-4588-80b7-31b01bba9218, Content-Length: 201, } Data: [{\n > \"application_type\": \"native\",\n \"client_name\": \"ownCloud 2.9.1 > (build 5500)\",\n \"redirect_uris\": [\n \"http://127.0.0.1\"\n ],\n > \"token_endpoint_auth_method\": \"client_secret_basic\"\n}\n]" > > > CAS JSON service definition created by client > (ownCloud2.9.1(build5500)-1636576580202.json) > { > @class: org.apereo.cas.services.OidcRegisteredService > serviceId: http://127.0.0.1 > name: ownCloud 2.9.1 (build 5500) > id: 1636576580202 > description: Registered service ownCloud 2.9.1 (build 5500) > logoutUrl: "" > clientSecret: EQfoYQ0uscSGDwqzQQCkiDvbUMTv4Or1QnGw > clientId: QRRw9U52xBQYyyO0glZLSmS9LII6Jg3t3kvl > dynamicallyRegistered: true > dynamicRegistrationDateTime: 2021-11-10T20:36:20.201971Z > scopes: > [ > java.util.HashSet > [ > address > phone > openid > email > profile > offline_access > ] > ] > } > > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/3a414bf9-59b3-46a0-8ece-a5c84986545cn%40apereo.org.
