mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-02-08 11:19:36 +03:00
Integration error using OpenID and AWS Cognito #3382
Closed
opened 2026-02-05 06:33:35 +03:00 by OVERLORD
·
7 comments
No Branch/Tag Specified
development
further_theme_development
l10n_development
release
llm_only
vectors
v25-11
docker_env
drawio_rendering
user_permissions
ldap_host_failover
svg_image
prosemirror
captcha_example
fix/video-export
v25.12.3
v25.12.2
v25.12.1
v25.12
v25.11.6
v25.11.5
v25.11.4
v24.11.4
v25.11.3
v25.11.2
v25.11.1
v25.11
v25.07.3
v25.07.2
v25.07.1
v25.07
v25.05.2
v25.05.1
v25.05
v25.02.5
v25.02.4
v25.02.3
v25.02.2
v25.02.1
v25.02
v24.12.1
v24.12
v24.10.3
v24.10.2
v24.10.1
v24.10
v24.05.4
v24.05.3
v24.05.2
v24.05.1
v24.05
v24.02.3
v24.02.2
v24.02.1
v24.02
v23.12.3
v23.12.2
v23.12.1
v23.12
v23.10.4
v23.10.3
v23.10.2
v23.10.1
v23.10
v23.08.3
v23.08.2
v23.08.1
v23.08
v23.06.2
v23.06.1
v23.06
v23.05.2
v23.05.1
v23.05
v23.02.3
v23.02.2
v23.02.1
v23.02
v23.01.1
v23.01
v22.11.1
v22.11
v22.10.2
v22.10.1
v22.10
v22.09.1
v22.09
v22.07.3
v22.07.2
v22.07.1
v22.07
v22.06.2
v22.06.1
v22.06
v22.04.2
v22.04.1
v22.04
v22.03.1
v22.03
v22.02.3
v22.02.2
v22.02.1
v22.02
v21.12.5
v21.12.4
v21.12.3
v21.12.2
v21.12.1
v21.12
v21.11.3
v21.11.2
v21.11.1
v21.11
v21.10.3
v21.10.2
v21.10.1
v21.10
v21.08.6
v21.08.5
v21.08.4
v21.08.3
v21.08.2
v21.08.1
v21.08
v21.05.4
v21.05.3
v21.05.2
v21.05.1
v21.05
v21.04.6
v21.04.5
v21.04.4
v21.04.3
v21.04.2
v21.04.1
v21.04
v0.31.8
v0.31.7
v0.31.6
v0.31.5
v0.31.4
v0.31.3
v0.31.2
v0.31.1
v0.31.0
v0.30.7
v0.30.6
v0.30.5
v0.30.4
v0.30.3
v0.30.2
v0.30.1
v0.30.0
v0.29.3
v0.29.2
v0.29.1
v0.29.0
v0.28.3
v0.28.2
v0.28.1
v0.28.0
v0.27.5
v0.27.4
v0.27.3
v0.27.2
v0.27.1
v0.27
v0.26.4
v0.26.3
v0.26.2
v0.26.1
v0.26.0
v0.25.5
v0.25.4
v0.25.3
v0.25.2
v0.25.1
v0.25.0
v0.24.3
v0.24.2
v0.24.1
v0.24.0
v0.23.2
v0.23.1
v0.23.0
v0.22.0
v0.21.0
v0.20.3
v0.20.2
v0.20.1
v0.20.0
v0.19.0
v0.18.5
v0.18.4
v0.18.3
v0.18.2
v0.18.1
v0.18.0
v0.17.4
v0.17.3
v0.17.2
v0.17.1
v0.17.0
v0.16.3
v0.16.2
v0.16.1
v0.16.0
v0.15.3
v0.15.2
v0.15.1
v0.15.0
v0.14.3
v0.14.2
v0.14.1
v0.14.0
v0.13.1
v0.13.0
v0.12.2
v0.12.1
v0.12.0
v0.11.2
v0.11.1
v0.11.0
v0.10.0
v0.9.3
v0.9.2
v0.9.1
v0.9.0
v0.8.2
v0.8.1
v0.8.0
v0.7.6
v0.7.5
v0.7.4
v0.7.3
0.7.2
v.0.7.1
v0.7.0
v0.6.3
v0.6.2
v0.6.1
v0.6.0
v0.5.0
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label
🐕 Support
Milestone
No items
No Milestone
Projects
Clear projects
No project
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: starred/BookStack#3382
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @tedivo on GitHub (Dec 3, 2022).
Attempted Debugging
Searched GitHub Issues
Describe the Scenario
I'm trying to integrate BookStackApp with AWS Cognito using OpenID.
Everything has been configured as per the documentation available and the YouTube video, however when I click Login with OIDC, it presents an Unknown Error occurred. See logs showing
Enabling debug logs show this...
Exact BookStack Version
22.11
Log Content
PHP Version
7.4.3
Hosting Environment
Ubuntu 20.04.5 LTS installed manually with git clone
@ssddanbrown commented on GitHub (Dec 3, 2022):
Tracing the error through, I get the impression that query parameters are maybe not being handled here.
codeparameter in the URL?@tedivo commented on GitHub (Dec 3, 2022):
Hi - thanks for the quick response.
The callback URL does not have a
codeparameter.https://docs.example.com/oidc/callback?error_description=invalid_scope&state=c50fdebacf62de85967a572bc94a06d0&error=invalid_requestI'm using Apache web server. which config are you looking for? The apache2.conf or the site conf?
@ssddanbrown commented on GitHub (Dec 3, 2022):
@tedivo That's okay, don't need the server config now based on the URL.
So AWS cognito is returning an "invalid scope" error.
By default BookStack will request the
openid,profile&emailscopes, not sure what is tripping AWS cognito here. If you've set theOIDC_ADDITIONAL_SCOPESoption that could also affect things here.@tedivo commented on GitHub (Dec 3, 2022):
That was it - perfect! Thank you.
Can you please update the documentation with the scopes that are used by default?
@tedivo commented on GitHub (Dec 3, 2022):
@ssddanbrown - Sorry, one further issue downstream. The login screen from Cognito is now being displayed but once I authenticate, the callback URL is displaying JSON on screen instead of taking me back into the BookStackApp.
Callback URL
https://docs.example.com/oidc/callback?code=2f97bb4a-0eda-4330-93cd-f2ba110bcb95&state=80b51548034bd69f9c36935f50f71e98JSON displayed
{"at_hash":"iFxK7gMu60p_L-DhSyJAFg","sub":"e958c733-1666-40bb-acdf-9dfea40fc714","email_verified":true,"custom:organization_id":"43eb4c8f-234d-4b29-89b6-000000000000","iss":"https:\/\/cognito-idp.us-west-1.amazonaws.com\/us-west-1_cEGDILpY4","cognito:username":"e958c733-1666-40bb-acdf-9dfea40fc714","origin_jti":"b853717e-9588-4c3a-8d3b-372fb1839f1a","aud":"4kb2r55a3c0flt8p9fircvfag3","event_id":"116d622b-5868-4841-99e6-5bf88bf60918","token_use":"id","auth_time":1670022961,"name":"Mark","exp":1670026561,"iat":1670022961,"family_name":"PTL","jti":"a1c94201-6bba-4da9-8cb6-2835d8d3aa2e","email":"mark@example.com"}@ssddanbrown commented on GitHub (Dec 3, 2022):
@tedivo Do you currently have the
OIDC_DUMP_USER_DETAILSoption set totrue?@tedivo commented on GitHub (Dec 3, 2022):
Yes - I did :-(
I'm sorry. Set to false and it works perfectly now!