Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

oxTrust doesn't handle "Authorized JavaScript Origins" OIDC client property properly when SQL db is used for persistence #2350

Open
aliaksander-samuseu opened this issue Jul 5, 2023 · 0 comments
Assignees
Milestone

Comments

@aliaksander-samuseu
Copy link
Contributor

aliaksander-samuseu commented Jul 5, 2023

Description

When Gluu Server is installed with SQL db as persistence layer, and "Authorized JavaScript Origins" property is set for any of OIDC clients registered in the system, instead of displaying it as a list of items in web UI, it shows raw unparsed JSON object used to store this item in "oxAuthAuthorizedOrigins" field of the "oxAuthClient" SQL table. When this happens, web UI won't allow you to update this client any longer, throwing an error - until "oxAuthAuthorizedOrigins" property is removed. The issue doesn't happen in LDAP-based installations.

Preconditions

  1. Latest released Gluu Server CE package is installed with MySQL as persistence layer

Steps To Reproduce

  1. Log in to oxTrust
  2. Move to "OpenID Connect" > "Clients" page
  3. Open any client's properties page for which no "Authorized JavaScript Origins" property has yet been defined and switch to "Software info" tab
  4. Put several random uris to the list called "Authorized JavaScript Origins" on the page and click "Update" button
  5. Switch to "Software info" tab and remember how "Authorized JavaScript Origins" list looks like right after the update
  6. Refresh the page (either hit F5 key or click Refresh button of your browser)
  7. Switch to "Software info" tab and see how "Authorized JavaScript Origins" list looks like now
  8. Change any other property of the client and try to update it again

Expected behavior

"Authorized JavaScript Origins" property is always represented as a list of uris in web UI

Actual behavior

At step 5) it actually still looks like it should - but after page is refreshed, instead of the list of uris it's rendered as a single item containing JSON object which contains list of uris, like this: {"v":["https://oidc-js.site","https://oidc-js.site:5000"]}
This is actually how it looks like when it's stored in db. So it doesn't parse the raw data value before rendering it on page. See the picture with comparison below.

When you try to update the client later, it won't persist it and next error is logged to "oxtrust.log":

Caused by: com.querydsl.core.QueryException: Caught MysqlDataTruncation for update gluudb.oxAuthClient
set oxAuthAuthorizedOrigins = ?
where doc_id = ?
	at com.querydsl.sql.DefaultSQLExceptionTranslator.translate(DefaultSQLExceptionTranslator.java:50) ~[querydsl-sql-5.0.0.jar:?]
	at com.querydsl.sql.Configuration.translate(Configuration.java:507) ~[querydsl-sql-5.0.0.jar:?]
	at com.querydsl.sql.dml.AbstractSQLUpdateClause.execute(AbstractSQLUpdateClause.java:213) ~[querydsl-sql-5.0.0.jar:?]
	at org.gluu.persist.sql.operation.impl.SqlOperationServiceImpl.updateEntryImpl(SqlOperationServiceImpl.java:270) ~[gluu-orm-sql-4.5.1.Final.jar:?]
	at org.gluu.persist.sql.operation.impl.SqlOperationServiceImpl.updateEntry(SqlOperationServiceImpl.java:221) ~[gluu-orm-sql-4.5.1.Final.jar:?]
	at org.gluu.persist.sql.impl.SqlEntryManager.merge(SqlEntryManager.java:266) ~[gluu-orm-sql-4.5.1.Final.jar:?]
	... 88 more
Caused by: com.mysql.cj.jdbc.exceptions.MysqlDataTruncation: Data truncation: Data too long for column 'oxAuthAuthorizedOrigins' at row 1

jscript_origins

@nynymike nynymike added this to the 4.5.2 milestone Jul 5, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants