pagure

#3120 Pagure does not trust oidc tokens issued by keycloak
Closed: Fixed Opened by wattersmt.

Closed: Fixed
Reopen Issue

I have configured a pagure instance to authenticate users using OIDC and our keyclock server however pagure is showing a 500 error after a user logs in. The logs apache logs show errors as follows.

[Mon Apr 02 15:16:15.101334 2018] [:error] [pid 5464] 2018-04-02 15:16:15,101 [INFO] oauth2client.client: Successfully retrieved access token
[Mon Apr 02 15:16:15.104539 2018] [:error] [pid 5464] 2018-04-02 15:16:15,103 [ERROR] flask_oidc: id_token issued by non-trusted issuer: https://auth.example.com/auth/realms/realm

There doesn't appear to be a configuration option to define trusted providers in pagure.cfg. Is there a way that we can make this work?

You want the setting OIDC_VALID_ISSUERS = ['https://auth.example.com/auth/realms/realm']

Alternatively, you can set the issuer key in client_secrets.json.

A number of the configuration keys available for oidc are listed in: http://flask-oidc.readthedocs.io/en/latest/?badge=latest#settings-reference

I'll add this to the documentation :)

Metadata Update from @pingou:
- Issue assigned to pingou
- Issue tagged with: doc

Thanks for the info. A working example would be nice to have in the documentation. I will submit a PR to resolve this.

Commit 8244414d fixes this issue
Metadata

doc

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.