|
|
Hello,
|
|
|
|
openid server is s Shibboleth IDP v5.1.4 with
Plugin: net.shibboleth.oidc.common Current Version: 3.2.0
Plugin: net.shibboleth.idp.plugin.oidc.op Current Version: 4.2.1
Plugin: net.shibboleth.idp.plugin.oidc.config Current Version: 2.2.0 |
|
|
|
Now I have gdb installed on our test system. Please guide me to set breakpoints at the appropriate locations. |
|
|
|
Do you use the release 5.12.1 or the nightly after 5.12.1 ? |
|
|
|
It's the latest nightly: sogo v5.12.1.20250610-1 |
|
|
|
Ok, put a breakpoint here -> https://github.com/Alinto/sogo/blob/9954c3607bfda55424f5ac532a1075407235f345/SoObjects/SOGo/SOGoOpenIdSession.m#L5637
b SoObjects/SOGo/SOGoOpenIdSession.m:563
It is after sogo fetch the token. When here, check the value of the var expiresIn
p expiresIn
po expiresIn
You can also check the dictionary from the request response
po tokenRet
Then put a breakpoint here -> https://github.com/Alinto/sogo/blob/9954c3607bfda55424f5ac532a1075407235f345/SOPE/GDLContentStore/GCSOpenIdFolder.m#L310
b SOPE/GDLContentStore/GCSOpenIdFolder.m:310
It is just before inserting in the database, check the value of expiration and the dictionary of columns/value
p nowExpire
po newRecord
|
|
|
|
Starting program: /usr/sbin/sogod -WOUseWatchDog NO -WONoDetach YES -WOPort 127.0.0.1:20000 -WOWorkersCount 1 -WOLogFile - -WOPidFile /tmp/sogo.pid
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: the debug information found in "/usr/lib/debug//usr/lib/libSBJson.so.2.3.1" does not match "/lib/libSBJson.so.2" (CRC mismatch).
Jun 10 15:52:05 sogod [10797]: version 5.12.1 (build @sogo-build.alinto.int 202506100544) -- starting
Jun 10 15:52:05 sogod [10797]: vmem size check enabled: shutting down app when vmem > 512 MB. Currently at 87 MB
Jun 10 15:52:05 sogod [10797]: <0x0x5555558bcdb0[SOGoProductLoader]> SOGo products loaded from '/usr/lib/GNUstep/SOGo':
Jun 10 15:52:05 sogod [10797]: <0x0x5555558bcdb0[SOGoProductLoader]> PreferencesUI.SOGo, CommonUI.SOGo, Mailer.SOGo, MainUI.SOGo, Appointments.SOGo, MailPartViewers.SOGo, AdministrationUI.SOGo, ContactsUI.SOGo, Contacts.SOGo, SchedulerUI.SOGo, MailerUI.SOGo
Jun 10 15:52:06 sogod [10797]: All products loaded - current memory usage at 93 MB
Jun 10 15:52:06 sogod [10797]: |SOGo| WOHttpAdaptor listening on address 127.0.0.1:20000
^C
Program received signal SIGINT, Interrupt.
0x00007ffff6b5c9e3 in __GI___poll (fds=0x555555c0b3e0, nfds=2, timeout=timeout@entry=29906)
at ../sysdeps/unix/sysv/linux/poll.c:29
29 ../sysdeps/unix/sysv/linux/poll.c: Datei oder Verzeichnis nicht gefunden.
(gdb) b SoObjects/SOGo/SOGoOpenIdSession.m:563
Breakpoint 1 at 0x7ffff7f241fe: file SOGoOpenIdSession.m, line 563.
(gdb) p expiresIn
No symbol "expiresIn" in current context.
(gdb) po expiresIn
No symbol "expiresIn" in current context.
(gdb) po tokenRet
No symbol "tokenRet" in current context.
(gdb) b SOPE/GDLContentStore/GCSOpenIdFolder.m:310
Breakpoint 2 at 0x7ffff7e1046b: file GCSOpenIdFolder.m, line 310.
(gdb) c
Continuing.
^C
Program received signal SIGINT, Interrupt.
0x00007ffff6b5c9e3 in __GI___poll (fds=0x555555c0b3e0, nfds=2, timeout=timeout@entry=25393)
at ../sysdeps/unix/sysv/linux/poll.c:29
29 in ../sysdeps/unix/sysv/linux/poll.c
(gdb) p nowExpire
No symbol "nowExpire" in current context.
(gdb) po nowExpire
No symbol "nowExpire" in current context.
|
|
|
|
Ah sorry I haven't explained it properly.
First launch gdb with sogo with the correct IP and port (the value you put for WOPort in your sogo.conf or init.d/sogo.service)
/usr/sbin/sogod -WOUseWatchDog NO -WONoDetach YES -WOPort 127.0.0.1:20000 -WOWorkersCount 1 -WOLogFile - -WOPidFile /tmp/sogo.pid
If sogo directly runs, you may stop it first with ctrl-c
Then set your two breakpoints:
b SoObjects/SOGo/SOGoOpenIdSession.m:563
b SOPE/GDLContentStore/GCSOpenIdFolder.m:310
If gdb ask for missing library, say yes/y.
Then run sogo, again say yes if gdb ask something
r
Then go to your browser and go to SOGo and do all the process to connect yourself. When you successfully login to your openid server, the breakpoints should stop the program.
Then here you can check the variables with p and po. |
|
|
|
Breakpoint 1:
...
Breakpoint 1, -[SOGoOpenIdSession fetchToken:redirect:] (self=0x555555dcddc0,
_cmd=0x7ffff2974620 <_OBJC_SELECTOR_TABLE+1632>, code=0x555555d2b220, oldLocation=0x555555dc0620)
at SOGoOpenIdSession.m:563
563 SOGoOpenIdSession.m: Datei oder Verzeichnis nicht gefunden.
(gdb) p expiresIn
$1 = (NSNumber *) 0x5555559e0c30
(gdb) po expiresIn
600
(gdb) po tokenRet
{"access_token" = "eyJraWQiOiJkZWZhdWx0UlNBU2lnbiIsInR5cCI6ImF0K2p3dCIsImFsZyI6IlJTNTEyIn0.eyJzdWIiOiJmYjRlZGQ3ZjdiMjQ3OTg2NzQzYmM0NzQzODU1M2Q1MCIsImlzcyI6Imh0dHBzOi8vaWRwLXRlc3QudW5pLWtvbnN0YW56LmRlIiwiZm9yX29wIjoiQUFkelpXTnlaWFF4azN1czlqVzByQUlnN1lsYlpacmZOSFprU3drWDd3WnFZcVFkUkk2RjlVczFmMEEwbi1lMlpGQXZYRFJQZlJIenBxYWlCTTVMUWdpUG9YejBMZ2k2TVZCcWZBM2hxOG1LNjdLdHNTTmpUMlN6b1BaT2FWUlNXazF5UnlyWWxDNDJRMXBxTGY3S1RHdXciLCJjbGllbnRfaWQiOiJfYTEzYTFmYzIyODk3ZDQzODE5ZmEwZTFjZWZmMTExY2MiLCJzaWQiOiJfNDZhNDQwZGJhZTFjNTRmYTNmNDZjNTBmOGExNjNlNDgiLCJhdWQiOiJodHRwczovL2lkcC10ZXN0LnVuaS1rb25zdGFuei5kZSIsInJvb3RfanRpIjoiX2I5MDVlM2NlYzFkYmY1ZTEyOTE0OTdjNzAzODIxMDVmIiwiYXV0aF90aW1lIjoxNzQ5NTY3NTk2LCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZXhwIjoxNzQ5NTY4MTk3LCJpYXQiOjE3NDk1Njc1OTcsImp0aSI6Il80YTE4OTYzNWZjNGI4NDA1NzU4OThkM2U3MWQ3ZmQ3ZCJ9.Zy_VYLRJ_1HvZW_LVjjySQHPon2cDLvmiwZAwgiqm1n4GnnruaJ4QqrO1rChbkq4Cm2lgw6jtiCWJR2N889VkV2f4g4BtzwDUbO5to9gNLLapJnXVTeaXrXdWYE-nR0p4hnoZzrGTATKQ9Q38HH286ujIdyskBIYhib2KKdGYDKQ_cB2hZoyhIbPfOcoO1cqXj51SKuA1KNRcxZZfJ_IEMLH4g0aSVirHj5qgCMMkaoe_dT2txJM_MJV2862hn0qDd8Ma8QTadEKhicyBYutf8Y9FV7zp9zOig6JXMca6-VjTLkExUf0mj6PriV9-CXQAYk8igUiEnsX0cAHhmK3y5JpMvYLztUxs0XOoNPZF_5JErmnbYSYf3WFP4DbeIus7TKDWp9VVGXxDBTFc4gAfDLo5mJyxcGd3ITbioiMJ39jy0y4s57Xz2wrskQsa0wLS04GVQVBLfMyXjAiMFeBGaTEBaBnjfyUKAqM7bKeDOgBuOFqcb-Mj1LqEsU9qbaB"; "expires_in" = 600; "id_token" = "eyJraWQiOiJkZWZhdWx0UlNBU2lnbiIsImFsZyI6IlJTNTEyIn0.eyJhdF9oYXNoIjoiZ0c4NW91eVZQajlXY3NUU3NuYUxfaXVWZjRuOWlKbU9Jc0RKR05JcTYtYyIsInN1YiI6ImZiNGVkZDdmN2IyNDc5ODY3NDNiYzQ3NDM4NTUzZDUwIiwiYXVkIjoiX2ExM2ExZmMyMjg5N2Q0MzgxOWZhMGUxY2VmZjExMWNjIiwiYXV0aF90aW1lIjoxNzQ5NTY3NTk2LCJpc3MiOiJodHRwczovL2lkcC10ZXN0LnVuaS1rb25zdGFuei5kZSIsImV4cCI6MTc0OTU3MTE5NywiaWF0IjoxNzQ5NTY3NTk3LCJzaWQiOiJfNDZhNDQwZGJhZTFjNTRmYTNmNDZjNTBmOGExNjNlNDgifQ.kY_j8F9hRtVnGBdnJxLxMQQyyC8adDJgyIbeECyeqv_TrARhXgEIwqemOJW50cesL-GYdfKDo4ofY_BGGivJjv_OPtL3AGhqDRUAMFfZsv4UdFSAAGmZHHX0vWS5LRfJ7GrsztTl1uCD--ZlbDT3afLn94WR3UtrasxRZIOrw_0uf39BQ5gyqwybg8HujjaKDJswXveE28KyMNwWsmGTLtnbxyUk3rb3vMH0LoDCD7_b1WZr4HwYe6FVUCDp-r2PK59mLcZC3PNVoXc5V2MNlJc3HD9wH8GsCmDpsZCSDaYxDi3StwdPmVbGoXLOwl3GtBHD6InthS1169XyMV4xbwwTEEz21hoZXCOvnlo6lobKq4S4sn34Z_rVKEwvJy_6NQ2AVtreZRq22AO4p6Xhi6AJmu1tvcsyX5LiT3C4Vr3F6ZIJ-7tN7GBc6GX06d5YvP5vcZkpbpWJOAFrkMjxKJ9GbaCDhKE05qopVyK_uL2n0dgtrUKQyV5lp_nDXT17"; scope = "openid profile email"; "token_type" = Bearer; }
...
Breakpoint 2:
...
Breakpoint 2, -[GCSOpenIdFolder writeOpenIdSession:withOldSession:withRefreshToken:withExpire:withRefreshExpire:] (
self=0x555555d24d30, _cmd=0x7ffff7fb3ac0 <_OBJC_SELECTOR_TABLE+1152>, _user_session=0x555555dd5ec0,
_old_session=0x7ffff7e2b860 <_OBJC_INSTANCE_13.6>, _refresh_token=0x0, _expire=0x5555559e0c30, _refresh_expire=0x0)
at GCSOpenIdFolder.m:310
310 GCSOpenIdFolder.m: Datei oder Verzeichnis nicht gefunden.
(gdb) p nowExpire
$2 = 1749568412
(gdb) po nowExpire
Cannot access memory at address 0x68484b9c
(gdb)
...
|
|
|
|
Beware the last one is
po newRecord
All I can see seems all right, the value 600 is correctly fetch and nowExpire is timsestamp + 600.
newRecord is the value used for the sql query.
After the last breakpoint, type cto continue the process and see if the bug appears. |
|
|
|
Breakpoint 1, -[GCSOpenIdFolder writeOpenIdSession:withOldSession:withRefreshToken:withExpire:withRefreshExpire:] (self=0x555555d8d670, _cmd=0x7ffff7fb3ac0 <_OBJC_SELECTOR_TABLE+1152>, _user_session=0x555555c95910,
_old_session=0x7ffff7e2b860 <_OBJC_INSTANCE_13.6>, _refresh_token=0x0, _expire=0x555555c25ee0,
_refresh_expire=0x0) at GCSOpenIdFolder.m:310
310 GCSOpenIdFolder.m: Datei oder Verzeichnis nicht gefunden.
(gdb) po newRecord
{"c_old_session" = ""; "c_session_started" = 1749625130; "c_user_session" = "eyJraWQiOiJkZWZhdWx0UlNBU2lnbiIsInR5cCI6ImF0K2p3dCIsImFsZyI6IlJTNTEyIn0.eyJzdWIiOiJmYjRlZGQ3ZjdiMjQ3OTg2NzQzYmM0NzQzODU1M2Q1MCIsImlzcyI6Imh0dHBzOi8vaWRwLXRlc3QudW5pLWtvbnN0YW56LmRlIiwiZm9yX29wIjoiQUFkelpXTnlaWFF4bWZRd3FETWpTTGJJSFg1UEdRM0t3blZyQzVfdld0SWUwcDVTb19GQWtuVFg4SHVCNnRJS2hQNjFHM2ZBcS1rOTI2aWJheFE4cDR3cFE5REdVU1pUZTNmVkl0MG1ERWJmLUM0bDU0QXNuTEZSZ3psR1ozcERabkpSajJKTlFNXzNSYUhwT1d6R1FmQ1oiLCJjbGllbnRfaWQiOiJfYTEzYTFmYzIyODk3ZDQzODE5ZmEwZTFjZWZmMTExY2MiLCJzaWQiOiJfY2Q1NmNhNTdjNDViODBjZDg3NzRmZGIxZjBjYjU5YTciLCJhdWQiOiJodHRwczovL2lkcC10ZXN0LnVuaS1rb25zdGFuei5kZSIsInJvb3RfanRpIjoiXzVkY2JkMjA1YjVjNGY5MGY4MTI0ODI2MTE5NGNmNTIxIiwiYXV0aF90aW1lIjoxNzQ5NjI1MDIzLCJzY29wZSI6Im9wZW5pZCBwcm9maWxlIGVtYWlsIiwiZXhwIjoxNzQ5NjI1NjIzLCJpYXQiOjE3NDk2MjUwMjMsImp0aSI6Il82Y2FkZjgwMzExZWYxZWVmNTBmZWU0MmEzZjRkMThkMyJ9.AOLZoZJNnLBBsoCZbksh-I2Rrn2D5OfygjaJWZj1yES5JTlzqkDhW6GvYwAWo9PMinNjqqrnhY1ILdoTG0lf7eL-tKW0JWNlzSb0dp5hFjAsqya2pJSYWw9JOtx4qLpATvRXtvSrZ7UdQ2CFxLlCMFx5O1uzUPymgsvZxONo-X2ieLUr6xT_GJa9MybWij9SrVxxLYUgVfI4kJQObMBhRYazckqWga-Jt04FzL_IolNndwb24m4YH6TT8mdyBTUQ6fTJNwlHNkNT-uuc6LyMjrpJHU_kCI0nVhB5H1UfUhX-R2JIwrYWPa0_JmCLDaAmvTOczZwYHelX5eJ463re1ccPN5CxRPdbyB7oA6dLMrTx_DK8ilWnpyiuLNLjMyjOSUG5fMqXY9iDCdvrlojhmetStUMU4CanVco4ptFbLkDvwNXB3iNPof63JDd6Sg-qiwN5Y1f4tiLrvMPAheKqtuInQ_m3KKjd7K-qDn25JO0_GN80wp_uJHVm6deE10RT"; }
|
|
qhivert
2025-06-11 08:31
administrator
~0018257
Last edited: 2025-06-11 08:36
|
Ok i've found the culprit and made a fix.
I've build the package in a custom repo before pushing into the nightly.
First remove sogo and change the repo url (assuming your test server is also debian jessie)
deb https://packages.sogo.nu/custom/openid_curl/debian/ jessie jessie
When fixing it I notice you have
SOGoOpenIdEnableRefreshToken = YES;
but your openid server doesn't seems to handle it (it doesn't return any refresh token). It may be a simple configuration to do on your Shibboleth server and/or adding a scope in SOGoOpenIdScope . |
|
|
|
Thank you very much.
I've build the package in a custom repo before pushing into the nightly.
So I will install the updated package tomorrow and will get back to you with the result.
SOGoOpenIdEnableRefreshToken = YES;
I guess it would be more appropriate setting this option to NO and adding a SOGoOpenIdScope?
Best regards,
Markus |
|
|
|
So I will install the updated package tomorrow and will get back to you with the result.
Sorry, I meant I didn't push the fix into the main branch so it won't be in the nightly yet. Hence the custom repo so people can test it and check it. If you can change the repo and check it works correctly, it will help me a lot.
I guess it would be more appropriate setting this option to NO and adding a SOGoOpenIdScope?
The refresh token is not mandatory and purely a openid server config.
For example with keycloak, the resfresh token is by default and no need to modify the scope
With Authentik I need to configure authentik and add 'offline_access' to my scope.
No idea for Shibboleth.
If you're unsure about it, just set SOGoOpenIdEnableRefreshToken to NO. |
|
|
|
First remove sogo and change the repo url (assuming your test server is also debian jessie)
deb https://packages.sogo.nu/custom/openid_curl/debian/ jessie jessie
we are on Debain 11 (bullseye) |
|
|
|
Hi,
I've build the packages for debian 11.
deb https://packages.sogo.nu/custom/openid_curl/debian/ bullseye bullseye |
|
|
|
After installing sogo and sogo-dbg v5.12.1.20250612-1 i did not encounter any postgresql errors in the log file. Database table "sogo_openid" has been successfully updated. Thank you very much.
Best regards,
Markus |
|
