Use (on-premise) Gitlab server as OAuth provider - asp.net-core

Question

I want to make a .NET Core 2.1 MVC app use my internal Gitlab server as OAuth authentication service provider.
Inside Gitlab Admin Area I've added an Application:
Application Id: xxx
Secret: xxx
Callback url: http://localhost:5000/Account/ExternalLoginCallback
Trusted: Y
Scopes: - api (Access the authenticated user's API)
- openid (Authenticate using OpenID Connect)
The Startup.ConfigureServices is similar to:
services.AddAuthentication().AddOAuth("GitLab", options =>
{
options.ClientId = "xxx";
options.ClientSecret = "xxx";
options.CallbackPath = new PathString("/Account/ExternalLoginCallback");
options.AuthorizationEndpoint = "https://myGitlabServer/oauth/authorize";
options.TokenEndpoint = "https://myGitlabServer/login/oauth/token";
options.UserInformationEndpoint = "https://myGitlabServer/api/v4/user";
options.SaveTokens = true;
options.Events = new OAuthEvents
{
OnCreatingTicket = async context =>
{
var request = new HttpRequestMessage(HttpMethod.Get, context.Options.UserInformationEndpoint);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", context.AccessToken);
var response = await context.Backchannel.SendAsync(request, HttpCompletionOption.ResponseHeadersRead, context.HttpContext.RequestAborted);
response.EnsureSuccessStatusCode();
var user = JObject.Parse(await response.Content.ReadAsStringAsync());
context.RunClaimActions(user);
}
};
});
On navigating to my apps' login page I can select GitLab as login provider and get redirected to the login page successfully. After singning in with the correct creds I would expect the controller to be called but the redirect fails.
Exception: OAuth token endpoint failure: Status: NotFound;Headers: Server: nginx
The corresponding request is:
GET http://localhost:5000/Account/ExternalLoginCallback?code=xxx&state=xxx HTTP/1.1
The AccountController signature looks like:
[HttpGet]
[AllowAnonymous]
public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
{
...
}
Any ideas what I am missing or doing wrong?

Answer 1

There where several things to be corrected.
First localhost does not apply to an application deployed somewhere in your network, so I had to change the Callback url from
http://localhost:5000/Account/ExternalLoginCallback
to
Callback url: http://{IP}:5000/signin-gitlab
Note the renaming of /Account/ExternalLoginCallback to just /signin-gitlab.
Startup.ConfigureServices (relevant parts) now:
...
services.Configure<CookiePolicyOptions>(options =>
{
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
.AddOAuth("Gitlab", options =>
{
options.SignInScheme = IdentityConstants.ExternalScheme;
// App creds
options.ClientId = "xxx";
options.ClientSecret = "xxx";
options.CallbackPath = new PathString("/signin-gitlab");
options.AuthorizationEndpoint = "https://myGitlabServer/oauth/authorize";
options.TokenEndpoint = "https://myGitlabServer/oauth/token";
options.UserInformationEndpoint = "https://myGitlabServer/api/v4/user";
options.SaveTokens = true;
options.Events = new OAuthEvents
{
OnCreatingTicket = async context =>
{
var request = new HttpRequestMessage(HttpMethod.Get, context.Options.UserInformationEndpoint);
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", context.AccessToken);
request.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
var response = await context.Backchannel.SendAsync(request, context.HttpContext.RequestAborted);
response.EnsureSuccessStatusCode();
var user = JObject.Parse(await response.Content.ReadAsStringAsync());
// Add claims
var userId = user.Value<string>("username");
if (!string.IsNullOrEmpty(userId))
{
context.Identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, userId, ClaimValueTypes.String, context.Options.ClaimsIssuer));
options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, userId);
}
var name = user.Value<string>("name");
if (!string.IsNullOrEmpty(name))
{
context.Identity.AddClaim(new Claim(ClaimTypes.GivenName, name, ClaimValueTypes.String, context.Options.ClaimsIssuer));
options.ClaimActions.MapJsonKey(ClaimTypes.GivenName, name);
}
var email = user.Value<string>("email");
if (!string.IsNullOrEmpty(email))
{
context.Identity.AddClaim(new Claim(ClaimTypes.Email, email, ClaimValueTypes.Email, context.Options.ClaimsIssuer));
options.ClaimActions.MapJsonKey(ClaimTypes.Email, email);
}
var avatar = user.Value<string>("avatar_url");
if (!string.IsNullOrEmpty(avatar))
{
context.Identity.AddClaim(new Claim(ClaimTypes.Uri, avatar, ClaimValueTypes.String, context.Options.ClaimsIssuer));
options.ClaimActions.MapJsonKey(ClaimTypes.Uri, avatar);
}
}
};
})
.AddCookie();
...
Inside my AccountController I have 2 methods to handle external logins:
[HttpPost]
[AllowAnonymous]
[ValidateAntiForgeryToken]
public IActionResult ExternalLogin(string provider, string returnUrl = null)
{
// Request a redirect to the external login provider.
var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Account", new { returnUrl });
var properties = _signInManager.ConfigureExternalAuthenticationProperties(provider, redirectUrl);
return Challenge(properties, provider);
}
[HttpGet]
[AllowAnonymous]
public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
{
if (remoteError != null)
{
ErrorMessage = $"Error from external provider: {remoteError}";
return RedirectToAction(nameof(Login));
}
var info = await _signInManager.GetExternalLoginInfoAsync();
if (info == null)
{
return RedirectToAction(nameof(Login));
}
// Sign in
var result = await _signInManager.ExternalLoginSignInAsync(info.LoginProvider, info.ProviderKey, isPersistent: false, bypassTwoFactor: true);
if (result.Succeeded)
{
var user = await _userManager.FindByLoginAsync(info.LoginProvider, info.ProviderKey);
var claimsPrincipal = await this._signInManager.CreateUserPrincipalAsync(user);
var identity = claimsPrincipal.Identity as ClaimsIdentity;
await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(identity));
var updateResult = await _signInManager.UpdateExternalAuthenticationTokensAsync(info);
return RedirectToLocal(returnUrl);
}
if (result.IsLockedOut)
{
return RedirectToAction(nameof(Lockout));
}
else
{
// If the user doesn't have an account, then ask to create one
ViewData["ReturnUrl"] = returnUrl;
ViewData["LoginProvider"] = info.LoginProvider;
var email = info.Principal.FindFirstValue(ClaimTypes.Email);
return View("ExternalLogin", new ExternalLoginViewModel { Email = email });
}
}
Finally the view part inside my login view:
<section>
<h4>Use another service to log in.</h4>
<hr />
#{
var loginProviders = (await SignInManager.GetExternalAuthenticationSchemesAsync()).ToList();
if (loginProviders.Count == 0)
{
<div>
<p>
There are no external authentication services configured. See this article
for details on setting up this ASP.NET application to support logging in via external services.
</p>
</div>
}
else
{
<form asp-action="ExternalLogin" asp-route-returnurl="#Context.Request.Query["returnUrl"]" method="post" class="form-horizontal">
<div>
<p>
#foreach (var provider in loginProviders)
{
<button type="submit" class="btn btn-gitlab" name="provider" value="#provider.Name" title="Log in using your #provider.DisplayName account"><i class="fab fa-#provider.Name.ToLower()"></i> #provider.Name</button>
}
</p>
</div>
</form>
}
}
</section>