Hello,
I just happened to be looking at https://lists.fedorahosted.org/accounts/login/?next=/archives/list/firewalld... to try to sign up, and when I click on "Fedora" to try to use my fedora account, I get a page telling me they'll redirect. Clicking continue and I get 400 - Bad Request. "Invalid redirect_uri" and a message saying to let Fedora Infra know. I don't know how to do that.
I've used the "send an email to the special address" way, but just wasn't sure how else to report the issue.
Sincerely, -- Nathanael Noblet
On Thu, Jun 27, 2024 at 04:46:41PM GMT, Nathanael Noblet wrote:
Hello,
I just happened to be looking at https://lists.fedorahosted.org/accounts/login/?next=/archives/list/firewalld... to try to sign up, and when I click on "Fedora" to try to use my fedora account, I get a page telling me they'll redirect. Clicking continue and I get 400 - Bad Request. "Invalid redirect_uri" and a message saying to let Fedora Infra know. I don't know how to do that.
There's a link in the message right there. ;)
https://pagure.io/fedora-infrastructure/issues
I've used the "send an email to the special address" way, but just wasn't sure how else to report the issue.
In this case it's likely fallout from the massive mailman upgrade from eailer today. We already have a few issues to sort out noted in https://pagure.io/fedora-infrastructure/issue/8455#comment-916759
I'll add a note that the lists.fedorahosted.org login isn't working right.
kevin
I can see what is happening here, in OIDC we have entry only for lists.fedoraproject.org.
I created a ticket on infra tracker for you https://pagure.io/fedora-infrastructure/issue/12013, but I'm not sure how to solve this as the OIDC entry is shared between all instances and it doesn't allow us to have more client URLs than one. As workaround you can use lists.fedoraproject.org for now, the list can be found there as well https://lists.fedoraproject.org/archives/list/firewalld-users@lists.fedoraho...
Michal
On 28. 06. 24 1:56, Kevin Fenzi wrote:
On Thu, Jun 27, 2024 at 04:46:41PM GMT, Nathanael Noblet wrote:
Hello,
I just happened to be looking athttps://lists.fedorahosted.org/accounts/login/?next=/archives/list/firewalld... to try to sign up, and when I click on "Fedora" to try to use my fedora account, I get a page telling me they'll redirect. Clicking continue and I get 400 - Bad Request. "Invalid redirect_uri" and a message saying to let Fedora Infra know. I don't know how to do that.
There's a link in the message right there. ;)
https://pagure.io/fedora-infrastructure/issues
I've used the "send an email to the special address" way, but justwasn't sure how else to report the issue.
In this case it's likely fallout from the massive mailman upgrade from eailer today. We already have a few issues to sort out noted in https://pagure.io/fedora-infrastructure/issue/8455#comment-916759
I'll add a note that the lists.fedorahosted.org login isn't working right.
kevin
On Fri, Jun 28, 2024 at 9:04 AM Michal Konecny mkonecny@redhat.com wrote:
I can see what is happening here, in OIDC we have entry only for lists.fedoraproject.org.
I created a ticket on infra tracker for you https://pagure.io/fedora-infrastructure/issue/12013, but I'm not sure how to solve this as the OIDC entry is shared between all instances and it doesn't allow us to have more client URLs than one. As workaround you can use lists.fedoraproject.org for now, the list can be found there as well https://lists.fedoraproject.org/archives/list/firewalld-users@lists.fedoraho...
How did the custom FAS/OpenID plugin work around this? I know it worked with that deployment...
My assumption is that OpenID just checked the client_id server side and not the origin URL. I will need to check what are the posibilities in OIDC as it needs different redirect_uri for each instance as well. Maybe it could be defined as template or regex in the definition. I'm not expert on Ipsilon, so I need to check the options.
Michal
On 28. 06. 24 9:14, Neal Gompa wrote:
On Fri, Jun 28, 2024 at 9:04 AM Michal Konecny mkonecny@redhat.com wrote:
I can see what is happening here, in OIDC we have entry only for lists.fedoraproject.org.
I created a ticket on infra tracker for you https://pagure.io/fedora-infrastructure/issue/12013, but I'm not sure how to solve this as the OIDC entry is shared between all instances and it doesn't allow us to have more client URLs than one. As workaround you can use lists.fedoraproject.org for now, the list can be found there as well https://lists.fedoraproject.org/archives/list/firewalld-users@lists.fedoraho...
How did the custom FAS/OpenID plugin work around this? I know it worked with that deployment...
On Fri, 2024-06-28 at 09:42 +0200, Michal Konecny wrote:
My assumption is that OpenID just checked the client_id server side and not the origin URL. I will need to check what are the posibilities in OIDC as it needs different redirect_uri for each instance as well. Maybe it could be defined as template or regex in the definition. I'm not expert on Ipsilon, so I need to check the options.
If each instance has its own client id and expected redirects, can't we just add more client configs to Ipsilon? One per instance?
-
Adam Williamson -
Kevin Fenzi -
Michal Konecny -
Nathanael Noblet -
Neal Gompa