Response mode: “form_post”

[ar-filho]

When trying to authenticate with the parameter [ 'response_mode': 'form_post' ], the plugin generates the message by “oidcop.oauth2.authorization.authz_part2:905”, however when trying to respond, satosa_oidcop, displays the message:

File "/usr/local/lib/python3.11/site-packages/satosa_oidcop/idpy_oidcop.py", line 699, in _handle_backend_response
     data = _args["response_args"].to_dict()
            ~~~~~^^^^^^^^^^^^^^^^^
KeyError: 'response_args'

When debugging, the variable “response_args” has no content.

Expected action:
Frontend posts the content of:
'response_msg' generated in oidcop.oauth2.authorization.authz_part2:905
for the requester in 'session_id'.

*Lines may be different because of pdb.

[peppelinux]

Ok,

To get a good solution in a collaborative way I have to ask you to start a branch/PR with a unit test that reproduces this problem

Then I'll add my commits and then we'll decide when merge and release

Thank you @ar-filho, your contribution Is really appreciated

[peppelinux]

This issue focuses our attention on the support of https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html in oidcop and idpy-oidc

both supports form_post (see https://github.com/IdentityPython/oidc-op/search?q=form_post)

So I would use a unit test that reproduces a request with response_mode=form_post and then check the value of response_placement here https://github.com/UniversitaDellaCalabria/SATOSA-oidcop/blob/main/satosa_oidcop/idpy_oidcop.py#L690

[peppelinux]

do you still have this issue @ar-filho ?

[Yoroitchi]

Hello,
As of today, i can confirm this issue is still there

[2024-08-28 11:37:12,804] [ERROR] [satosa.proxy_server.__call__] Unknown error
Traceback (most recent call last):
  File "/usr/local/lib/python3.9/site-packages/satosa/base.py", line 254, in run
    resp = self._run_bound_endpoint(context, spec)
  File "/usr/local/lib/python3.9/site-packages/satosa/base.py", line 179, in _run_bound_endpoint
    return spec(context)
  File "/usr/local/lib/python3.9/site-packages/satosa/backends/saml2.py", line 419, in authn_response
    return self.auth_callback_func(context, self._translate_response(authn_response, context.state))
  File "/usr/local/lib/python3.9/site-packages/satosa/base.py", line 150, in _auth_resp_callback_func
    return self._auth_resp_finish(context, internal_response)
  File "/usr/local/lib/python3.9/site-packages/satosa/base.py", line 119, in _auth_resp_finish
    return frontend.handle_authn_response(context, internal_response)
  File "/usr/local/lib/python3.9/site-packages/satosa_oidcop/idpy_oidcop.py", line 814, in handle_authn_response
    response = self._handle_backend_response(context, internal_resp)
  File "/usr/local/lib/python3.9/site-packages/satosa_oidcop/idpy_oidcop.py", line 786, in _handle_backend_response
    data = _args["response_args"].to_dict()
KeyError: 'response_args'

[Yoroitchi]

After further investigation, this issue seems a bit complicated.
The problem comes from here https://github.com/UniversitaDellaCalabria/SATOSA-oidcop/blob/main/satosa_oidcop/idpy_oidcop.py#L782 as info doesn't hold response_placement as shown in the logs I gathered
With form post

[2024-08-29 11:34:41,555] [DEBUG] [satosa_oidcop.idpy_oidcop._handle_backend_response] info: {'response': 'https://dev-test-rp.federation.renater.fr/redirect_uri', 'http_headers': [('Content-type', 'application/x-www-form-urlencoded'), ('Pragma', 'no-cache'), ('Cache-Control', 'no-store')]}

withtout form post

[2024-08-29 11:35:52,317] [DEBUG] [satosa_oidcop.idpy_oidcop._handle_backend_response] info: {'response': 'https://dev-test-rp.federation.renater.fr/redirect_uri', 'http_headers': [('Content-type', 'application/x-www-form-urlencoded'), ('Pragma', 'no-cache'), ('Cache-Control', 'no-store')]}

We can even see that in both cases, info has the exact same values which leads _response_placement to always be set to endpoint.response_placement aka "url" as it is the default value, see https://github.com/IdentityPython/idpy-oidc/blob/main/src/idpyoidc/server/oauth2/authorization.py

In this case we can observe that when using form_post, _args doesn't hold an AuthorizationResponse, which is more an issue on the side of idpyoidc IMO, but that is a story for another time.
Using form_post

[2024-08-29 12:14:30,523] [DEBUG] [satosa_oidcop.idpy_oidcop._handle_backend_response] _args: dict_keys(['session_id', 'response_msg', 'content_type', 'response_placement', 'cookie'])

Using query

[2024-08-29 12:15:15,829] [DEBUG] [satosa_oidcop.idpy_oidcop._handle_backend_response] _args: dict_keys(['response_args', 'fragment_enc', 'session_id', 'return_uri', 'cookie'])

BUT, we can observe that _args holds response_placement when using form_post, which I think can be a good starting point to correct this issue.