Update module to use auth0/auth0-php version 8.x

Created on 24 October 2022, about 2 years ago
Updated 9 June 2023, over 1 year ago

Problem/Motivation

The 3.x branch of the Drupal module is using version 7.9.2 of the auth0-php SDK library, which is nearly at the end of its extended support window.

See https://github.com/auth0/auth0-PHP/tree/8.3.5#support-matrix

Proposed resolution

Update to SDK 8 which will be supported until November 2024.

See UPGRADE.md for advice on upgrading.

Remaining tasks

User interface changes

Cookie secret field added to settings form.

API changes

Data model changes

CookieSecret is a new requirement for the SDK configuration. The SDK description is The secret used to derive an encryption key for the user identity in a session cookie and to sign the transient cookies used by the login callback.

Feature request
Status

Fixed

Version

3.0

Component

Code

Created by

🇬🇧United Kingdom polynya

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • 🇦🇺Australia seamus_lee

    Thanks for the work @polynya and @aneek

    One thing I was noticing when comparing the previous set of changes is that I don't think the offline access was set up correctly and I think this solves the issue as per https://auth0.com/docs/secure/tokens/refresh-tokens/get-refresh-tokens you need to specify offline_access in the scopes if your permitting offline access

    ```
    diff --git a/src/Controller/AuthController.php b/src/Controller/AuthController.php
    index 1a93a6f..95d389c 100644
    --- a/src/Controller/AuthController.php
    +++ b/src/Controller/AuthController.php
    @@ -231,7 +231,7 @@ class AuthController extends ControllerBase {
    $this->redirectForSso = (bool) $this->config->get(AuthController::AUTH0_REDIRECT_FOR_SSO);
    $this->offlineAccess = (bool) $this->config->get(AuthController::AUTH0_OFFLINE_ACCESS);
    $this->currentRequest = $request_stack->getCurrentRequest();
    -
    + $scopes = explode(' ', AUTH0_DEFAULT_SCOPES);
    $sdk_configuration = new SdkConfiguration([
    'domain' => $this->helper->getAuthDomain(),
    'clientId' => $this->clientId,
    @@ -239,6 +239,7 @@ class AuthController extends ControllerBase {
    'cookieSecret' => $this->cookieSecret,
    'redirectUri' => "$base_url/auth0/callback",
    'persistUser' => FALSE,
    + 'scope' => ($this->offlineAccess ? array_merge($scopes, ['offline_access']) : $scopes),
    ]);
    $transient_store = new SessionStore($sdk_configuration);
    $sdk_configuration->setTransientStorage($transient_store);
    ```

  • 🇦🇺Australia seamus_lee

    Just flagging that I have tested this with the change I mentioned above on a client site and login works successfully. One thing I would suggest is that this should probably be done as a 4.x version given the change in the SDK version and also we need to highlight in the release notes that the auth0_cookie_secret needs to be configured probably prior to the upgrade otherwise can get a fatal error

  • First commit to issue fork.
    • 41d0b32f committed on 3.x
      Issue #3317233 by seamus_lee: deal with offline_access scope
      
    • 754ead01 committed on 3.x
      Issue #3317233 by grota: create random secret in hook_update_N and in...
    • 08c26084 committed on 3.x
      Issue #3317233 by polynya: Add return parameter for logout, defaults to...
    • 9db1a12d committed on 3.x
      Issue #3317233 by polynya: Redirect does not always occur so force it...
    • a71b81e8 committed on 3.x
      Issue #3317233 by polynya: Update module to use auth0/auth0-php version...
  • Status changed to Fixed over 1 year ago
  • 🇪🇸Spain grota

    Thank you @polynya and @seamus_lee! I rebased MR3 and adding also the bit about the offlines scopes and a contribution from me to fill the cookie secret in a hook_update_N and hook_install.
    I kept the commits unsquashed credit where credit is due.

  • Automatically closed - issue fixed for 2 weeks with no activity.

Production build 0.71.5 2024