0056149: Authorization code open id protocol does not work while making login in sco

Openbravo Issue Tracking System - POS2

View Issue Details

Project

Category

View Status

Date Submitted

Last Update

0056149

POS2

POS

public

2024-08-01 13:47

2024-09-09 18:30

Reporter

njimenez

Assigned To

caristu

Priority

normal

Severity

major

Reproducibility

have not tried

Status

closed

Resolution

fixed

Platform

OS Version

Product Version

Target Version

Fixed in Version

24Q4

Merge Request Status

Review Assigned To

OBNetwork customer

Support ticket

Regression level

Regression date

Regression introduced in release

Regression introduced by commit

Triggers an Emergency Pack

Summary

0056149: Authorization code open id protocol does not work while making login in sco

Description

Right now it is possible to make login with the open id protocol in the pos application. Also should be possible to do login with open id in the sco application too but there is a problem with the authorization code protocol

The login in sco for external authorization was defined thinking on pkce protocol were the communication exchange take place in the pos application side. Once you receive the token with the user information the call to the backoffice is done to validate the received user identifier.

This is why in sco there were no problem on making two different calls one to the switch user approval and the second to the login handler with the same user credentials information as at this point non communication is going to be performed with the authorization provider.

The problem that we have found in the authorization code protocol is that we are expecting to make the communication exchange to obtain the token id with the user information in the backoffice side. So the second attept to make authorization, this is when the login handler calls, will always be refused as we are trying to call a second time to the authorization provider to obtain the token id with the same code.

Steps To Reproduce

1. Configure an authentication provider at the backoffice with type opend id and authorization code protocol

https://wiki.openbravo.com/wiki/Authentication#OpenID_Authentication [^]

2. Open the pos application
3. Do click on switch to sco mode button
4. Click on authorization provider button instead of providing user credentials
5. See how the screen gets blocked doing login

Proposed Solution

1. In MobileCoreLoginHandler class we are going to add a new validation in doPost method to switch application.

if (req.getParameter("switchAppMode")) {
// Authenticate to make sure if the switch application mode can be done
// The authenticated user will be saved
}

This validation will be done before calling LoginHandler in line 120.

In login hanler a protected method called for example, authenticate(request, response) will be added.

This method will be check the session value stored in the previous step. If it does exist the session value will be removed and returned to the login handler, otherwise, the reqular authentication will be performed.

With those changes the class shouldn be needed but there are more validations performed here. Maybe will be needed to be done on mobile core or just remove the authentication from switch user.

Additional Information

Tags

No tags attached.

Relationships

related to	feature request	0055941		closed	njimenez	Login and approvals in pos with oauth2
causes	defect	0056430		closed	jarmendariz	Unable to switch from SCO to POS