KNEL/KNELAgentIdentityProvisioning
6
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

scripts: fix oidc code extraction + Cloudron 10 totp routes

Browse Source 
- sed kept the URL prefix in the auth-code extraction; the garbage code
  was the cause of every invalid_grant on the token exchange
- enrollment now uses the Cloudron 10 profile-scoped routes mined from
  the dashboard bundle: POST /api/v1/profile/totp_secret and
  POST /api/v1/profile/totp_enable
- seed storage verifies the setfield write and falls back to a full
  vault item recreate (smcli setfield 400s on some ciphers)
- prompt=login added to the auth URL for session-switch flows

Verified: 32 COO-org identities enrolled end-to-end (seed in vault +
real TOTP login as each identity). Full detail on the #942 comment.
https://projects.knownelement.com/issues/942
This commit is contained in:
mrcharles
2026-09-09 12:34:40 -05:00
parent 1a1a7ca581
commit 627948a98e
2 changed files with 45 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/agent-provisioning/scripts/cloudron-oidc-login.sh
+8 -4
View File
@@ -22,7 +22,7 @@ PW=$(SM get "$ITEM" --field password)
SEED=$(SM get "$ITEM" --field totp_seed 2>/dev/null || true)
VERIFIER=$(openssl rand -base64 48 | tr '+/' '-_' | tr -d '=\n' | cut -c1-64)
CHALLENGE=$(printf '%s' "$VERIFIER" | openssl dgst -sha256 -binary | openssl base64 | tr '+/' '-_' | tr -d '=\n')
AUTH="$BASE/openid/auth?client_id=$CLIENT&response_type=code&scope=openid%20email%20profile&redirect_uri=https%3A%2F%2Fmy.knownelement.com%2Fauthcallback.html&code_challenge=$CHALLENGE&code_challenge_method=S256"
AUTH="$BASE/openid/auth?client_id=$CLIENT&response_type=code&scope=openid%20email%20profile&redirect_uri=https%3A%2F%2Fmy.knownelement.com%2Fauthcallback.html&code_challenge=$CHALLENGE&code_challenge_method=S256&prompt=login"
JAR="/tmp/oidc-jar-$U.txt"; rm -f "$JAR"
INT=$(curl -sk -o /dev/null -w '%{url_effective}' -c "$JAR" -L --max-redirs 8 "$AUTH")
@@ -56,10 +56,14 @@ case "$CALLBACK" in
-d '' | grep -i '^location:' | head -1 | tr -d '\r' | sed 's/^[Ll]ocation: //')
[ -n "$CLOC" ] || { echo "FAIL: consent confirm produced no redirect" >&2; exit 6; }
case "$CLOC" in http*) : ;; *) CLOC="$BASE$CLOC" ;; esac
[ "$DBG" = 1 ] && echo "DBG cloc: ${CLOC:0:90}" >&2
CALLBACK=$(curl -sk -b "$JAR" -c "$JAR" -o /dev/null -w '%{url_effective}' -L --max-redirs 8 "$CLOC")
;;
esac
CODE=$(printf '%s' "$CALLBACK" | sed -n 's/[?&]code=\([^&]*\).*/\1/p')
CODE=$(printf '%s' "$CALLBACK" | sed -n 's/^.*[?&]code=\([^&]*\).*$/\1/p')
[ "$DBG" = 1 ] && { echo "DBG callback: ${CALLBACK:0:120}" >&2; echo "DBG code raw: $CODE" >&2; }
# codes may arrive percent-encoded in the Location header; decode before exchange
CODE=$(printf '%s' "$CODE" | perl -pe 's/%([0-9A-Fa-f]{2})/chr(hex($1))/ge')
[ "$DBG" = 1 ] && echo "DBG code len: ${#CODE}" >&2
[ -n "$CODE" ] || { echo "FAIL: no authorization code at callback: $CALLBACK" >&2; exit 6; }
@@ -71,8 +75,8 @@ TOKRESP=$(curl -sk -b "$JAR" -c "$JAR" -X POST "$BASE/openid/token" \
--data-urlencode "redirect_uri=$REDIRECT" \
--data-urlencode "code_verifier=$VERIFIER")
ACCESS=$(printf '%s' "$TOKRESP" | sed -n 's/.*"access_token":"\([^"]*\)".*/\1/p')
[ -n "$ACCESS" ] || { echo "FAIL: token exchange: $(printf '%s' "$TOKRESP" | head -c 120)" >&2; exit 7; }
[ -n "$ACCESS" ] || { echo "FAIL: token exchange: $TOKRESP" >&2; exit 7; }
printf '%s' "$ACCESS" > "/tmp/.oidc-bearer-$U"
chmod 600 "/tmp/.oidc-bearer-$U"
WHO=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"username":"\([^"]*\)".*/\1/p')
WHO=$(curl -sk "$BASE/api/v1/profile" -H "Authorization: Bearer $ACCESS" | sed -n 's/.*"username":[[:space:]]*"\([^"]*\)".*/\1/p')
echo "OK: bearer for '$WHO' at /tmp/.oidc-bearer-$U (session jar $JAR)"