entra auth test

nextgenpdf-install.sh

@@ -130,9 +130,9 @@ User=$CURRENT_USER
 WorkingDirectory=/home/$CURRENT_USER/pdf-rename-sort
 Environment="PATH=/home/$CURRENT_USER/pdf-rename-sort/venv/bin"
 Environment="SECRET_KEY=CHANGE_THIS_SECRET_KEY_IN_PRODUCTION"
-Environment="TENANT_ID=${TENANT_ID:-YOUR_MICROSOFT_ENTRA_TENANT_ID}"
-Environment="CLIENT_ID=${CLIENT_ID:-YOUR_MICROSOFT_ENTRA_CLIENT_ID}"
-Environment="CLIENT_SECRET=${CLIENT_SECRET:-YOUR_MICROSOFT_ENTRA_CLIENT_SECRET}"
+$(if [ -n "$TENANT_ID" ] && [ "$TENANT_ID" != "YOUR_MICROSOFT_ENTRA_TENANT_ID" ]; then echo "Environment=\"TENANT_ID=$TENANT_ID\""; fi)
+$(if [ -n "$CLIENT_ID" ] && [ "$CLIENT_ID" != "YOUR_MICROSOFT_ENTRA_CLIENT_ID" ]; then echo "Environment=\"CLIENT_ID=$CLIENT_ID\""; fi)
+$(if [ -n "$CLIENT_SECRET" ] && [ "$CLIENT_SECRET" != "YOUR_MICROSOFT_ENTRA_CLIENT_SECRET" ]; then echo "Environment=\"CLIENT_SECRET=$CLIENT_SECRET\""; fi)
 Environment="ADMIN_USERNAME=$ADMIN_USER"
 Environment="ADMIN_PASSWORD=$ADMIN_PASS"
 ExecStart=/home/$CURRENT_USER/pdf-rename-sort/venv/bin/gunicorn --bind 127.0.0.1:3000 pdf_renamer:app
@@ -249,6 +249,18 @@ echo "4. Add a client secret under Certificates & secrets"
 echo "5. Add redirect URI: https://$DOMAIN_NAME/auth/microsoft/callback"
 echo "6. Grant appropriate permissions if needed"
 echo ""
+echo "If you provided Entra credentials during installation:"
+echo "   - The service has been configured automatically"
+echo "   - Skip to step 6 below"
+echo ""
+echo "If you left Entra credentials blank during installation:"
+echo "   - Edit the service file: sudo nano /etc/systemd/system/pdf-renamer.service"
+echo "   - Add the following lines (replace with your actual values):"
+echo "     Environment=\"TENANT_ID=your-tenant-id\""
+echo "     Environment=\"CLIENT_ID=your-client-id\""
+echo "     Environment=\"CLIENT_SECRET=your-client-secret\""
+echo "   - Save and run: sudo systemctl daemon-reload && sudo systemctl restart pdf-renamer"
+echo ""
 echo "Next steps:"
 echo "1. Update the environment variables in /etc/systemd/system/pdf-renamer.service:"
 echo "   - SECRET_KEY: Set a secure random key (use: openssl rand -hex 32)"
@@ -272,6 +284,11 @@ echo "5. Check service status:"
 echo "   sudo systemctl status pdf-renamer"
 echo "   sudo systemctl status nginx"
 echo ""
+echo "6. Test OAuth configuration:"
+echo "   cd /home/$CURRENT_USER/pdf-rename-sort"
+echo "   source venv/bin/activate"
+echo "   python test_oauth_config.py"
+echo ""
 echo "NOTE: This setup runs alongside your existing app on port 5000."
 echo "The PDF Renamer will be accessible at https://$DOMAIN_NAME."
 echo "File permissions have been set for web access (755 for directories)."

pdf_renamer.py

@@ -21,6 +21,10 @@ TENANT_ID = os.getenv('TENANT_ID', 'your-tenant-id')
 CLIENT_ID = os.getenv('CLIENT_ID', 'your-client-id')
 CLIENT_SECRET = os.getenv('CLIENT_SECRET', 'your-client-secret')
 
+print(f"DEBUG: TENANT_ID = {TENANT_ID}")
+print(f"DEBUG: CLIENT_ID = {CLIENT_ID}")
+print(f"DEBUG: CLIENT_SECRET = {'*' * len(CLIENT_SECRET) if CLIENT_SECRET else 'None'}")
+
 # Admin Configuration
 ADMIN_USERNAME = os.getenv('ADMIN_USERNAME', 'trbcit')
 ADMIN_PASSWORD = os.getenv('ADMIN_PASSWORD', 'atdrmbicn')
@@ -31,7 +35,7 @@ microsoft = oauth.register(
     client_id=CLIENT_ID,
     client_secret=CLIENT_SECRET,
     server_metadata_url=f'https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid_configuration',
-    client_kwargs={'scope': 'openid profile email'}
+    client_kwargs={'scope': 'openid email profile'}
 )
 
 def analyze_failed_extractions(log_path):
@@ -650,6 +654,13 @@ def login():
 
 @app.route('/entra-login')
 def entra_login():
+    # Check if Microsoft Entra ID is configured
+    if TENANT_ID in ['your-tenant-id', 'YOUR_MICROSOFT_ENTRA_TENANT_ID'] or \
+       CLIENT_ID in ['your-client-id', 'YOUR_MICROSOFT_ENTRA_CLIENT_ID'] or \
+       CLIENT_SECRET in ['your-client-secret', 'YOUR_MICROSOFT_ENTRA_CLIENT_SECRET']:
+        flash('Microsoft Entra ID is not properly configured. Please check your environment variables.', 'error')
+        return redirect(url_for('login'))
+
     redirect_uri = url_for('auth', _external=True)
     return microsoft.authorize_redirect(redirect_uri)
 
@@ -684,10 +695,20 @@ def admin_login():
 
 @app.route('/auth')
 def auth():
+    try:
+        print("DEBUG: Starting OAuth callback processing")
         token = microsoft.authorize_access_token()
+        print(f"DEBUG: Got token: {token}")
         user = microsoft.parse_id_token(token)
+        print(f"DEBUG: Parsed user: {user}")
         session['user'] = user
         return redirect(url_for('upload_files'))
+    except Exception as e:
+        print(f"OAuth error: {e}")  # Log the error for debugging
+        import traceback
+        print(f"Full traceback: {traceback.format_exc()}")
+        flash('Authentication failed. Please check your Microsoft Entra ID configuration.', 'error')
+        return redirect(url_for('login'))
 
 @app.route('/logout')
 @login_required

test_oauth_config.py

@@ -0,0 +1,80 @@
+#!/usr/bin/env python3
+"""
+Test script to verify Microsoft Entra ID OAuth configuration
+Run this to check if your OAuth settings are correct before deploying.
+"""
+
+import os
+import requests
+from authlib.integrations.requests_client import OAuth2Session
+
+def test_oauth_config():
+    # Get configuration from environment
+    tenant_id = os.getenv('TENANT_ID')
+    client_id = os.getenv('CLIENT_ID')
+    client_secret = os.getenv('CLIENT_SECRET')
+
+    print("Testing Microsoft Entra ID OAuth Configuration")
+    print("=" * 50)
+    print(f"TENANT_ID: {tenant_id}")
+    print(f"CLIENT_ID: {client_id}")
+    print(f"CLIENT_SECRET: {'*' * len(client_secret) if client_secret else 'None'}")
+    print()
+
+    if not all([tenant_id, client_id, client_secret]):
+        print("❌ ERROR: Missing required environment variables!")
+        print("Make sure TENANT_ID, CLIENT_ID, and CLIENT_SECRET are set.")
+        return False
+
+    if tenant_id in ['your-tenant-id', 'YOUR_MICROSOFT_ENTRA_TENANT_ID']:
+        print("❌ ERROR: TENANT_ID is still set to default placeholder value!")
+        return False
+
+    if client_id in ['your-client-id', 'YOUR_MICROSOFT_ENTRA_CLIENT_ID']:
+        print("❌ ERROR: CLIENT_ID is still set to default placeholder value!")
+        return False
+
+    if client_secret in ['your-client-secret', 'YOUR_MICROSOFT_ENTRA_CLIENT_SECRET']:
+        print("❌ ERROR: CLIENT_SECRET is still set to default placeholder value!")
+        return False
+
+    # Test metadata URL
+    metadata_url = f'https://login.microsoftonline.com/{tenant_id}/v2.0/.well-known/openid_configuration'
+    print(f"Testing metadata URL: {metadata_url}")
+
+    try:
+        response = requests.get(metadata_url, timeout=10)
+        if response.status_code == 200:
+            print("✅ Metadata URL is accessible")
+        else:
+            print(f"❌ Metadata URL returned status {response.status_code}")
+            return False
+    except Exception as e:
+        print(f"❌ Error accessing metadata URL: {e}")
+        return False
+
+    # Test OAuth client creation
+    try:
+        client = OAuth2Session(
+            client_id=client_id,
+            client_secret=client_secret,
+            scope=['openid', 'email', 'profile']
+        )
+        print("✅ OAuth client created successfully")
+    except Exception as e:
+        print(f"❌ Error creating OAuth client: {e}")
+        return False
+
+    print()
+    print("🎉 OAuth configuration appears to be correct!")
+    print()
+    print("Next steps:")
+    print("1. Make sure your redirect URI is registered in Microsoft Entra:")
+    print("   https://yourdomain.com/auth")
+    print("2. Restart the application: sudo systemctl restart pdf-renamer")
+    print("3. Check the application logs for any remaining issues")
+
+    return True
+
+if __name__ == '__main__':
+    test_oauth_config()