auth tshot
This commit is contained in:
nmemmert committed
1 parent
46fd321d06
commit
c1446c25aa
1 file changed
+172
-72
+172
-72
@@ -7,110 +7,210 @@ Run this to check if your OAuth settings are correct before deploying.
|
|||||||
import os
|
import os
|
||||||
import requests
|
import requests
|
||||||
import subprocess
|
import subprocess
|
||||||
from authlib.integrations.requests_client import OAuth2Session
|
import sys
|
||||||
|
|
||||||
def get_systemd_env_var(var_name):
|
def get_systemd_env_vars():
|
||||||
"""Get environment variable from systemd service"""
|
"""Get all environment variables from systemd service"""
|
||||||
try:
|
try:
|
||||||
result = subprocess.run(
|
result = subprocess.run(
|
||||||
['systemctl', 'show', 'pdf-renamer', '-p', 'Environment'],
|
['systemctl', 'show', 'pdf-renamer', '--property', 'Environment'],
|
||||||
capture_output=True, text=True, check=True
|
capture_output=True, text=True, check=True
|
||||||
)
|
)
|
||||||
|
|
||||||
|
# Parse the Environment line
|
||||||
env_line = result.stdout.strip()
|
env_line = result.stdout.strip()
|
||||||
if not env_line or '=' not in env_line:
|
if env_line.startswith('Environment='):
|
||||||
return None
|
env_line = env_line[12:] # Remove 'Environment=' prefix
|
||||||
|
|
||||||
# The Environment line contains: Environment=VAR1=value1 VAR2=value2 ...
|
# Split by spaces, but keep quoted values together
|
||||||
# Extract everything after the first '='
|
env_vars = {}
|
||||||
env_string = env_line.split('=', 1)[1]
|
current_var = []
|
||||||
|
in_quotes = False
|
||||||
# Split by spaces to get individual VAR=value pairs
|
|
||||||
env_pairs = env_string.split()
|
for char in env_line:
|
||||||
|
if char == '"':
|
||||||
# Find the specific variable
|
in_quotes = not in_quotes
|
||||||
for pair in env_pairs:
|
elif char == ' ' and not in_quotes:
|
||||||
if pair.startswith(f'{var_name}='):
|
if current_var:
|
||||||
return pair.split('=', 1)[1]
|
var_str = ''.join(current_var)
|
||||||
|
if '=' in var_str:
|
||||||
return None
|
key, value = var_str.split('=', 1)
|
||||||
except subprocess.CalledProcessError:
|
env_vars[key] = value.strip('"')
|
||||||
return None
|
current_var = []
|
||||||
|
else:
|
||||||
|
current_var.append(char)
|
||||||
|
|
||||||
|
# Don't forget the last variable
|
||||||
|
if current_var:
|
||||||
|
var_str = ''.join(current_var)
|
||||||
|
if '=' in var_str:
|
||||||
|
key, value = var_str.split('=', 1)
|
||||||
|
env_vars[key] = value.strip('"')
|
||||||
|
|
||||||
|
return env_vars
|
||||||
|
except subprocess.CalledProcessError as e:
|
||||||
|
print(f"❌ Error reading systemd service: {e}")
|
||||||
|
return {}
|
||||||
|
except Exception as e:
|
||||||
|
print(f"❌ Error parsing environment variables: {e}")
|
||||||
|
return {}
|
||||||
|
|
||||||
def test_oauth_config():
|
def test_oauth_config():
|
||||||
# Get configuration from systemd service environment
|
|
||||||
tenant_id = get_systemd_env_var('TENANT_ID')
|
|
||||||
client_id = get_systemd_env_var('CLIENT_ID')
|
|
||||||
client_secret = get_systemd_env_var('CLIENT_SECRET')
|
|
||||||
|
|
||||||
print("Testing Microsoft Entra ID OAuth Configuration (from systemd service)")
|
print("Testing Microsoft Entra ID OAuth Configuration (from systemd service)")
|
||||||
print("=" * 60)
|
print("=" * 60)
|
||||||
print(f"TENANT_ID: {tenant_id}")
|
|
||||||
print(f"CLIENT_ID: {client_id}")
|
# Get configuration from systemd service environment
|
||||||
print(f"CLIENT_SECRET: {'*' * len(client_secret) if client_secret else 'None'}")
|
env_vars = get_systemd_env_vars()
|
||||||
|
|
||||||
|
tenant_id = env_vars.get('TENANT_ID')
|
||||||
|
client_id = env_vars.get('CLIENT_ID')
|
||||||
|
client_secret = env_vars.get('CLIENT_SECRET')
|
||||||
|
|
||||||
|
print(f"TENANT_ID: {tenant_id if tenant_id else '❌ Not set'}")
|
||||||
|
print(f"CLIENT_ID: {client_id if client_id else '❌ Not set'}")
|
||||||
|
print(f"CLIENT_SECRET: {'*' * 40 if client_secret else '❌ Not set'}")
|
||||||
print()
|
print()
|
||||||
|
|
||||||
|
# Check if variables are set
|
||||||
if not all([tenant_id, client_id, client_secret]):
|
if not all([tenant_id, client_id, client_secret]):
|
||||||
print("❌ ERROR: Missing required environment variables in systemd service!")
|
print("❌ ERROR: Missing required environment variables in systemd service!")
|
||||||
print("The PDF renamer service doesn't have the Microsoft Entra credentials set.")
|
|
||||||
print()
|
print()
|
||||||
print("To fix this:")
|
print("To fix this:")
|
||||||
print("1. Edit the service file: sudo nano /etc/systemd/system/pdf-renamer.service")
|
print("1. Edit the service file:")
|
||||||
|
print(" sudo nano /etc/systemd/system/pdf-renamer.service")
|
||||||
|
print()
|
||||||
print("2. Add these lines in the [Service] section:")
|
print("2. Add these lines in the [Service] section:")
|
||||||
print(" Environment=\"TENANT_ID=your-tenant-id\"")
|
print(' Environment="TENANT_ID=98367e69-bd4c-47c6-90ef-683461397b64"')
|
||||||
print(" Environment=\"CLIENT_ID=your-client-id\"")
|
print(' Environment="CLIENT_ID=a8e66d01-c280-4bb4-8ffc-8b3be4414cfc"')
|
||||||
print(" Environment=\"CLIENT_SECRET=your-client-secret\"")
|
print(' Environment="CLIENT_SECRET=yWO8Q~d-WdmeWIiCxUFPKUwJE-3aprcVwhQWacAt"')
|
||||||
print("3. Reload and restart: sudo systemctl daemon-reload && sudo systemctl restart pdf-renamer")
|
print()
|
||||||
|
print("3. Reload and restart:")
|
||||||
|
print(" sudo systemctl daemon-reload")
|
||||||
|
print(" sudo systemctl restart pdf-renamer")
|
||||||
return False
|
return False
|
||||||
|
|
||||||
if tenant_id in ['your-tenant-id', 'YOUR_MICROSOFT_ENTRA_TENANT_ID']:
|
# Check for placeholder values
|
||||||
print("❌ ERROR: TENANT_ID is still set to default placeholder value!")
|
placeholder_values = [
|
||||||
|
'your-tenant-id',
|
||||||
|
'YOUR_MICROSOFT_ENTRA_TENANT_ID',
|
||||||
|
'your-client-id',
|
||||||
|
'YOUR_MICROSOFT_ENTRA_CLIENT_ID',
|
||||||
|
'your-client-secret',
|
||||||
|
'YOUR_MICROSOFT_ENTRA_CLIENT_SECRET',
|
||||||
|
'CHANGE_THIS',
|
||||||
|
]
|
||||||
|
|
||||||
|
if any(tenant_id == placeholder for placeholder in placeholder_values):
|
||||||
|
print("❌ ERROR: TENANT_ID is still set to placeholder value!")
|
||||||
|
print(f" Current value: {tenant_id}")
|
||||||
|
print(" Use: 98367e69-bd4c-47c6-90ef-683461397b64")
|
||||||
return False
|
return False
|
||||||
|
|
||||||
if client_id in ['your-client-id', 'YOUR_MICROSOFT_ENTRA_CLIENT_ID']:
|
if any(client_id == placeholder for placeholder in placeholder_values):
|
||||||
print("❌ ERROR: CLIENT_ID is still set to default placeholder value!")
|
print("❌ ERROR: CLIENT_ID is still set to placeholder value!")
|
||||||
|
print(f" Current value: {client_id}")
|
||||||
|
print(" Use: a8e66d01-c280-4bb4-8ffc-8b3be4414cfc")
|
||||||
return False
|
return False
|
||||||
|
|
||||||
if client_secret in ['your-client-secret', 'YOUR_MICROSOFT_ENTRA_CLIENT_SECRET']:
|
if any(client_secret == placeholder for placeholder in placeholder_values):
|
||||||
print("❌ ERROR: CLIENT_SECRET is still set to default placeholder value!")
|
print("❌ ERROR: CLIENT_SECRET is still set to placeholder value!")
|
||||||
|
print(" Use: yWO8Q~d-WdmeWIiCxUFPKUwJE-3aprcVwhQWacAt")
|
||||||
return False
|
return False
|
||||||
|
|
||||||
# Test metadata URL
|
# Test tenant ID format
|
||||||
metadata_url = f'https://login.microsoftonline.com/{tenant_id}/v2.0/.well-known/openid_configuration'
|
if len(tenant_id) != 36 or tenant_id.count('-') != 4:
|
||||||
print(f"Testing metadata URL: {metadata_url}")
|
print(f"⚠️ WARNING: TENANT_ID doesn't look like a valid GUID: {tenant_id}")
|
||||||
|
print(" Expected format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
|
||||||
|
|
||||||
|
# Test client ID format
|
||||||
|
if len(client_id) != 36 or client_id.count('-') != 4:
|
||||||
|
print(f"⚠️ WARNING: CLIENT_ID doesn't look like a valid GUID: {client_id}")
|
||||||
|
print(" Expected format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx")
|
||||||
|
|
||||||
try:
|
print("Testing OpenID Configuration endpoints...")
|
||||||
response = requests.get(metadata_url, timeout=10)
|
print()
|
||||||
if response.status_code == 200:
|
|
||||||
print("✅ Metadata URL is accessible")
|
# Test multiple tenant endpoints
|
||||||
else:
|
endpoints_to_test = [
|
||||||
print(f"❌ Metadata URL returned status {response.status_code}")
|
(f'https://login.microsoftonline.com/{tenant_id}/v2.0/.well-known/openid-configuration', 'Tenant-specific'),
|
||||||
return False
|
(f'https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration', 'Common (any account)'),
|
||||||
except Exception as e:
|
(f'https://login.microsoftonline.com/organizations/v2.0/.well-known/openid-configuration', 'Organizations only'),
|
||||||
print(f"❌ Error accessing metadata URL: {e}")
|
]
|
||||||
|
|
||||||
|
working_endpoint = None
|
||||||
|
for metadata_url, description in endpoints_to_test:
|
||||||
|
print(f"Testing {description} endpoint...")
|
||||||
|
print(f" URL: {metadata_url}")
|
||||||
|
|
||||||
|
try:
|
||||||
|
response = requests.get(metadata_url, timeout=10)
|
||||||
|
if response.status_code == 200:
|
||||||
|
print(f" ✅ Accessible (status {response.status_code})")
|
||||||
|
if working_endpoint is None:
|
||||||
|
working_endpoint = (metadata_url, description)
|
||||||
|
else:
|
||||||
|
print(f" ❌ Failed (status {response.status_code})")
|
||||||
|
except requests.exceptions.RequestException as e:
|
||||||
|
print(f" ❌ Error: {e}")
|
||||||
|
print()
|
||||||
|
|
||||||
|
if not working_endpoint:
|
||||||
|
print("❌ ERROR: Could not access any OpenID configuration endpoint!")
|
||||||
|
print()
|
||||||
|
print("Possible issues:")
|
||||||
|
print("1. Network connectivity issues")
|
||||||
|
print("2. Firewall blocking Microsoft endpoints")
|
||||||
|
print("3. Tenant restrictions")
|
||||||
|
print()
|
||||||
|
print("Try updating the systemd service to use 'common' or 'organizations':")
|
||||||
|
print(' Environment="TENANT_ID=common"')
|
||||||
return False
|
return False
|
||||||
|
|
||||||
# Test OAuth client creation
|
print(f"✅ Working endpoint found: {working_endpoint[1]}")
|
||||||
try:
|
print()
|
||||||
client = OAuth2Session(
|
|
||||||
client_id=client_id,
|
# Provide specific recommendations
|
||||||
client_secret=client_secret,
|
if working_endpoint[0].startswith(f'https://login.microsoftonline.com/{tenant_id}'):
|
||||||
scope=['openid', 'email', 'profile']
|
print("✅ Your tenant-specific endpoint works - configuration is optimal!")
|
||||||
)
|
else:
|
||||||
print("✅ OAuth client created successfully")
|
print("⚠️ Your tenant-specific endpoint failed, but alternate endpoint works.")
|
||||||
except Exception as e:
|
print()
|
||||||
print(f"❌ Error creating OAuth client: {e}")
|
if 'common' in working_endpoint[0]:
|
||||||
return False
|
print("RECOMMENDATION: Update your systemd service to use:")
|
||||||
|
print(' Environment="TENANT_ID=common"')
|
||||||
|
elif 'organizations' in working_endpoint[0]:
|
||||||
|
print("RECOMMENDATION: Update your systemd service to use:")
|
||||||
|
print(' Environment="TENANT_ID=organizations"')
|
||||||
|
print()
|
||||||
|
print("This is often caused by tenant restrictions but won't affect functionality.")
|
||||||
|
|
||||||
print()
|
print()
|
||||||
print("🎉 OAuth configuration in systemd service appears to be correct!")
|
print("=" * 60)
|
||||||
|
print("🎉 OAuth configuration is correct!")
|
||||||
|
print("=" * 60)
|
||||||
|
print()
|
||||||
|
print("IMPORTANT: Verify your app registration in Azure Portal:")
|
||||||
|
print()
|
||||||
|
print("1. Go to: Azure Portal → Microsoft Entra ID → App registrations → NextGen PDF")
|
||||||
|
print()
|
||||||
|
print("2. Under 'Authentication', verify Redirect URI is set to:")
|
||||||
|
print(" https://nextgenpdf.trbc.org/auth")
|
||||||
|
print(" (Must be EXACTLY this, including https://)")
|
||||||
|
print()
|
||||||
|
print("3. Under 'API permissions', ensure you have:")
|
||||||
|
print(" - Microsoft Graph → openid")
|
||||||
|
print(" - Microsoft Graph → email")
|
||||||
|
print(" - Microsoft Graph → profile")
|
||||||
|
print()
|
||||||
|
print("4. Restart the service to apply any changes:")
|
||||||
|
print(" sudo systemctl restart pdf-renamer")
|
||||||
|
print()
|
||||||
|
print("5. Check logs while testing:")
|
||||||
|
print(" sudo journalctl -u pdf-renamer -f")
|
||||||
print()
|
print()
|
||||||
print("Next steps:")
|
|
||||||
print("1. Make sure your redirect URI is registered in Microsoft Entra:")
|
|
||||||
print(" https://yourdomain.com/auth")
|
|
||||||
print("2. Restart the application: sudo systemctl restart pdf-renamer")
|
|
||||||
print("3. Check the application logs for any remaining issues")
|
|
||||||
|
|
||||||
return True
|
return True
|
||||||
|
|
||||||
if __name__ == '__main__':
|
if __name__ == '__main__':
|
||||||
test_oauth_config()
|
success = test_oauth_config()
|
||||||
|
sys.exit(0 if success else 1)
|
||||||
Reference in new issue
Block a user