invalid callback url to gitlab

[atmlvs]

I use gerrit-2.14.6.war and latest gerrit-oauth-provider jar, configured the redirect URI in gitlab as http://192.168.132.29:8081/gerrit/oauth according to documentation. But seems this is a invalid url.

could you help to specify what the correct redirect URL used here? thanks.

[mwebber]

All IP addresses 192.168.x.x are private addresses (only accessible from your local network), so it might be rejecting it because of that (even though it should work, provided your browser can see that address).

What's the exact error message you are getting, and where do you see it? Are there any error messages in Gerrit's error_log?

[atmlvs]

Hi Matthew, I used it in local network, the callback works in sonar, but failed in Gerrit. I tried to access the http://192.168.132.29:8081/oauth page and returned "Not Found".
the page from gitlab side shows,
"""
An error has occurred
The redirect URI included is not valid.
"""
and Gerrit's error_log shows nothing when click "sigin in" from Gerrit.
httpd_log shows "GET /login/%23%2Fq%2Fstatus%3Aopen HTTP/1.1" 302 - "http://192.168.132.29:8081/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0".

[mwebber]

Does GitLab require the redirect to go to https?

[atmlvs]

I guess no, because sonar also use the same gitlab server. sonar requires https and redirect works: https://localhost:port/sonar/oauth2/callback/gitlab.
is there any way to test the redirect? I think the redirect url was served by gerrit-oauth-provider, am I right?

[speachy]

I just got bit by something similar to this, authenticating against gitlab.

I'm currently using gerrit 2.14.20 and the 2.14.6.2 gerrit-oauth-plugin release.

I tried to enable gitlab autnentication, configured gitlab and gerrit with the correct URLs, and gitlab kicks things back claiming an invalid URL.

Here's where things get strange. The URL that the oauth-plugin generates is this:

https://gitlab.com/oauth/authorize?client_id=BLABLABLA&redirect_uri=https:/gerrit.mysite/oauth&etcetc

Note the redirect URI reads 'https:/' not 'https://' -- If I manually edit the URL to add the missing '/' everything works.

The plugin authenticates against google and github properly, and gerrit's canonicalWebUrl correctly has 'https://' in it.

(update: fix typo)

[davido]

I am not sure what could be wrong here. From the day one, the code looks right: [1].

    service = new ServiceBuilder().provider(new GitLabApi(rootUrl))
        .apiKey(cfg.getString(InitOAuth.CLIENT_ID))
        .apiSecret(cfg.getString(InitOAuth.CLIENT_SECRET))
        .callback(canonicalWebUrl + "oauth")
        .build();

Can you debug it?

[1] https://gerrit-review.googlesource.com/c/plugins/oauth/+/99000/5/src/main/java/com/googlesource/gerrit/plugins/oauth/GitLabOAuthService.java#68

[speachy]

I've spent some quality time on this today, after having upgraded to gerrit 2.16.23, and the latest version of the 2.16 build of the oauth plugin.

I discovered that the invalid URI problem I had was due to a trailing trailing '/' on the 'root-url' -- in other words, it needs to read "root-url = https://gitlab.com"

That got me past the invalid URL, and gitlab then prompts me to authorize my gerrit instance. I say yes, and it redirects back ot the configured URL, but gerrit simply returns "Server Error"

Here is the redirection URL that gitlab kicks back to the browser:

https://my.gerrit.site/r/oauth?code=HEXBLABLABLA&state=MOREHEXBLABLABLA

In the logs, I see this:

[2020-11-15 05:34:55,493] [HTTP-86] WARN org.eclipse.jetty.server.HttpChannel : handleException /r/oauth com.fasterxml.jackson.core.JsonParseException: Unrecognized token 'error': was expecting (JSON String, Number, Array, Object or token 'null', 'true' or 'false')
at [Source: (String)"error code: 1010"; line: 1, column: 6]
[2020-11-15 05:34:55,494] [HTTP-86] ERROR com.google.gerrit.pgm.http.jetty.HiddenErrorHandler : Error in GET /r/oauth?code=bcf595294e6905b4013afdf70ba22e8c42192b740b5c7a34c65e1def6896849f&state=ckXPqEgibaoUUWZYG_t6YI0UamIFhzrVeFZn4NOwxeE
java.lang.RuntimeException: Cannot retrieve access token
at com.googlesource.gerrit.plugins.oauth.GitLabOAuthService.getAccessToken(GitLabOAuthService.java:120)
[...and a lot more...]

Any suggestions?

EDIT: That 'error code: 1010' message appears to be due to gitlab using cloudfare, and them not liking the user-agent:

https://support.cloudflare.com/hc/en-us/articles/360029779472#error1010

EDIT2: Looks like cloudfare+gitlab is definitely rejecting some user-agents:

https://gitlab.com/gitlab-org/gitlab/-/issues/223293

Would it be feasible to allow the user-agent reported by the oauth plugin to be configurable?

[davido]

I am not a Gitlab expert. I would probably accept anything that would help making GitLab OAuth provider work (again).