OIDC with Kanidm

[papylhomme]

Hello,

just configured OIDC with kanidm, it works fine but I had to disable PKCE which is flagged as insecure. Did I miss something, or is it a missing feature for auth worflow ?

[joshwebtimestwo]

This is missing from CWA's current generic-OIDC setup: cps/oauth_bb.py constructs OAuth2ConsumerBlueprint without use_pkce, whose default is False.

For a local test patch, add this after the generic-provider blueprint_params dictionary in generate_oauth_blueprints(), before constructing the blueprint:

blueprint_params.update(
    use_pkce=True,
    code_challenge_method="S256",
)

These are blueprint options, not extra authorization URL parameters. Flask-Dance needs to retain the verifier and send it during the token exchange, not just add a challenge parameter to the initial URL.

I tested Flask-Dance 7.1.0, within CWA's dependency range, using CWA's actual GenericOIDCSession and a mocked HTTPS token endpoint. Enabling this produced an S256 challenge and a token-request verifier whose hash matched it; without it, neither was sent. I haven't tested a complete CWA login against Kanidm, so this still needs integration testing with your installed versions. There isn't currently a CWA admin-panel toggle for it.

[papylhomme]

Thanks for the details, I'll give it a try then 👍

[hippi345]

you didn't miss anything, CWA's generic OIDC just doesn't do PKCE right now. in cps/oauth_bb.py the generic provider is a Flask-Dance OAuth2ConsumerBlueprint built without use_pkce, so no code_challenge ever gets sent and kanidm refuses it. so kanidm system oauth2 warning-insecure-client-disable-pkce <client> is the only way for now.

it's still a confidential client using the client secret on the token call, so it's not wide open, you just lose the extra PKCE check.

Flask-Dance has supported use_pkce=True since 7.0, and CWA already allows that version, so it should be a pretty small change. worth opening a feature request for it

[papylhomme]

Thx for the quick response. I'm not worried about security in this case, I just want to keep an eye on this thing to disable the flag once the feature is available :)