Problems with using Nextcloud OAuth trough Generic OAuth connector (ID Token not present in token response)

[dmigis]

Question
I'm struggling to make wikijs working with Nextcloud as OAuth provider via Generic OpenID/OAuth connector. After successful redirection to Nextcloud login page and granting access Wikijs throws me an "ID Token not present in token response" error. In wikijs logs there is no error, nginx and nextcloud logs show, that token was received, but user data wasn't requested. Other services with Nextcloud as OAuth provider (Jupyterhub, Vouch proxy and so on) working okay. Is it a bug or I'm doing something wrong?

Host Info (please complete the following information):
OS: Docker
Wiki.js version: 2.5.126
Database engine: Postgres 11

[tionis]

I have the same problem when trying to use Gitea as oAuth provider. Same config works fine for other applications using it as oAuth provider.

[maznu]

Same problems here with our own home-grown OIDC auth endpoint.

I can see wiki.js making a POST to our token endpoint, which responds something like this:

{"access_token": "blahblahblah", "token_type": "Bearer", "scope": "openid openid profile email", "refresh_token": "blahblahblah", "expires_in": 3600}

But it doesn't get as far as making a request to our userinfo endpoint.

[Doctacosa]

I'm getting the same results.

OS: Docker
Wiki.js version: 2.5.170
Database engine: Postgres 11

My homegrown endpoint appears to be working fine, as I'm able to obtain the proper tokens by using a third-party tool like Postman, but Wiki.js fails with the error described above. I can't think of any alternative to make this work.

[cse342]

I am also affected by this issue.

OS: Ubuntu Server 20.04.1 LTS
Database: Postgres 12
Wiki.js: 2.5.170

I tried it with Nextcloud and with a Forum based on Woltlab Burning Board with an Addon called "Oauth 2.0 Server".
In both cases I receive the message "ID Token not present in token response" upon granting access on the openid server.
If I checked correctly, the underlying library is passport-openidconnect, the file in charge is lib/strategy.js. If I looked it up correctly, this library hasn't received an update in nearly 4 years.

[daniel-illi]

I have the same problem.

I think wiki.js implements the OAuth 'implicit flow' to get the access token: the auth server returns the token immediately.
But all clients I used so far implement the 'authorization code' flow where the auth server returns an authorization code, which the client in turn uses to request the token from the auth server.

[Doctacosa]

I think wiki.js implements the OAuth 'implicit flow' to get the access token: the auth server returns the token immediately.

That's an interesting idea, I wasn't aware of the difference. Checking through the documentation of my PHP OAuth library (league/oauth2-server), the implicit workflow would have the client send a response_type of token, while the authorization flow would use code. Testing on Wiki.js, it sends code, implying that it's the authorization workflow being used.

I don't pretend to be super familiar with OAuth, so if someone else could chime in on this, it would be nice!

[daniel-illi]

After having another look, I realize that I was mistaken.

The error message reads "ID token not present in token response".
The wiki.js OAuth module expects the token endpoint response to include an JWT id token.

But when I inspect the browser requests in the developer console, I see that the redirect from the authorize endpoint triggers this error even before querying the token endpoint.
From my understanding, wiki.js should read the code from the redirect, call the token endpoint with the code and receive the access token and maybe an id token.

So something seems to be wired incorrectly.

[assada]

Same issue with oauth2 login. Looks like wiki.js support only OpenID type of OAuth2 protocol. =(

[troedel2546]

Same for me here with trying to connect to Mattermost as OAuth provider.

[mariosgit]

Just run into the same problem, the callback to https://wikijsthing/login/71ece951-xxx/callback?state=something&code=somestuff crashes with 500 server error. I do not see any token call, I guess this should be done under the hood.