Zotlabs|Hubzilla Development

AndHub: A native Hubzilla app for Android

Andrew

Sun, 24 Jun 2018 17:30:39 +0000

Many thanks to massimiliano and the #Disroot community for creating and sharing their new Hubzilla #app for #Android. I was able to compile and install from the source code with no trouble at all (git clone, open in Android Studio, Build, install generated APK). This is an exciting addition that I personally have been seeking for a long time. I tried several times over the years to get an Android app online, but I just didn't have the time and expertise to get the job done. Now I am happy to study the #AndHub source and hopefully to contribute where I can to improve it.

disroot / AndHub

Hubzilla Android app

show all 11 Comments

meaz

Tue, 26 Jun 2018 17:19:43 +0000

@Massimiliano you're the man!

Tue, 26 Jun 2018 20:36:29 +0000

What I wonder is how hard it will be to make a html 5 app for the librem 5 (currently stuck on ios till that comes out)

Marzanna

Wed, 27 Jun 2018 08:43:08 +0000

@mrjive you can try SailfishX. Still lacks many features but very promising.

Hubzilla with OAuth2 and OpenID Connect

Lasantha Ranaweera

Tue, 19 Jun 2018 06:22:14 +0000 last edited: Tue, 19 Jun 2018 06:40:41 +0000

Hi !Hubzilla Development,
I want to authenticate Hubzilla with external authentication provider like KeyCloak. Basically I don't want to create accounts in Hubzilla server and just want to use trusted tokens issued by third party to login to the system. Does Hubzilla support OAuth2 and OpenID Connect? Any documentation will be greatly appreciated.

OAuth2 OpenIDConnect SSO

show all 39 Comments

Tue, 19 Jun 2018 06:47:27 +0000

Does Hubzilla support OAuth2 and OpenID Connect?

Yes. The authorize endpoint is at /authorize and the token endpoint is at /token . These are discoverable via .well-known/oauth-authorization-server . You can create tokens manually by enabling OAuth2 token management in settings/features . Dynamic registration is theoretically supported but currently untested. There are currently no scopes, so successful authentication gives you full access to a channel's resources. You are welcome to improve on this.

There is a very basic zot API described in the documentation, and an emulation of the twitter/statusnet API is available as an addon.

Lasantha Ranaweera

Tue, 19 Jun 2018 06:59:57 +0000

Thank you very much for the prompt reply.

Are you referring Access Tokens in site admin shown in below screenshot?

Where should I configure authentication provider information in the server ?

Tue, 19 Jun 2018 09:04:10 +0000

This is your /admin/features page which will turn on the feature by default for everybody on the site.

You may want /settings/features to turn it on for just your channel instead. Either way, select and enable 'OAuth2 Clients'. You'll then find an OAuth2 management link on the left hand side of your /settings page.

Lasantha Ranaweera

Tue, 19 Jun 2018 09:28:08 +0000

Thanks again.

poVoq

Sat, 14 Jul 2018 13:26:53 +0000 last edited: Sat, 14 Jul 2018 13:30:47 +0000

I am also trying to get this to work, but with Hubzilla as the provider/server. My test case is a Wordpress installation with this plugin: https://github.com/daggerhart/openid-connect-generic

With the /authorize, /token and /logout I get already quite far, but it seems to be not fully working yet.

If I am logged into my Hubzilla account and click on the OpenID button in Wordpress, I get redirected to a "accept/reject" page on Hubzilla (but with an "unkown application" notice). If I click on accept however I get a json response

client_secret    "blablarandomstring"
error    "invalid_client"
error_description    "No client id supplied"

Edit: if I supply a random client ID in Wordpress, I get the following error on WP: "ERROR: This client is invalid or must authenticate using a client secret"
(I know I can create this per channel, but I am trying to create a instance wide login mechanism, not an individual app login).

If I am not logged in on Hubzilla it shows the login screen, but on login it redirects to a 404 page despite what appears to be close to the expected redirect url by wordpress ( https://example.com/wp-admin/admin-ajax.php?action=openid-connect-authorize).

I also think that one of the possible reasons it doesn't work is that normally OpenID Connect also expect a user info endpoint, something like this: https://example.com/oauth2/UserInfo
Any idea what could this be in the case of Hubzilla?

Anyways... help much apprechiated :)

poVoq

Sat, 14 Jul 2018 13:39:42 +0000

poVoq hat Lasantha Ranaweeras Beitrag mit ⋕OpenIDConnect verschlagwortet

poVoq

Sat, 14 Jul 2018 13:39:57 +0000

poVoq hat Lasantha Ranaweeras Beitrag mit ⋕SSO verschlagwortet

Wed, 08 Aug 2018 02:36:13 +0000

@poVoq @Lasantha Ranaweera

Just checking in - have you made any progress? Especially @poVoq with a "server wide" solution? I'm interested in doing the exact same thing - maybe we can pool our efforts.

Wed, 08 Aug 2018 03:42:19 +0000

OK, Tracing down the WP plugin along with tracking through the Hubzilla implementation of OAUTH2, I've found a few things. I'll be digging further over the next few days as I have time available. If you're actively working on debugging, let me know and maybe we can work together.

poVoq

Wed, 08 Aug 2018 07:34:30 +0000

I gave up on it for now as my impression is that right now this isn't fully supported. So if you can add the missing parts to the codebase, I'll definilty help test and debug it.

Wed, 08 Aug 2018 14:52:48 +0000

Doesn't look like anything is missing... Just looks like certain assumptions were made by different developers that didn't match. I did find 2 things that I'll be submitting a patch for. I need to do a bit more investigation, but the setup should be basically functional after the patches are applied. There may be a couple of specific config options that need to be set on the WordPress side also. But it's close.

Wed, 08 Aug 2018 22:30:10 +0000

I was working on it last night and found a bunch of little things. We'll probably have a bit of overlap but that's OK. I'm still stuck on the id_token (JWT?) verification as the id_token seems to have an empty "sub" property. This needs to be populated in the oauth2 library with the user_id and that's where I gave up for the night. There was an undocumented step I found in the oauth2 library issues list about making the id_token appear at all.

OAuth2Server:
       // Add the "OpenID Authorization Code" grant type
    $this->addGrantType(new \OAuth2\OpenID\GrantType\AuthorizationCode($storage));

authorize:
use the correct client_id in the UI
deleting individual tokens used the SQL from oauth1

api_auth:
if(array_key_exists('REDIRECT_REMOTE_USER',$_SERVER)) {
        if(! array_key_exists('HTTP_AUTHORIZATION',$_SERVER)) {
            $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_REMOTE_USER'];
        }
    }

api_zot:

        api_register_func('api/userinfo','api_zot_info',true);
    api_register_func('api/z/1.0/info','api_zot_info',true);

function api_zot_info($type) {
        if(api_user() === false) {
            return false;
        }

        $c = channelx_by_n(api_user());

        json_return_and_die( [
            'sub' => $c['channel_id'],
            'name' => $c['channel_name'],
            'preferred_username' => $c['channel_address'],
            'picture' => $c['xchan_photo_l']
        ]);
    }

Thu, 09 Aug 2018 00:59:18 +0000

HA! Sounds like we ended up getting to about the same place. I only found a couple of little things - and you probably know the standards better than me (I found out this afternoon that one of my "fixes" is disallowed by the standard, so I'd have to go back to the drawing board). I'm assuming you found the !is_aray($config) issue which took me a bit before I widened my eyes and saw the issue. I did finally get to the the point of seeing a failure to verify the id_token and that's where I needed to stop as real life beckoned.

Are your changes anywhere I could pull them from? Or do we just want to throw the whole ball of wax at @Mario Vavti and make him merge them? (Which basically will just mean if we collide, take yours, LOL)

Thu, 09 Aug 2018 04:51:19 +0000

I'm assuming you found the

Yes. Forgot to mention that one.

Are your changes anywhere I could pull them from?

Unfortunately no , which is why I tried to provide a fair bit of detail in my comment. I'm fairly certain the only thing standing in the way at this point is the missing "sub" in the id_token. Everything else is just a matter of massaging the userinfo endpoint to provide more things like for instance email. I doubt if I'll be able to get back to it until next week.

Thu, 09 Aug 2018 13:43:49 +0000

I've got sub populating - but there is a type conflict. The standard is strict - both data and type must match - and the JWT is registering user_id as int, but the userinfo reply has it as string. I've tried various ways of casting it, but so far no dice. I also ended up creating a /userinfo endpoint modeled after the /token endpoint (took me a bit to figure out the auto resolution of Module endpoints).

I'm so close I can taste it... so chances are, I'll at least have it WORKING in the next day or so. Now... as for working CORRECTLY, I'll probably need someone to look it over and tell me what I screwed up.

Thu, 09 Aug 2018 16:41:47 +0000

I just realized that the dev notes from above solve the opposite problem from the OP. The OP talks about using Hubzilla as a client to an openid provider. We're working on using Hubzilla as the provider and authenticating other client systems.

Just a note to acknowledge the discrepancy and possibly clear up confusion for anyone reading this later.

Fri, 10 Aug 2018 01:33:43 +0000

Woot.... I have a functional interface. Now to weed through and clean up the changes to the bare essentials without breaking it (again).

Andrew

Fri, 10 Aug 2018 09:37:00 +0000

I'm glad to see so much progress being made on this. I was just reviewing the git log; it looks like I started working on this in February because I was seeking the "right way" to authenticate an #Android #app that of course I never completed. However, I guess it got Mike interested in it enough again to revise, complete, and integrate what I had done, and now it's nice to see yet another person pick up the baton to (hopefully) truly get this thing across the finish line.

After all this work, then, is the question of how are we going to use it? It should allow many existing apps and frameworks to interoperate with Hubzilla since this is a widely accepted standard, which should lower the barrier to developers who wish to connect external apps to Hubzilla. It would be great if perhaps this could be used as the authentication mechanism for the #Nomad app @Massimiliano has been building.

Fri, 10 Aug 2018 15:50:22 +0000

Ok, I have a working implementation.  Need to do a few UI updates.  Certain things should not be changed since connect-with-openid is a server wide thing and if a user changes things like "secrets", it will affect the whole server (ooh, that would be a mess!)

These things should be easy to remedy - the OAuth2 library is extensible enough to make it possible to do both public and private.  From what I can see, the way things are implemented currently, all clients are by default "public" - meaning anyone can use any "client_id" in the database.  It only checks the client_secret if it is sent by the client.  If the client sends a blank client_secret, then the check is not done.  We may want to change that in the future, but given the exceedingly limited amount of information I expect we will ever send back, I'm not seeing a problem with leaving it as-is.  I'm actually having  a hard time coming up with a usecase that makes it a high priority to fix.

In any event, overriding the default logic in the Storage class is what would be needed.  It's pretty simple to do.  Just look at what's done by default in the vendor/bshaffer/oauth2-server-php/src/OAuth2/Storage/Pdo.php (default PDO storage class), and add whatever changes are needed in Zotlabs/OAuth2Storage.php.

@poVoq - In doing testing and investigation - the Wordpress plugin will work, but there are a couple of caveats (mostly having to do with username assignment and some other little things).  I'm probably eventually going to fork their code and make some updates and either ask them to be merged in or just release them separately.  The biggest thing is to leave the secret blank (see notes above).  I'd really like to also make the plugin multi-site aware, then some real awesomeness can commence.

Fri, 10 Aug 2018 17:26:57 +0000

Initial PR submitted.... one more on the way to clean up a few UI items not related to raw functionality.

But... IT WORKS! I can auth my WORDPRESS install to Hubzilla - no need for a password.

poVoq

Fri, 10 Aug 2018 17:50:19 +0000

That sounds awesome. Another system you could try is this:
https://apps.nextcloud.com/apps/sociallogin

Since it uses hybridauth3 it should show compatibility with a lot of php apps.

Fri, 10 Aug 2018 18:10:47 +0000

@Mike Macgirvin - I didn't mentally process all your changes and so didn't comprehend the api_zot and api_auth changes you referenced.  I ended up simply making a /userinfo endpoint to go along with the /token and /authorize endpoints.  I think it makes more sense since the OAUTH2 library has it's own authentication scheme for the /userinfo endpoint.

As you'll note, for the OAUTH stuff itself, almost all of the changes I made were to the Identity/OAuth2Storage.php and Identity/OAuth2Server.php files to implement the appropriate things from the OAuth2 library itself.

As frustrating as that exercise was (and believe me.... it was frustrating as all get out!), I'm VERY pleased with the results.  There are some things to do to tighten it up, but I don't think any of them are "make-it-or-break-it".  So, we should have a working OAuth2 connect-with-openid framework now.

One thing that DOES need to happen (GDPR and all that), is that the authorization screen needs to include the info about what may be "shared" (username, webbie, but really, not much else, I was going to do some profile stuff (picture/etc), but decided against it at this point).  That authorization screen needs someone who knows how to work UI magic...  it's functional, but that's about it.  (ABSOLUTELY NOT disparaging @Andrew Manning  or whoever put it together!!  Basically just saying, "Looks like *I* did it!" LOL.

Fri, 10 Aug 2018 19:54:30 +0000

@poVoq - unfortunately, I don't personally have the resources to do that kind of testing. But with a few base considerations, anyone should be able to test and report. Basically (1) Don't put in a "client_secret" setting. (2) make sure the "scope" includes openid. (3) The only Claims currently supported are name, preferred_username, zotwebbie, and zothash. No other claims are returned and if you include them in the scope, your request will be rejected.

I expect the updates will be pushed into dev in the next few days for anyone who wants to try it out.

Fri, 10 Aug 2018 21:59:20 +0000

I'll merge in my fixes after I see what parts don't overlap.

poVoq

Wed, 05 Dec 2018 15:49:24 +0000

@M. Dent Has this server wide login functionality been actually implemented in HubZilla? I was kind of hopeing to see it working after upgrading to 3.8 recently, but the converted Oauth2 app seem to still only work per user basis to authorize devices etc. Not as a server wide SSO mechanism for users (e.g. to have a button on the login screen of Nextcloud that says "log-in with our HubZilla (instance)" instead of Google/Facebook etc social logins.

Thu, 06 Dec 2018 04:35:40 +0000

I had it working with the WordPress OID-Connect app back when we had this conversation previously. I haven't had a need to revisit it, but I assume it still works. Oauth2 is a different system entirely. I will need to review the state of this to give a definitive answer but my quick answer is, "Last I knew it worked - it wasn't pretty, but it was functional".

poVoq

Thu, 06 Dec 2018 15:12:44 +0000

OID-Connect is an extension to Oauth2, but anyways... OID-Connect is what I am actually interested in ;)

So how do I configure it? There isn't any admin setting that would allow to create a client ID and client secret or anything like that.

Thu, 06 Dec 2018 16:23:25 +0000

Technically an "extension", to the standard, yes, but from an implementation standpoint it's really it's own thing.

I just took a quick peek at the code to see if I could answer your question - it's been refactored quite a bit since I last looked and I don't have time to look more closely right now. I was hoping it would be a quick answer but I'm going to have to go back and "play" with it before I can give you specifics. Sorry.

Thu, 06 Dec 2018 16:29:13 +0000

As I recall, the ClientID is arbitrary - and you leave the secret blank. The hardest part when I did it last time was knowing what fields to request (if you request something that Hubzilla does not allow to be requested, it denies, so ask only for the bare minimum) and which field to use as a "key" or "id".

If you can read and follow PHP, you might be able to figure it out yourself by looking at the openid addon in the addon repository: https://framagit.org/hubzilla/addons

It's something someone should put together at least a quick "how-to" for so if you figure it out, it'd be a great help to write something up and at least post it - or better - put in a merge request to the HZ Documentation!

I actually have a use for this, so I'll eventually get around to it. But right now, there's no telling exactly how long that could be - probably sometime between now and February 30th.

Mon, 10 Dec 2018 12:21:55 +0000

Hi,

I'm new to Hubzilla so first of all, congratulations on the idea and willpower to create & invest time in zot, Hubzilla etc.

I like the idea of maintaining my online identity in Hubzilla only and not having to maintain user/pwd combos for other services.
So I wanted to help by testing OpenID Connect on a service against Hubzilla as provider and I'm sharing the outcome below.
As a sample, I installed Nextcloud with the "Social login" app.
My first concern is "can it work?", next "is it feasible to use for non-technical users?", next "what if ...?"

I'm sharing my findings at this moment even though it's far from complete - maybe I'm doing it all wrong and I can spend my time better on a config as-it-should.

My findings:
- it's possible to configure OAuth2 app manager in Hubzilla & Custom OpenID Connect in Nextcloud => Social login app, so that one can login in Nextcloud using a Hubzilla account
User experience:
   - open Nextcloud login page
   - click button "Hubzilla OpenID Connect login"
   - (if I'm logged in to Hubzilla) => dialog "do you want to allow app nextcloud access to your channel data?" => Allow/Deny
   - (if I'm not logged in to Hubzilla) => First login to Hubzilla, then same dialog as if I was logged in already (see line above)
   - logged in to Nextcloud; if the user did not exist already (first time login), it is created in Nextcloud. Username will be a name <internal name>-<HZ internal user_id> e.g. "Hubzilla-6"

- side effects:
  - login name in Nextcloud is linked to the internal user ID in Hubzilla, so I wonder if/how it's possible to link a Hubzilla account to an existing Nextcloud account. It seems to me that the username to login in Nextcloud is taken from the id_token and userinfo is ignored as it's something optional (like email, profile picture etc)
    Interesting read: https://github.com/zorn-v/nextcloud-social-login/issues/32
  - for every new login attempt, I'm redirected to Hubzilla to "Allow" the login (not desirable, should be only once max?)
  - for every new login, a new entry appears in "Connected OAuth2 Apps" (for the same application) - see attached pic. Seems also undesirable.

- I want to look into some settings in Nextcloud social login app for which I found no doc:
   - "Allow users to connect social logins with their account"
   - "Prevent creating an acccount if the email address exists in another account"
=> what do they mean exactly and can they be used to enhance the user experience?

For reference, my config:
- Nextcloud (v14): install "social login" app
  Add a "Custom OpenID Connect" entry
  I configured
   "internal name" => "Hubzilla"
   "Title" => "Hubzilla OpenID Connect login"   [ this is what appears in the button on the login page ]
   "Authorize URL" => "https://MY_HUB/authorize"
   "Token URL" => "https://MY_HUB/token"
   "User info" => "https://MY_HUB/userinfo"
   "Client Id" => "nextcloud"    [ actually just an identifier that you will configure in Hubzilla OAuth2 Apps manager ]
   "Client Secret" => [the consumer secret generated in Hubzilla for the "nextcloud" OAuth2 App ]
   "Scope" => "openid"

- Hubzilla:
  - Install OAuth2 Apps manager
  - Add an application
    "Name" => the "Client Id" configured above in Nextcloud
    "Consumer secret" => a secret is generated by Hubzilla
    "Redirect" => (empty)
    "Grant Types" => "authorization_code" (*)
    "Authorization scope" => (empty)
(*) When I leave the "Grant Types" empty, then the OAuth2 library generates an error. More details on request.

poVoq

Mon, 10 Dec 2018 14:51:23 +0000

- I want to look into some settings in Nextcloud social login app for which I found no doc:
   1. "Allow users to connect social logins with their account"
   2. "Prevent creating an acccount if the email address exists in another account"
=> what do they mean exactly and can they be used to enhance the user experience?

1. allows you to connect the OID-Connect to an existing account. Log into Nextcloud with a regular account, go to Settings->Additional settings and click on one of the available providers below. It will then connect the Hubzilla account to your existing account.
2. If the Hubzilla account allows the scope of email address to be shared (not sure if already implemented) Nextcloud social login will automatically search the user-database for that email address and ask you to log into that account instead. If login is successful it will do the same as under 1.

poVoq

Mon, 10 Dec 2018 14:57:09 +0000

@Pascal
Did you try without configuring the Oauth2 app manager? I understood @M. Dent that this should be possible?
I would like to safe my users the hassle of configuring the OID-Connect app themselves and just do it server-wide for my Hubzilla instance.

Sat, 15 Dec 2018 21:23:10 +0000 last edited: Sun, 16 Dec 2018 08:39:06 +0000

@poVoq

I think you need to configure the Oauth2 app manager with 1 app == client ID e.g. 'nextcloud'. In Nextcloud, use that client ID in the OpenID Connect configuration. In my test, when I removed all OAuth2 app configuration, it would be unable to authenticate (message about invalid client credentials).
Note that the Oauth2 app manager interface requires to enter a secret (at least in my test).

But this is system-wide in the sense that, once configured as an admin in HZ & Nextcloud, then users don't need to configure anything. After my configuration as above, I can login to Nextcloud, authenticating with any user on my hub instance without configuration by that user. Nextcloud will auto-create the user.
Else, I don't understand your use case.

Sorry for the delay, I took some time to set-up a seperate 'testing' Nextcloud instance in order not to pollute my real hubzilla & nextcloud enviroment.
And speaking of pollution, if we go on about authenticating Nextcloud against Hubzilla through OpenID Connect, probably best to open a new conversation as this is not at all the original topic.

Note: I found that the email scope was not supported in HZ (although it was intended) -> I submitted a fix in merge request 1436. Easy to fix manually in your install if you look at the commit.

Edit: scopes I found to work were "openid name email picture". This populates "Full name", "Email" and the profile picture in Nextcloud. Hubzilla will return them without asking questions if you "Allow" the authentication.

Sat, 15 Dec 2018 21:34:34 +0000

@Pascal

THANKS! --- I've merged your update to dev.

https://framagit.org/hubzilla/core/merge_requests/1436

poVoq

Sun, 24 Feb 2019 16:27:46 +0000

@Pascal
Do you still have this working? I am running into an error:

Warning: count(): Parameter must be an array or an object that implements Countable in /var/www/hubzilla/vendor/bshaffer/oauth2-server-php/src/OAuth2/Response.php on line 369

Bug report here:
https://framagit.org/hubzilla/core/issues/1341

Maybe related to the Disable auto create new users & Allow users to connect social logins with their account parameters in NC social login? I only want to use it as an alternative quick login.

Mon, 25 Feb 2019 09:44:10 +0000

@poVoq

I'm currently using HZ 4.0RC - 1230; I did not bother to update NC, still using NC 14.0.4 and "social login" add-on version 1.11.2.
Works for me still.

I'll have a look at your bug report later.

Mon, 25 Feb 2019 11:56:08 +0000 last edited: Mon, 25 Feb 2019 11:56:24 +0000

It works for me in my dev environment after web-based update to NC 15.0.4 (social login add-on is updated as well).

poVoq

Mon, 25 Feb 2019 14:39:05 +0000

Hmm, ok so maybe something got fixed on that for Hubzilla4.0RC? Update of the external library maybe?
Because on my hub running Hubzilla 3.8.9 from the master git branch I always get stuck at that above warning, no matter how I config it.
@Pascal Could you please recheck your settings VS. what you wrote above? I only added the openid name email picture scopes.
Did you ever figure out why it has to have "Grant Types" => "authorization_code"? Thanks for the help!

poVoq

Sun, 10 Mar 2019 18:43:31 +0000

Updating to Hubzilla4.0 changed the error ;) I now get a Nextcloud page with the following:
Error: Signed API request has returned an error. HTTP error 401. Raw Provider API response: .

Zotlabs|Hubzilla Development

hubzilla-development@zotlabs.org