From 9d4d5366a173f0f14c41903e8ffe96b82beba4b3 Mon Sep 17 00:00:00 2001 From: Ben Cooke Date: Tue, 5 Mar 2024 13:12:33 -0500 Subject: [PATCH] [MM-56088] Adding extra logs for openId state failures (#25663) * adding extra logs for openId failures --- server/channels/app/oauth.go | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/server/channels/app/oauth.go b/server/channels/app/oauth.go index 191b2b4262..b26906217f 100644 --- a/server/channels/app/oauth.go +++ b/server/channels/app/oauth.go @@ -822,17 +822,19 @@ func (a *App) AuthorizeOAuthUser(c request.CTX, w http.ResponseWriter, r *http.R stateEmail := stateProps["email"] stateAction := stateProps["action"] if stateAction == model.OAuthActionEmailToSSO && stateEmail == "" { - return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest) + err := errors.New("No email provided in state when trying to switch from email to SSO") + return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest).Wrap(err) } cookie, cookieErr := r.Cookie(CookieOAuth) if cookieErr != nil { - return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest) + return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest).Wrap(cookieErr) } expectedTokenExtra := generateOAuthStateTokenExtra(stateEmail, stateAction, cookie.Value) if expectedTokenExtra != expectedToken.Extra { - return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest) + err := errors.New("Extra token value does not match token generated from state") + return nil, "", stateProps, nil, model.NewAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.invalid_state.app_error", nil, "", http.StatusBadRequest).Wrap(err) } appErr = a.DeleteToken(expectedToken)