PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add sso-diagnose.sh: verify all peertube-sso-incident claims into a log

Browse Source 
- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary
This commit is contained in:
Pontoporeia
2026-08-24 11:36:02 +02:00
parent f31addb6bc
commit e4b48867aa
7 changed files with 500 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sso-diagnose.log
+91
View File
@@ -0,0 +1,91 @@
════════════════════════════════════════════════════════════════════
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:42:17 +0200
════════════════════════════════════════════════════════════════════
MISSING-DEP dig
MISSING-DEP host
── topology / DNS / reverse-DNS / HTTP identity
%-28s %s DNS[videos.erg.be]: 194.78.61.186
%-28s %s rDNS[194.78.61.186]: none
%-28s %s DNS[mail.erg.school]: 79.99.201.114
%-28s %s rDNS[79.99.201.114]: none
%-28s %s DNS[portail.erg.school]: 79.99.201.119
%-28s %s rDNS[79.99.201.119]: none
── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
%-28s %s HTTP: 200
%-28s %s issuer: https://portail.erg.school/
%-28s %s grant_types_supported: authorization_code,refresh_token
%-28s %s response_types_supported: code
%-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
%-28s %s token_endpoint: https://portail.erg.school/oauth2/token
FINDING grant.password → ABSENT
FINDING grant.client_credentials → ABSENT
FINDING grant.authorization_code → PRESENT
CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
── PeerTube OAuth (https://videos.erg.be)
%-28s %s config HTTP: 200
%-28s %s local client_id: <REDACTED>
%-28s %s local client present: yes
%-28s %s password-grant ok: 0
%-28s %s password-grant code:
── SMTP AUTH mechanisms (mail.erg.school:587)
%-28s %s AUTH mechanisms: PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
── proxy → backend identity-header propagation
%-28s %s echo header [X-Powered-By]: PeerTube
%-28s %s echo header [Server]: nginx
%-28s %s effective-url: https://videos.erg.be/
════════════════════════════════════════════════════════════════════
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
════════════════════════════════════════════════════════════════════
════════════════════════════════════════════════════════════════════
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:46:25 +0200
════════════════════════════════════════════════════════════════════
MISSING-DEP dig
MISSING-DEP host
── topology / DNS / reverse-DNS / HTTP identity
%-28s %s DNS[videos.erg.be]: 194.78.61.186
%-28s %s rDNS[194.78.61.186]: none
%-28s %s DNS[mail.erg.school]: 79.99.201.114
%-28s %s rDNS[79.99.201.114]: none
%-28s %s DNS[portail.erg.school]: 79.99.201.119
%-28s %s rDNS[79.99.201.119]: none
── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
%-28s %s HTTP: 200
%-28s %s issuer: https://portail.erg.school/
%-28s %s grant_types_supported: authorization_code,refresh_token
%-28s %s response_types_supported: code
%-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
%-28s %s token_endpoint: https://portail.erg.school/oauth2/token
FINDING grant.password → ABSENT
FINDING grant.client_credentials → ABSENT
FINDING grant.authorization_code → PRESENT
CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
── PeerTube OAuth (https://videos.erg.be)
%-28s %s config HTTP: 200
%-28s %s local client_id: <REDACTED>
%-28s %s local client present: yes
%-28s %s password-grant ok: 0
%-28s %s password-grant code:
── SMTP AUTH mechanisms (mail.erg.school:587)
%-28s %s AUTH mechanisms: PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
── proxy → backend identity-header propagation
%-28s %s response-header scope: response side only — cannot reveal inbound identity
%-28s %s response [X-Powered-By]: PeerTube
%-28s %s response [Server]: nginx
── request-side identity header probe (echo endpoint)
%-28s %s echo endpoint: SKIPPED — pass --echo <url> (point it at echo-headers.php behind the same vhost)
HINT: to see headers LemonLDAP injects, host scripts/echo-headers.php behind
the SAME LemonLDAP vhost as PeerTube and re-run with --echo <that-url>.
A public echo service only shows headers YOUR client sent, not the
post-auth headers the SSO proxy adds.
%-28s %s effective-url: https://videos.erg.be/
════════════════════════════════════════════════════════════════════
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
════════════════════════════════════════════════════════════════════