mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 09:53:08 +02:00
Pontoporeia
e4b48867aa
- docs: record the open identity-forwarding question, auth contracts, and responsibility boundary
92 lines
5.7 KiB
Plaintext
92 lines
5.7 KiB
Plaintext
|
|
════════════════════════════════════════════════════════════════════
|
|
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:42:17 +0200
|
|
════════════════════════════════════════════════════════════════════
|
|
MISSING-DEP dig
|
|
MISSING-DEP host
|
|
── topology / DNS / reverse-DNS / HTTP identity
|
|
%-28s %s DNS[videos.erg.be]: 194.78.61.186
|
|
%-28s %s rDNS[194.78.61.186]: none
|
|
%-28s %s DNS[mail.erg.school]: 79.99.201.114
|
|
%-28s %s rDNS[79.99.201.114]: none
|
|
%-28s %s DNS[portail.erg.school]: 79.99.201.119
|
|
%-28s %s rDNS[79.99.201.119]: none
|
|
── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
|
|
%-28s %s HTTP: 200
|
|
%-28s %s issuer: https://portail.erg.school/
|
|
%-28s %s grant_types_supported: authorization_code,refresh_token
|
|
%-28s %s response_types_supported: code
|
|
%-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
|
|
%-28s %s token_endpoint: https://portail.erg.school/oauth2/token
|
|
FINDING grant.password → ABSENT
|
|
FINDING grant.client_credentials → ABSENT
|
|
FINDING grant.authorization_code → PRESENT
|
|
CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
|
|
── PeerTube OAuth (https://videos.erg.be)
|
|
%-28s %s config HTTP: 200
|
|
%-28s %s local client_id: <REDACTED>
|
|
%-28s %s local client present: yes
|
|
%-28s %s password-grant ok: 0
|
|
%-28s %s password-grant code:
|
|
── SMTP AUTH mechanisms (mail.erg.school:587)
|
|
%-28s %s AUTH mechanisms: PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
|
|
FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
|
|
FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
|
|
── proxy → backend identity-header propagation
|
|
%-28s %s echo header [X-Powered-By]: PeerTube
|
|
%-28s %s echo header [Server]: nginx
|
|
%-28s %s effective-url: https://videos.erg.be/
|
|
|
|
════════════════════════════════════════════════════════════════════
|
|
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
|
|
════════════════════════════════════════════════════════════════════
|
|
|
|
════════════════════════════════════════════════════════════════════
|
|
XAMXAM SSO/PeerTube diagnosis — 2026-08-19 12:46:25 +0200
|
|
════════════════════════════════════════════════════════════════════
|
|
MISSING-DEP dig
|
|
MISSING-DEP host
|
|
── topology / DNS / reverse-DNS / HTTP identity
|
|
%-28s %s DNS[videos.erg.be]: 194.78.61.186
|
|
%-28s %s rDNS[194.78.61.186]: none
|
|
%-28s %s DNS[mail.erg.school]: 79.99.201.114
|
|
%-28s %s rDNS[79.99.201.114]: none
|
|
%-28s %s DNS[portail.erg.school]: 79.99.201.119
|
|
%-28s %s rDNS[79.99.201.119]: none
|
|
── SSO IdP discovery (https://portail.erg.school/.well-known/openid-configuration)
|
|
%-28s %s HTTP: 200
|
|
%-28s %s issuer: https://portail.erg.school/
|
|
%-28s %s grant_types_supported: authorization_code,refresh_token
|
|
%-28s %s response_types_supported: code
|
|
%-28s %s authorization_endpoint: https://portail.erg.school/oauth2/authorize
|
|
%-28s %s token_endpoint: https://portail.erg.school/oauth2/token
|
|
FINDING grant.password → ABSENT
|
|
FINDING grant.client_credentials → ABSENT
|
|
FINDING grant.authorization_code → PRESENT
|
|
CONCLUSION: IdP offers NO non-interactive grant → password/app-token paths are dead (matches report).
|
|
── PeerTube OAuth (https://videos.erg.be)
|
|
%-28s %s config HTTP: 200
|
|
%-28s %s local client_id: <REDACTED>
|
|
%-28s %s local client present: yes
|
|
%-28s %s password-grant ok: 0
|
|
%-28s %s password-grant code:
|
|
── SMTP AUTH mechanisms (mail.erg.school:587)
|
|
%-28s %s AUTH mechanisms: PLAIN LOGIN XOAUTH2 OAUTHBEARER PLAIN LOGIN XOAUTH2 OAUTHBEARER
|
|
FINDING SMTP → SSO/OAuth2 wired in (XOAUTH2/OAUTHBEARER present)
|
|
FINDING SMTP → legacy PLAIN/LOGIN KEPT → app's PLAIN auth still works (matches report)
|
|
── proxy → backend identity-header propagation
|
|
%-28s %s response-header scope: response side only — cannot reveal inbound identity
|
|
%-28s %s response [X-Powered-By]: PeerTube
|
|
%-28s %s response [Server]: nginx
|
|
── request-side identity header probe (echo endpoint)
|
|
%-28s %s echo endpoint: SKIPPED — pass --echo <url> (point it at echo-headers.php behind the same vhost)
|
|
HINT: to see headers LemonLDAP injects, host scripts/echo-headers.php behind
|
|
the SAME LemonLDAP vhost as PeerTube and re-run with --echo <that-url>.
|
|
A public echo service only shows headers YOUR client sent, not the
|
|
post-auth headers the SSO proxy adds.
|
|
%-28s %s effective-url: https://videos.erg.be/
|
|
|
|
════════════════════════════════════════════════════════════════════
|
|
summary → log written to: /home/theophile/repos/xamxam/sso-diagnose.log
|
|
════════════════════════════════════════════════════════════════════
|