scope changes causing authentication to fail for EVEOnline provider

Description 🐜

Scope parameter in EVEOnlline provider is being overwritten with “openid”

The EVEOnline provider requires there to be NO scope parameter. However in the provider code it is specified as “publicData” but it’s not even using that?

..., wellKnown: "https://login.eveonline.com/.well-known/oauth-authorization-server", authorization: { params: { scope: "publicData", }, },

However, when the login URL is constructed we get this:

url: 'https://login.eveonline.com/oauth/authorize?client_id=*redacted*&scope=openid&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Feveonline&nextauth=signin%2Ceveonline&state=GejPhUb_qWw8yj03eDsaDqmuN-tL1BLmXy3iRYW2Z-E

See in the URL that scope=openid … does anyone know why this is happening? EVEOnline reports a authentication error saying the scope is invalid. Is there a way to completely remove the scope parameter from the login URL?

Is this a bug in your own project?

Yes

How to reproduce ☕️

Use the auth provider for EVEOnline. You’ll need to get a developer API key which you can get from https://developers.eveonline.com/applications

Screenshots / Logs 📽

Environment 🖥

System: OS: Windows 10 10.0.19043 CPU: (8) x64 Intel® Core™ i7-6700K CPU @ 4.00GHz
Memory: 4.19 GB / 15.93 GB Binaries: Node: 17.0.1 - E:\Program Files\nodejs\node.EXE npm: 8.1.2 - E:\Program Files\nodejs\npm.CMD Browsers: Chrome: 97.0.4692.99 Edge: Spartan (44.19041.1266.0), Chromium (97.0.1072.69) Internet Explorer: 11.0.19041.1202 npmPackages: next: ^12.0.9 => 12.0.9 next-auth: ^4.0.0-beta.7 => 4.0.0-beta.7 react: 17.0.2 => 17.0.2

Contributing 🙌🏽

Yes, I am willing to help solve this bug in a PR

[brownoxford]

The Eve login endpoint does not return an id_token, so the eve configuration should be specifying idToken:false instead of true. This will lead to the login process trying to get at the userinfo_endpoint to look up user information, but the configured wellKnown of https://login.eveonline.com/.well-known/oauth-authorization-server does not provide that either.

The solution is to copy the EVEOnline configuration to your local code, set idToken to false, remove wellKnown, and manually specify authorization, token and userinfo.

[geraldm74]

Update:

Adding the following code to the EVEOnline Provider options fixed the id_token problem:

token: { async request({ client, provider, params, checks }) { const tokens = await client.oauthCallback( provider.callbackUrl, params, checks ) tokens.id_token = tokens.access_token return { tokens } }, }

The OAuth profile data is returned correctly as follows:

[next-auth][debug][PROFILE_DATA] { OAuthProfile: { scp: ‘publicData’, jti: ‘e8352ed6-6dab-4031-bc00-b4fa347ef756’, kid: ‘JWT-Signature-Key’, sub: ‘CHARACTER:EVE:----’, azp: ‘ab0f323397e04cc28718b0381965fa34’, tenant: ‘tranquility’, tier: ‘live’, region: ‘world’, name: ‘----’, owner: ‘Oz7Q/sor0EvZ4VQwNCN35lk6uZc=’, exp: 1643583849, iat: 1643582649, iss: ‘login.eveonline.com’ } }

However I then get a new error: [next-auth][error][OAUTH_PARSE_PROFILE_ERROR]

https://next-auth.js.org/errors#oauth_parse_profile_error Cannot read properties of undefined (reading ‘toString’) { error: { message: “Cannot read properties of undefined (reading ‘toString’)”, stack: “TypeError: Cannot read properties of undefined (reading ‘toString’)\n” …, name: ‘TypeError’ },

After this error I see the following:

[next-auth][debug][OAUTH_CALLBACK_RESPONSE] { profile: null, account: null, OAuthProfile: { scp: ‘publicData’, jti: ‘e8352ed6-6dab-4031-bc00-b4fa347ef756’, kid: ‘JWT-Signature-Key’, sub: ‘CHARACTER:EVE:----’, azp: ‘ab0f323397e04cc28718b0381965fa34’, tenant: ‘tranquility’, tier: ‘live’, region: ‘world’, name: ‘----’, owner: ‘Oz7Q/sor0EvZ4VQwNCN35lk6uZc=’, exp: 1643583849, iat: 1643582649, iss: ‘login.eveonline.com’ } }

I’m assuming the undefined error message is to do with profile and account being null? Does anyone know why this is?