Re: moodle 3.6 with ldap AD cannot rename user

August 21, 2019, 3:05 am

≫ Next: Re: A2FA (Another 2-Factor Auth) bar code is not shown in moodle site

≪ Previous: Re: Issue on multiple user accounts for one person

by Leon Stringer.

This sounds like MDL-66071 which should be fixed in the Moodle 3.6.5+ weekly release issued 12 days ago.

If your Moodle site is older than this update it to the latest weekly release. (There is a workaround if you can't do this for some reason).

↧

Re: A2FA (Another 2-Factor Auth) bar code is not shown in moodle site

August 21, 2019, 5:47 am

≫ Next: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: Re: moodle 3.6 with ldap AD cannot rename user

by Martin Biermann.

I just installed it on my Moodle 3.7 site and it works extremely well. Beware: You MUST read the README.md (is in the zip file; just expand) since you have to add a column to the user database manually.

↧

Could not upgrade oauth token in custom oAuth2 config

August 21, 2019, 7:34 am

≫ Next: Re: Issue on multiple user accounts for one person

≪ Previous: Re: A2FA (Another 2-Factor Auth) bar code is not shown in moodle site

by Alejandro Caminero.

Hi everyone,

I'm asking for help because I have no idea what to do to resolve my problem...

We are tring to set up our moodle instance (installed on a debian VM) to log in via OAuth2 with one of our applications, that is ready to do it (we use it with other apps without any problem)

I've configured moodle with correct client_id, secret, scope... and the next endpoints:

token_endpoint
authorization_endpoint
validation_endpoint

I see in the login page the button with our authentication site, so I click on it

Then, browser open our authentication app and I enter the username and password

When I return to moodle automatically, I get this error:

error/Could not upgrade oauth token

More information about this error

×Debug info:
Error code: Could not upgrade oauth token
$a contents:

×Stack trace:

line 567 of /lib/oauthlib.php: moodle_exception thrown
line 475 of /lib/oauthlib.php: call to oauth2_client->upgrade_token()
line 44 of /auth/oauth2/login.php: call to oauth2_client->is_logged_in()

But I dont find any information about this error. There is anyway to get more information about that?

My moodle version is 3.6.1

↧

Re: Issue on multiple user accounts for one person

August 22, 2019, 12:45 am

≫ Next: Re: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: Could not upgrade oauth token in custom oAuth2 config

by Visvanath Ratnaweera.

I regularly have this problem because the local administrators of an ActiveDirectory authenticated Moodle site import courses - with user data! - from their previous site which was Office365. Those users end up being manual accounts in the current Moodle with identical data as the LDAP account. Pretty confusing.

The key to understand the cause is the column 'id' of the 'user' table. The 'id' is unique. Moodle doesn't have "duplicates", they are just different accounts!

↧

Re: Could not upgrade oauth token in custom oAuth2 config

August 22, 2019, 7:31 am

≫ Next: Re: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: Re: Issue on multiple user accounts for one person

by Leon Stringer.

This error will occur if Moodle's request to the OAuth 2 service token_endpointURL fails.

The most obvious reason for this would be that the URL is wrong so check that first.

The Authenticate token requests via HTTP headers setting should normally be off(the default).

The OAuth 2 service may be logging something in response to this failed request which could help identify the problem.

The failing request causing the error comes from the Moodle web server to the OAuth 2 service (not from the browser) so if it's a Linux server with SELinux is enforcing (check with the command getenforce) you may need to allow Apache to make outgoing network connections if you're using this.

↧

Re: Could not upgrade oauth token in custom oAuth2 config

August 23, 2019, 12:57 am

≫ Next: Re: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: Re: Could not upgrade oauth token in custom oAuth2 config

by Alejandro Caminero.

Hi Leon,

Thank you very much for your answer.

I've tried it with Authenticate token requests via HTTP headers setting turned on and turned off without success in both cases. I will keep it turned off.

Where I can see the oAuth service logs? I activated moodle's debbuging and all the information that I can see in the browser is not enough. I didn't see anything in log files in the system and I don't know where I could search for it.

↧

Re: Could not upgrade oauth token in custom oAuth2 config

August 23, 2019, 4:12 am

≫ Next: SSO authentication

≪ Previous: Re: Could not upgrade oauth token in custom oAuth2 config

by Leon Stringer.

If you're managing your own OAuth 2 service then you may have access to the logs for this. If it's a third party OAuth 2 service then you may not be able to see the logs. Accessing these would be down to the specific OAuth 2 service in use (i.e. I don't know where they are).

If you're comfortable changing the Moodle source code, what I would do next is add some extra output to the error message. You could change line 567 of lib/oauthlib.php from:

            throw new moodle_exception('Could not upgrade oauth token');

to (back up up the original file before modifying):

            throw new moodle_exception('Could not upgrade oauth token. Code: '
                    . $this->info['http_code'] . ", response: " .
                    htmlentities($response));

Hopefully that will show the HTTP status code and any error returned by the OAuth 2 service.

↧

SSO authentication

August 23, 2019, 3:28 am

≫ Next: Re: SSO authentication

≪ Previous: Re: Could not upgrade oauth token in custom oAuth2 config

by Pankaj kumar.

Hi Renaat,

recently we have upgraded moodle version form 3.6 to 3.7 everything is working fine except the plugins. we have enabled SSO authentication including Zimbra email and office 365 as shown in figure.

The upgraded version not showing this both plugins. I have run cron job many times and i also checked ldap is connected to our server, all the settings are same as running server..

could you please tell me how to solve this issue. ?

↧

Re: SSO authentication

August 23, 2019, 10:26 am

≫ Next: Re: Switching to Active Directory authenticaion

≪ Previous: SSO authentication

by Gareth J Barnard.

Note: Post moved and split from another unrelated post on the courses and course formats forum.

↧

Re: Switching to Active Directory authenticaion

August 24, 2019, 5:43 am

≫ Next: OAuth2 Setup Question - LINE Login

≪ Previous: Re: SSO authentication

by Visvanath Ratnaweera.

Hi

Most likely you will have duplicate users, as discussed in
Issue on multiple user accounts for one person.

I believe, if the AD data tally with what exist in Moodle, like the 'username' field, one should be able to convert those users just by careful setting the LDAP authentication and changing the 'auth' field in the 'user' table from 'manual' to 'ldap'. You need to do some testing in a copy of your site. Read Dave's reply in the above discussion.

↧

OAuth2 Setup Question - LINE Login

August 25, 2019, 6:29 pm

≫ Next: Re: OAuth2 Setup Question - LINE Login

≪ Previous: Re: Switching to Active Directory authenticaion

by Hirokazu Inoue.

Hello,

I am trying to setup OAuth 2 login feature using LINE (https://developers.line.biz/en/docs/line-login/web/integrate-line-login-v2/) and am having problems. Maybe I am not sending the correct string. I have Facebook and Google OAuth 2 features working, but the third OAuth 2 I want to integrate from LINE is giving me some trouble. I would like some help...

I have both Client ID and Client Secret setup from the LINE side. Below is what I have from Moodle's setup.

When I click on the login link from the login page, the following page shows up-- unlike Google or Facebook which allows you to select the account under which you want to use for login.

↧

Re: OAuth2 Setup Question - LINE Login

August 26, 2019, 1:25 am

≫ Next: Re: OAuth2 Setup Question - LINE Login

≪ Previous: OAuth2 Setup Question - LINE Login

by Jon Bolton.

You need to set the service base url, which is where your line installation resides.

↧

Re: OAuth2 Setup Question - LINE Login

August 26, 2019, 8:53 am

≫ Next: Re: OAuth2 Setup Question - LINE Login

≪ Previous: Re: OAuth2 Setup Question - LINE Login

by Hirokazu Inoue.

Where do I get the URL?

↧

Re: OAuth2 Setup Question - LINE Login

August 26, 2019, 10:26 am

≫ Next: Log out is not working after Saml login

≪ Previous: Re: OAuth2 Setup Question - LINE Login

by Jon Bolton.

It should be the URL of your LINE installation.

↧

Log out is not working after Saml login

August 29, 2019, 2:22 pm

≫ Next: "The system account was not connected for offline access" Facebook

≪ Previous: Re: OAuth2 Setup Question - LINE Login

by Irith Herman.

In Moodle 3.5

After login with Saml when a user is logging out and then trying to login again It turns out that the user is still logged in.

The logout is not working/

↧

"The system account was not connected for offline access" Facebook

September 3, 2019, 9:24 am

≫ Next: Re: Office 365/Suspended Users

≪ Previous: Log out is not working after Saml login

by Đinh Giang.

Hello

I have the Moodle 3.7 stable, https enabled, Google OAuth successful, correct Facebook ID and secret

Then I receive the following message when coming back from Facebook: "The system account was not connected for offline access".

Do you have any idea why that happens? Please help.

I turned on debug and now other message showed up.

Thank you

Giang

↧

Re: Office 365/Suspended Users

September 4, 2019, 11:43 pm

≫ Next: Re: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: "The system account was not connected for offline access" Facebook

by Raymond Reid.

Have you checked the mdl_auth_oidc_token table and delete the row for the unsuspended user?

Office suite 3.6.0.1 fixes this.

We are finding that suspended users are not automatically being unsuspended even though they are active in Azure AD.

Any help much appreciated

↧

Re: Could not upgrade oauth token in custom oAuth2 config

September 5, 2019, 4:04 am

≫ Next: Re: Could not upgrade oauth token in custom oAuth2 config

≪ Previous: Re: Office 365/Suspended Users

by Alejandro Caminero.

Hi Leon,

Thanks so much for your help and sorry for the delay...

I receive this output:

Error code: Could not upgrade oauth token. Code: 400, response: {"code":400,"error":"invalid_request","message":"invalid_request","status_code":"Bad Request"}

Now I dont know who is giving that bad request and how I can be sure if the request from moodle is correct

I have full access to the oAuth app and yes, there I can see a http 400 error

Do you know how can I see the body of the request that moodle build?

↧

Re: Could not upgrade oauth token in custom oAuth2 config

September 5, 2019, 7:28 am

≫ Next: Re: Cannot edit user profiles set up via LDAP sync [Solved]

≪ Previous: Re: Could not upgrade oauth token in custom oAuth2 config

by Leon Stringer.

The 400 Bad Request response is being returned by the OAuth 2 server so it doesn't like the request from Moodle. Does the OAuth app say why it's returning the 400 error?

How can you see the request body? Try changing the line we previously modified to:

            throw new moodle_exception('Could not upgrade oauth token. Code: '
                    . $this->info['http_code'] . ", response: " .
                    htmlentities($response) .
                    "body params: " . http_build_query($params));

For example with an invalid token_endpoint on my test site I get:

error/Could not upgrade oauth token. Code: 404, response: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /local/oauth/token.php1 was not found on this server.</p> </body></html> body params: code=bb51b69898a3fd53e489986aed73d336ae8ded70&grant_type=authorization_code&redirect_uri=https%3A%2F%2Foauth20client.example.com%2Fadmin%2Foauth2callback.php&client_id=oauthclient&client_secret=5bff0b…

You can see each parameter Moodle sends in the request separated by '&' starting with "code=bb51b6…". It's a bit messy but it's a quick way to see what Moodle is sending in the request.

↧