If you changed the user Status to Blocked the token is getting expired, this is working fine but the problem is - if you regenerate the token for that blocked user again, it's proving valid token and user can access to the site. Awaiting for your suggestion, thanks in advance.

CommentFileSizeAuthor
#18 simple_oauth-blocked-user-2976463-18.patch839 bytesumed91
#12 simple_oauth-blocked-user-2976463-12.patch715 bytesel7cosmos
#4 simple_oauth-blocked-user-2976463.patch800 bytesjyoti.singh

Comments

Rajandro created an issue. See original summary.

rajandro’s picture

rajandro commented
Title: Blocked user Barear token regeneration issue » Blocked user Bearer token regeneration issue
Issue summary: View changes
e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

I think that a failing test would help move this forward.

jyoti.singh’s picture

jyoti.singh commented
StatusFileSize
new simple_oauth-blocked-user-2976463.patch800 bytes

There can be two solutions here :

  • Get the user from Drupal and check for its status while generating OAuth Token
  • Check the user status in Authentication Provider file as its already loads the user from class TokenAuthUser

Attaching a patch for the second method.

jyoti.singh’s picture

jyoti.singh commented
Status: Needs work » Needs review
msankhala’s picture

msankhala commented
Status: Needs review » Needs work
Issue tags: +Need tests

Patch looks good. Its good to have a test case for this to ensure that this does not break anything.

  • e0ipso committed 7e44a34 on 8.x-3.x authored by jyoti.singh 
    Issue #2976463 by jyoti.singh, Rajandro, e0ipso, msankhala: Blocked user...
e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented
Status: Needs work » Fixed

Merged! Thanks for the contribution.

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented
Status: Fixed » Active

Setting back to Active so someone can add tests to this.

Thanks!

el7cosmos’s picture

el7cosmos
Primary language Indonesian
Location 🇮🇩 GMT+7
commented
Status: Active » Needs work

This prevent consumer with anoymous user (uid 0) to authenticate. There are some cases where a consumer didn't need an authenticated user, eg for client_credentials, and only looks for consumer roles.

e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented

@el7cosmos will you be able to provide a patch to fix this?

el7cosmos’s picture

el7cosmos
Primary language Indonesian
Location 🇮🇩 GMT+7
commented
Status: Needs work » Needs review
StatusFileSize
new simple_oauth-blocked-user-2976463-12.patch715 bytes

@e0ipso I can limit the check to authenticated user only, is that enough?

  • e0ipso committed 52a8e4e on 8.x-3.x authored by el7cosmos 
    Issue #2976463 by jyoti.singh, el7cosmos, e0ipso, Rajandro, msankhala:...
e0ipso’s picture

e0ipso
Primary language Catalan
Location Can Picafort
commented
Status: Needs review » Fixed

Thanks for the fix @el7cosmos!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.

Anonymous’s picture

Anonymous (not verified) commented

Could a new release be made which includes this patch? Upgrading to the latest dev version worked for me so that anonymous web service calls didn't log incorrect warnings, but it took me some time to figure out that this was what was causing the issue, since the ticket description isn't about that specifically. It would be nice if a new release was created so that people who usually install the latest stable version, like me, don't need to spend an hour or more tracking down the source of the errors.

In any case, though, thanks for the patch!

rajandro’s picture

rajandro commented
umed91’s picture

umed91 commented
StatusFileSize
new simple_oauth-blocked-user-2976463-18.patch839 bytes

I am still getting the above mentioned error and here is a simple patch to deny blocked users getting access token.

franckylfs’s picture

franckylfs commented

@umed91, thanks for the patch, it works fine. I had to adapt it a bit to use email instead of username, but still.

I think you should reopen a new ticket referencing this one so that a follow up can be done