How to setup oauth2 SSO using auth-backends plugin

Site Operators
1

Hello everyone,
I’m trying to connect my own marketing site to my open edx instance using auth-backends.
I’ve added an application and set these values on my site:

INSTALLED_APPS = INSTALLED_APPS + ['social_django']

# Generic OAuth2 variables irrespective of SSO/backend service key types.
OAUTH2_PROVIDER_URL = 'http://edx.devstack.lms:18000/oauth2'

# OAuth2 variables specific to social-auth/SSO login use case.
SOCIAL_AUTH_EDX_OAUTH2_KEY = "mktg-client-id"
SOCIAL_AUTH_EDX_OAUTH2_SECRET = "mktg-client-secret"
SOCIAL_AUTH_EDX_OAUTH2_URL_ROOT = "http://localhost:18000"
SOCIAL_AUTH_EDX_OAUTH2_PUBLIC_URL_ROOT = "http://localhost:18000"
SOCIAL_AUTH_REDIRECT_IS_HTTPS = False
SOCIAL_AUTH_STRATEGY = "auth_backends.strategies.EdxDjangoStrategy"

AUTHENTICATION_BACKENDS = (
    'auth_backends.backends.EdXOAuth2',
    'django.contrib.auth.backends.ModelBackend',
)

Now when I reach the LMS and login, it redirects me to my site with this parameter included in the query string:

error=invalid_scope

I didn’t define any scope in my settings. Requested scopes is by default: user_id+profile+email

Any help is really appreciated

1 Like
2

Could you kindly tell me that which version of auth-backends plugin can I use to connect my django site to an ironwood.master instance of Open edX?

3

Hi @mahyard were you able to find out where the scopes are defined?

4

Hi @Gaurav_Ojha
I wasn’t able to find out. I guess there was a problem with my instance version (ironwood.master) and in a small try to upgrade to master I was unsuccessful again. finally I fall back to the old method (OIDC) but it may be fixed on master now.
tell us about your experience.

5

Actually I didn’t find success even the OIDC way. I’m actually trying to make the credentials service to work and the error is same as what you received i.e. invalid_scope.

The ecommerce and insights services work fine with OIDC

6

@mahyard @Gaurav_Ojha did you both manage to solve this issue?

7

No @oma0256 I gave up!

8

hi @oma0256
I had no activity on this since my last reply

9

I faced same issues and found some solution :slight_smile:
Open you OAuth provider ( which is lms in edx case) and open https://xxxx.com/admin/oauth_dispatch/applicationaccess/ and set scope user_id,profile,email and it works correctly then after.

5 Likes
10

Ah, perfect! I had the same problem. And in my case, all I had to put in the scope field in OAuth Dispatch was user_id.

1 Like
11

You can add this directly to fix you error
go to mysql bash and add this to oauth_dispatch_applicationaccess table

INSERT INTO oauth_dispatch_applicationaccess VALUES (1,‘user_id’,2,NULL),(2,‘user_id’,3,NULL),(3,‘user_id’,4,NULL),(4,‘user_id’,5,NULL),(5,‘user_id’,6,NULL),(6,‘user_id’,7,NULL),(7,‘user_id’,8,NULL),(8,‘user_id’,9,NULL),(9,‘user_id’,10,NULL),(10,‘user_id’,11,NULL),(11,‘user_id’,12,NULL),(12,‘user_id’,13,NULL);