Inrupt doesn't work with Community Solid Server

[joeitu]

context

I'm trying to create a CSS recipe that uses PodBrowser as a CSS UI, I'm trying to run PodBrowser as a client-side app by exporting it in static HTML files.

step to reproduce

1. git clone the repo, npm install
2. npm run build
3. cd out/
4. python3 -m http.server 8001

Now on a browser go to http://localhost:8001, the PodBrowser index page should display normally.

I'll try to login to with my CSS instance host on localhost:3000 so I enter this address in the correct input and click GO

Expected behaviour

Login to CSS

Acutal behaviour

Stay on the index page and got two errors in the console:

    at new e (oidc-client.min.js:1:20295)
    at oidc-client.min.js:1:25906
    at async t.default.handle (AuthorizationCodeWithPkceOidcHandler.js:32:19)
    at async t.default.login (ClientAuthentication.js:16:153)
    at async login (Session.js:47:13)
    at async login (index.js:246:9)

[HsinhungLin]

It seems that Inrupt Pod Browser can't login to the pod created on CSS.

[joeitu]

I have tried CSS v2 and v3 and got the same result. Any idea how this can be fixed?

[joeitu]

Actually, It doesn't work with any of the "Sign in with other provider" options, bu tit work with the default Pod Space Sign In button

[HsinhungLin]

Since PodBrowser supports NSS. I think the problem is somehow about authentication like DPOP or something.
Unfortunately, still don't know how to fix it. Just find this sample about how to modified the authentication to DPOP that compatible with CSS 3.0.0.
https://github.com/jeff-zucker/solid-file-client/blob/master/docs/examples/upload/upload.js

[joeitu]

Form package.json I can see that Pod Browser uses Inrupt auth library, which is supposed to be compatible with CSS 2 and 3. Or perhaps it is a too old version?

[HsinhungLin]

For now, I can login to pod created in solidweb.me, however it shows nothing as follows

[joeitu]

Yes, actually the issue seems to be that is it not compatible with CSS yet. Maybe the core devs @ThisIsMissEm @daytonn @VirginiaBalseiro knows more about it?

[ThisIsMissEm]

Yes, actually the issue seems to be that is it not compatible with CSS yet. Maybe the core devs @ThisIsMissEm @daytonn @VirginiaBalseiro knows more about it?

Hi! There is a known issue that is that CSS doesn't include the correct scopes supported by default or in certain configurations doesn't. PodBrowser is still affected by that bug that was recently fixed in solid-client-authn-js; We need to upgrade the dependencies here, but there's been some complication in that.

[ThisIsMissEm]

Also, Pod Browser's localhost client_id is set to only allow :3000 as being where Pod Browser is, see: https://github.com/inrupt/pod-browser/blob/main/clientid.json

[joeitu]

there is a known issue that is that CSS doesn't include the correct scopes supported by default or in certain configurations doesn't. PodBrowser is still affected by that bug that was recently fixed in solid-client-authn-js; We need to upgrade the dependencies here, but there's been some complication in that.

So if I understand correctly the issue comes from Pod browser not using an updated version of solid-client-authn-js. But is there also some things to be fixed also on CSS side?

[ThisIsMissEm]

CSS either skips the scopes_supported header, or still has webid in the scopes supported despite not supporting that scope (my bad, I gave a bad recommendation by accident). We do need to upgrade the SDKs on Pod Browser, but as mentioned there were complications — last time I tried it the other week, it generated a 32k line diff and broke the build toolchain; I'm currently emphasising merging #440 first.

[ThisIsMissEm]

But there will likely be an issue due to the port mismatch in the redirectUrls of the client_id as pod-browser without any changes expects to run on port 3000

[ThisIsMissEm]

I can verify that going to https://podbrowser.inrupt.com and logging in with solidcommunity.net now works, as they no longer have the webid scope in their advertised scopes_supported list.

You can check this with:

curl -X 'GET' -H 'Accept: application/json' -L -v 'http://solidcommunity.net/.well-known/openid-configuration' | jq '.scopes_supported'

(alternatively swap in your own servers' URL there and check that you don't have webid as a scope if you're on CSS or NSS, as those don't actually support that scope afaik).

As for logging in from a locally hosted podbrowser instance, that could be more complicated due to how the login flow works with the redirect URL setup — running on localhost outside of what our development setup is isn't actively supported right now, and there's likely rough edges.

[joeitu]

When running the curl command I get the answer:

[
  "openid",
  "profile",
  "offline_access"
]

On CSS v2

As for logging in from a locally hosted podbrowser instance, that could be more complicated due to how the login flow works with the redirect URL setup — running on localhost outside of what our development setup is isn't actively supported right now, and there's likely rough edges.

Would using ngrok bipass this issue?