Oauth url only loading login form

[somoit-net]

Prerequisites

• I have searched for duplicate or closed issues
• I can recreate the issue with all plugins disabled

Describe the issue

I have configured Roundcube and Authelia to authenticate via OAuth.

When clicking the button to login im redirected to Authelia server so I authenticate and get the authorization code.

That code is then sent to the callback url:

https://myroundcube.mydomain.com/index.php/login/oauth?code=authelia_ac_BXNQ7VBJvj3O_wOlleKs6iVLHJuAV_L4BC9YPZ-OfM4.e7hyF2zSNyak9Xl5pWnc0Dk5VHr7drxIrIIW5-HKA6s&iss=https%3A%2F%2Fmyauthelia.mydomain.com&scope=email+profile+openid&state=iwymuJPqwAsu

But that url simply reloads the login form.

I have checked old issues like these ones...

• 1.6.1 breaks oauth/openid token request #8878
• Oauth (xoauth) redirect uri #8191
• Oauth login redirects to login page #9652

... and i've been checking the PATH_INFO value that should be sent from the reverse proxy (Nginx).
It wasnt being sent but i have fixed Nginx config so now its sent. Confirmed it adding some code in iniset.php:

//################# ADDED ##########################
if (!empty($_SERVER['PATH_INFO']))
{
    echo("PATH_INFO is not empty:<br>");
    echo("<b>".$_SERVER['PATH_INFO']."</b><br><br>");
}
else
{
    echo("PATH_INFO is empty<br><br>");
}

if (!preg_match('!^/([a-z]+)/([a-z]+)$!', $_SERVER['PATH_INFO'], $m))
{
    echo("Regex does not match");
}
//##################################################

// translate PATH_INFO to _task and _action GET parameters
if (!empty($_SERVER['PATH_INFO']) && preg_match('!^/([a-z]+)/([a-z]+)$!', $_SERVER['PATH_INFO'], $m)) {
    var_dump($m);
    if (!isset($_GET['_task'])) {
        $_GET['_task'] = $m[1];
    }
    if (!isset($_GET['_action'])) {
        $_GET['_action'] = $m[2];
    }
}

- See image -

But the regex to get the values of task and action does not match.
An example PATH_INFO value is:

/login/oauth?code=authelia_ac_L9KzngWKNxo-kOAZojD3tDDAe0IMoj9hZBSYbEhZA3A.AshxhxcyQ-cnxZPE7WDmXQDJVD5Bc4XS_BbnLjPyyO0&iss=https%3A%2F%2Fmyauthelia.mydomain.com&scope=email+profile+openid&state=J30MJuQGlckb

Is the problem related with this?
Or could be anything else?

What browser(s) are you seeing the problem on?

Brave 1.75, Firefox 135.0.1

What version of PHP are you using?

v8.3.9

What version of Roundcube are you using?

Tested in 1.6.5 and 1.6.10

[alecpl]

Judging be the regexp used with PATH_INFO it should be just /login/oauth.

[alecpl]

For nginx I'm using:

location ~ \.php(/.+)?$ {
    #rewrite "^/[a-zA-Z0-9]{16}/(.*)$" /$1;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_index  index.php;
    #include        fastcgi_params;
    fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
    fastcgi_param  PATH_INFO $fastcgi_path_info;
    fastcgi_pass   php-fpm;
}

[somoit-net]

Hello, thank for your response!

I'd already tried configuring nginx to send only "/login/oauth" as PATH_INFO, but then it starts a continuous loop between
/api/oidc/authorize... and index.php/login/oauth...

I've managed to make it work but using a non-clean way with this code in iniset.php:

if (!empty($_SERVER['PATH_INFO']) && preg_match('!^/([a-z]+)/(.+)$!', $_SERVER['PATH_INFO'], $m)) {
    if (!isset($_GET['_task'])) {
        $_GET['_task'] = $m[1];
    }
    if (!isset($_GET['_action'])) {
        if (str_starts_with($m[2], 'oauth')) {
            $_GET['_action'] = 'oauth';
            $query_params = parse_url($m[2], PHP_URL_QUERY);
            parse_str($query_params, $params);
            $_GET['error'] = $params['error'] ?? null;
            $_GET['code'] = $params['code'] ?? null;
            $_GET['state'] = $params['state'] ?? null;
        }
        else {
            $_GET['_action'] = $m[2];
        }
    }
}

[alecpl]

How about patch like this:

--- a/program/include/iniset.php
+++ b/program/include/iniset.php
@@ -66,7 +66,7 @@ if (@file_exists(INSTALL_PATH . 'vendor/autoload.php')) {
 }
 
 // translate PATH_INFO to _task and _action GET parameters
-if (!empty($_SERVER['PATH_INFO']) && preg_match('!^/([a-z]+)/([a-z]+)$!', $_SERVER['PATH_INFO'], $m)) {
+if (!empty($_SERVER['PATH_INFO']) && preg_match('!^/([a-z]+)/([a-z]+)(\?.*)?$!', $_SERVER['PATH_INFO'], $m)) {
     if (!isset($_GET['_task'])) {
         $_GET['_task'] = $m[1];
     }