OAuth2: add same email account on other client will break it on old client

Description

reproduce on https://demo.globalqss.com

  1. log in to system and setup a OAuth2

  • provider : "Microsoft - consumers" is copy of "Microsoft" with endpoint tennal = consumers

  • Authorization Credential : outlook - personal

  • run "Add Authorization Account" add account thuysanerp@outlook.com

  1. open client system and setup email info

  • mail host : smtp.office365.com

  • port : 587

  • email: thuysanerp@outlook.com

  1. run test mail success

  2. log in to GardenWorld

  • run "Add Authorization Account" add account thuysanerp@outlook.com

  1. open client GardenWorld and setup email info

  • mail host : smtp.office365.com

  • port : 587

  • email: thuysanerp@outlook.com

  1. run test mail success

  2. back to client system and run test email, it show invalidate user/password

issue because on function MAuthorizationAccount.syncOthers
line accessToken = SecureEngine.encrypt(accessToken, getAD_Client_ID());
update access token of email on system with a encrypt version

i'm not sure why need to encrypt here
wdyt about it

Environment

None

Activity

Show:

Carlos Ruiz January 27, 2022 at 11:39 AM

Hi

I opened the untested pull request 1146 with a possible solution for this.

If possible can you test and provide feedback for this.

The thing is that the column AD_AuthorizationAccount.AccessToken can potentially be encrypted and we’re updating it via direct SQL, so it requires encryption for those cases, but the code didn’t take into account that (thanks for catching it).

There is also a potential more complex case where different tenants have different encryption keys, that’s why I changed the code to do a loop by AD_Client_ID to call the SecureEngine

Regards,

Carlos Ruiz

Fixed

Details

Assignee

Reporter

Fix versions

Affects versions

Priority

Created January 27, 2022 at 9:30 AM
Updated April 1, 2022 at 5:39 PM
Resolved February 4, 2022 at 10:28 AM