Hi all,

I am running LimeSurvey Community Edition  Version 7.0.0+260526 on an Ubuntu server. I am trying to get login using OpenID Connect to work. The IDM is kanidm. The plugin I use is AuthOAuth2 (version 1.4.5).

I've configured the plugin and while I am correctly redirected to the IDM (and there is no error in the log there, I still see an error message "Incorrect username and/or password!" But only when I use only one scope.

Because the only problem (bug?) I noticed with the plugin is that if I set more than one scope (usually "openid, email, profile" is needed) there seems to be a problem with how the scope is URL-encoded (?) because I see a regex matching error in the kanidm log between the requested and offered scopes.

My questions:
1) Does someone of you also use LimeSurvey together with kanidm and could tell me the specific configuration settings for the plugin?

2) What's the best way to debug this?

Before you do any more testing, update to the latest version of LS7 which should be LS7.0.5+260623.

If the error persists, then you can go search how to debug.

I've upgraded to the latest version but the problem persists, unfortunately.

Good, then one factor is already excluded. Now it makes sense to start troubleshooting.

Let's see if someone has experience with setting up OpenId, because I don't.

The plugin I use is AuthOAuth2 (version 1.4.5).

Is this a Limesurvey Plugin? Is it made for LS 7?

Yes, it's this plugin. Unfortunately not updated since 5 years but it seems it's the only available OpenID Connect plugin (at least I couldn't find a better/more recent one):  github.com/BDSU/limesurvey-oauth2

It was not originally developed for LS7 but in the issues people managed to get it working with this version.

Wait - I just found this (apparently newer) version:  github.com/ulysseus-eu/limesurvey-oauth2
No idea how I could have missed this so far. Maybe I should try this first before digging deeper into the problem.

I'll report back 

Update: It works. Not the new version of the plugin but even the "old" one.

For anybody else struggling with this:
The "trick" was to set space (as in using the spacebar) as the scope separator for the URL in the plugin configuration (how stupid). As scopes I set (in this order) and as "Identifier Attribute" I set "E-Mail".