Release release 2.4.20.2 · OpenIDC/mod_auth_openidc

Features

add OIDCDebugMaskSecrets, which turns off the masking of secrets and tokens in the error/debug log that 2.4.20.1 made unconditional, so a protocol exchange can be read in full while troubleshooting. It defaults to On; setting it Off writes access, refresh and ID tokens, authorization codes and client secrets to the log in the clear whenever LogLevel is debug or higher, so a log written meanwhile must be treated as containing live credentials. It is server/virtual-host level only and cannot be relaxed per Location, and a warning is logged at every startup for as long as it is Off

Performance

cache: remove the process-local derived-object cache tier introduced in 2.4.20 and reworked in 2.4.20.1: the caches of parsed session state, flattened claim headers, parsed provider metadata, JWKs selection results and compiled Require regexes are gone, and each is computed per request again. It was worth 24-34% of the module's own CPU on a request that does no proxying -- nearly all of that the parsed-session cache alone -- which did not justify the concurrency, eviction and teardown surface it added, and the defects that came with it in both releases that carried it. A deployment proxying to a backend application is unlikely to measure a difference

Bugfixes

cache/file: do not delete a file cache entry from the read path when it is found to have expired. A writer replaces an entry by renaming a freshly written file over it and takes no lock on it, so a rename landing between finding the entry expired and unlinking it made the reader throw away the entry that had just replaced it -- for a session, a silent logout with the user sent back through authentication. Reclaiming expired entries is left to the cleaning cycle, which already did it for every entry that was never read again
cache/file: have the file cache cleaning cycle confirm an entry is still the file it inspected before removing it, so a sweep cannot unlink an entry a writer replaced in the meantime either
cache/shm: compute the shm cache's per-slot value size limit as a signed quantity, so it cannot wrap into an unbounded limit -- and overrun the slot -- if the configured slot size is ever smaller than the entry header
authz: do not retain memory for the life of the process every time a Require claim regular expression fails to compile

Commercial

commercial subscription based support for large enterprise businesses is available via sales@openidc.com
licensed binary packages for various other platforms such as Microsoft Windows, Red Hat Enterprise Linux 7, older Ubuntu and Debian distros, Oracle HTTP Server 12.x/14.x and IBM HTTP Server 9.x, are available under a commercial license and agreement via sales@openidc.com
support for Redis/Valkey over TLS, Redis/Valkey (TLS) Sentinel, and Redis/Valkey (TLS) Cluster is available under a commercial license and agreement via sales@openidc.com

The RPM packages below are signed with the following RSA PGP key:

Navigation Menu