Support for Require claim directive

[chilt-payx]

We were looking to use mod_auth_openidc as a resource server, but saw the deprecation comments in the sample config referencing this plug-in. We need to validate the audience (aud) field in our access token. Is this supported? I reviewed the sample config file provided, but did not see a way to do this.

[zandbelt]

The current state of things is that you cannot (yet) use any native Require claim aud:<> directive that you would use in mod_auth_openidc. What you can do today is inspect the OAUTH2_CLAIM_aud header value that will be sent to the backend in your application. I hope that is still a valid option for you...

[chilt-payx]

Unfortunately that will not work for our use case - we want to do the audience validation in the DMZ, which means it must be done in the web tier. Would you recommend we use mod_auth_openidc at this time? Do you expect to support this type of validation in the future?

[zandbelt]

I recommend that you use mod_auth_openidc for the time being indeed. I am turning this into a feature request.

[zandbelt]

would you be able to test the latest commit? I have added support for Require claim directives...

[chilt-payx]

would you be able to test the latest commit? I have added support for Require claim directives...

Is there an RPM installer available that I can use to install it on a test server of ours?

[zandbelt]

see: https://github.com/zmartzone/mod_oauth2/releases/tag/v3.0.1

[zandbelt]

Any luck with testing?

[chilt-payx]

Any luck with testing?

Sorry, we had a holiday weekend and I am just getting caught up from that. I should be able to run some tests tomorrow (May 31).

[zandbelt]

how did it work out?

[GRRedWings]

How do I use these claims? Is it possible to set a specific hd that I want in the jwt?

I have tried

<Location /secure>
#AllowOverride All
# Require valid-user
Require claim hd:mySite.com
AuthType oauth2
OAuth2TokenVerify jwks_uri https://www.googleapis.com/oauth2/v3/certs verify.iat=skip

[zandbelt]

you need Require oauth2_claim hd:mySite.com

[GRRedWings]

Thank you for the quick reply, is it possible to chain multiple together?

I have tried
Require oauth2_claim hd:mySite.com and email:me@mySite.com
Require oauth2_claim hd:mySite.com:oauth2_claim email:me@mySite.com

It seems to only take the last item, and the first item is ignored.

[zandbelt]

By default Apache considers this as a logical OR, in 2.4.x you can use RequireAll to create a logical AND.
See https://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#requireall In your case:

<RequireAll>
    Require oauth2_claim hd:mySite.com
    Require oauth2_claim email:me@mySite.com
</RequireAll>

[GRRedWings]

Again, thank you for the quick response! I appreciate the work you have done with this and helping those that don't have the strong understanding of Oauth & Apache that you do.