Error in oidc_util_create_symmetric_key

[wetzel-desy]

Hi,

I am running mod_auth_openidc and today encountered the following error during authentication:

src/util.c(2169): [client XXX] oidc_util_create_symmetric_key: key_len=30 free(): invalid pointer

Before I did a system update yesterday, the module worked as intended, has this happened to anyone else?
If you nee more info, please let me know.

Cheers and thanks,
Tim

[zandbelt]

which version are you on? also, please provide full server debug logs

[zandbelt]

have you set OIDCCryptoPassphrase?

[wetzel-desy]

Yes, it is set.

[zandbelt]

please paste your config

[wetzel-desy]

LoadModule auth_openidc_module /usr/lib/apache2/modules/mod_auth_openidc.so

OIDCRedirectURI [redacted]
OIDCCryptoPassphrase [redacted]

# protected locations
<Location /oidc-redirect>
  AuthType openid-connect
  Require valid-user
</Location>

# OAuth2.0 client data
OIDCOAuthClientID [redacted]
OIDCOAuthClientSecret [redacted]
OIDCOAuthVerifyJwksUri https://[redacted]/oauth2/jwk

OIDCOAuthIntrospectionEndpointAuth client_secret_basic

# cache encryption
OIDCCacheEncrypt On

[zandbelt]

it does not ring a bell but I suspect it has to do with the access token contents itself; if you could send a sample access token and the contents of the OIDCOAuthVerifyJwksUri to me in DM I will try and reproduce

[zandbelt]

Ok, I reproduced and fixed here: fdbd131

as an OAuth 2.0 client you're not supposed to access paths a that are configured as an OIDC RP (AuthType openid-connect), but you should only access paths configured with AuthType oauth20; if course a crash should prevented, so that is fixed, but basically your path was wrongly configured

[wetzel-desy]

Oh, that was quick, thanks! I will try it with the new version and let you know how it turned out.

[wetzel-desy]

Now it works again for me. Thanks a lot for the quick action!

[vlafranca]

Hi, how to use the new update do I need to compile the package manually ? Not seems to be published in apt registry

[zandbelt]

there's no need to install a version that contains the fix to prevent the crash, you can just as wel fix your configuration

[vlafranca]

As soon as I activate the module openidc even if not configured for any virtual host I get a segfault on a particular route which is using guzzle PHP ... If I disable openidc all is working fine, any clue ? Le sam. 30 janv. 2021 à 03:05, Hans Zandbelt <notifications@github.com> a écrit :

…

there's no need to install a version that contains the fix to prevent the crash, you can just as wel fix your configuration — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#529 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AB2NUS4XS6DB4V7ENHA54P3S4O4UZANCNFSM4WXBJAZA> .