Error 500 after the successful authentication after waiting a couple of min on the login page.

[security4java]

Hi,
I use mod_auth_openidc version "2.1.2" and Keycloak version “2.5.1”
When I open the protected application I redirected to IDP for the authentication:
https://server_ip/protected/redirect_uri?state=ZdTYbRr_NPCfn1_XfCk0kwM2K90&code=tnmBxsVj97hdhwAYdpKoNjmJGvRdi0DxeMc2lFwaQFw.dc51e496-fc56-4d21-aa84-2ee0fff35f15

I wait couple of minutes and provide correct user name and password.
After the successful authentication I get Error 500.
The errors from ssl_error_log below.
The full debug log and metatada are attached.
[Thu Feb 09 19:49:10 2017] [error] [client client_ip] oidc_restore_proto_state: state has expired, referer: https://server_ip/auth/realms/master/protocol/openid-connect/auth?response_type=code&scope=openid&client_id=httpd_server_ip&state=ZdTYbRr_NPCfn1_XfCk0kwM2K90&redirect_uri=https%3A%2F%2Fserver_ip%2Fprotected%2Fredirect_uri&nonce=56Y-arBTQ1a-
WaitOnLogin.zip
matadata.zip

bw5VMDvALKIrsirDUEB7ElyAXRMyfUk
[Thu Feb 09 19:49:10 2017] [error] [client client_ip] oidc_authorization_response_match_state: unable to restore state, referer: https://server_ip/auth/realms/master/protocol/openid-connect/auth?response_type=code&scope=openid&client_id=httpd_server_ip&state=ZdTYbRr_NPCfn1_XfCk0kwM2K90&redirect_uri=https%3A%2F%2Fserver_ip%2Fprotected%2Fredirect_uri&nonce=56Y-arBTQ1a-bw5VMDvALKIrsirDUEB7ElyAXRMyfUk
[Thu Feb 09 19:49:10 2017] [error] [client client_ip] oidc_handle_authorization_response: invalid authorization response state and no default SSO URL is set, sending an error..., referer: https://server_ip/auth/realms/master/protocol/openid-connect/auth?response_type=code&scope=openid&client_id=httpd_server_ip&state=ZdTYbRr_NPCfn1_XfCk0kwM2K90&redirect_uri=https%3A%2F%2Fserver_ip%2Fprotected%2Fredirect_uri&nonce=56Y-arBTQ1a-bw5VMDvALKIrsirDUEB7ElyAXRMyfUk

[zandbelt]

As it says here:

[Thu Feb 09 19:49:10 2017] [error] [client client_ip] oidc_restore_proto_state: state has expired, referer: <>

the state that correlates requests and responses has expired. The default for the lifespan of that state (cookie) is 5 minutes; you can tweak the setting with OIDCStateTimeout as documented here: https://github.com/pingidentity/mod_auth_openidc/blob/master/auth_openidc.conf#L621

[security4java]

I understand you, but …
I think this behavior introduce a very bad User Experience to end users.

I also understand that probably it is not bug of mod_auth_openidc but probably the problem of the OIDC protocol.

In the use case described above after the successful authentication users can do nothing:

• Users can not access application.
• Users can not logout (since the logout is protected).
• Users can not reset authentication and authenticate once again.

Users only can close a browser and open a new browser session.
It is not safe to configure the state timeout for one month since it introduce the security bridge therefore it is not the solution.
My opinion that if the state is expired the authentication should fail and the authentication process should start from the beginning.
Can RP just reset the authentication and to start the authentication from the beginning if the state is expired?
What do you say about the suggestion?

[zandbelt]

Agreed and that is (almost) how it should work now: the state should have been deleted and the user should be able to go to the original URL and restart the process.

It looks like the state cookies is correctly deleted so the user should just be able to restart the process. Doesn't that work for you?

[security4java]

In my case it is not happens.
After the authentication the request redirected to URL below:
https://server_ip/protected/redirect_uri?state=FirlrrJ-_cmfKtsLz384XQ_DTUQ&code=J20fRo274_Ni_VYtQZT2wDkfNxMB7G82Azn4mp5dGA0.fed3feac-5baa-46a4-967f-ca96c38e6a4a

Reload on the URL does not help – it remains on the same Error 500 page
See the attached log.

BTW, from my point of view it is OK if mod_auth_openidc will redirect to some specific HTTP error page (that possible to configure in the configuration).
This page will show that the authentication process too long and need to start from the beginning.

error2.zip

[zandbelt]

What you can do is set OIDCDefaultURL which is where the user will be redirected after this type of error, see: https://github.com/pingidentity/mod_auth_openidc/blob/master/auth_openidc.conf#L430

[security4java]

I continued to investigate the issue.
The problem that after the oidc_clean_expired_state_cookies error the authentication cookie (mod_auth_openidc_session) is not cleared.
Please elaborate if OIDCDefaultURL should be protected or not.
I guess it should not be protected (also it will be great if it is possible to configure it in the relative way).

The best if mod_auth_openidc_session will be cleared in case of this error ant the authentication process will be started once again.

[zandbelt]

The session cookie doesn't need to be cleared, it is just invalid. OIDCDefaultURL doesn't need to be protected, but if it is it will restart authentication.

[security4java]

No, the mod_auth_openidc_session cookie is valid.
I can access protected resources without any problems if i do it manually.
Just a request not redirected back to the resource and I see 500 error

[zandbelt]

So if you have a valid session, why would you try to authenticate again?

[security4java]

The use case is very problematic:

• It does not successful since the request does not redirected back to the original URL
• It does not fails since the mod_auth_openidc_session is valid

Should happens once of the following:

• Successful authentication while redirect back to the original URL
• Failed authentication and mod_auth_openidc_session cookie will be cleared (or invalid) and the authentication process will be started once again

[zandbelt]

I cannot parse this: "it does not successful" vs. "it does not fails" and I believe setting OIDCDefaultURL would give you a way out of the current situation.

Moreover, if you really think that waiting more than 5 minutes on a login page should be acceptable, then just increase OIDCStateTimeout.

I see the following issue myself: upon encountering an expired state cookie, there should be more information presented to the user than there is right now. I won't go as far as automatic restart since
a. it may lead to infinite loops easily
b. it may not be what the user wants (there may even be a new user behind the terminal)
a suggestion about the URL to go to may be appropriate (although POST data may have been lost etc.). Also: refreshing an error page should reproduce the error IMHO, that's not something that should change.

[security4java]

Ok, I agree with you that the authentication process should not be started once again.
But I think OIDCDefaultURL will not good for the use case.
The OIDCDefaultURL is used both for OP initiated SSO and in case of the invalid authorization response.
To solve the use case we need additional URL (let say) called OIDCErrorHandlingURL.

RP should redirect to OIDCErrorHandlingURL in case of any authorization / state / other problems.
The OIDCDefaultURL should be used for OP initiated SSO only.
In this case I can configure OIDCErrorHandlingURL for the page with appropriate error message and will logout the user.
The user (or other user) will be able to start the authentication process manually.

[zandbelt]

My point is that OP initiated SSO is not standardized and literally not used/deployed anywhere. Hence your easy way out today is to use OIDCDefaultURL.

An error URL/template exists already, that can also be customized:
https://github.com/pingidentity/mod_auth_openidc/blob/master/auth_openidc.conf#L423
the message just needs to be produced as I suggested.

And unless I still misunderstand you: the user is able to restart the authentication process today by clicking a bookmark or retyping the URL to the application; there's just not an easy way to do that from the error page which comes back to the error message displayed.

[security4java]

To start the authentication process a user should logout first.
And of course users do not remember the application logout URL :)
Therefore I will configure OIDCDefaultURL to the application logout URL with the appropriate error message.

It will solve the issue.
Thank you for your help.

[zandbelt]

No, if the use still has a valid session there's no need to logout. If the user doesn't have a valid session, the authentication flow will be restarted when the application is accessed. There's no need to remember a logout URL, there's only a need to remember/bookmark an application URL, which is how the user got to the application the first time as well.

[security4java]

But it is very very very not clear why after the successful authentication a user need press on some bookmark,

The following message is much much clearer:
“Your authentication process take a lot of time and you are logout due to security consideration.
Press here to login”.

[zandbelt]

yes, that's what I proposed