Redirect issue with sample google configuration #7

wstrange · 2014-05-16T18:37:29Z

This could be an issue with my configuration

I am attempting to configure google as the OIDC provider. Using the 1.2 release on Ubuntu 14.04.

It kind of works, but has odd behaviour:

open https://www.example.com:1443/example
Get redirected to google, go through the consent dance..
Get redirected back to https://www.example.com:1443/example/redirect_uri

It simply hangs at this point - on both firefox and chrome.

However - if I let it timeout, and then reload the /example page - it comes up OK!, and I can see that the oidc cookie is set.

I tried fiddling with the redirect url (/redirect_uri with and without trailing /) but that did not make a difference. So it appears that the odic module processes the assertion OK from google- but gets hung up trying to redirect back the original URL.

Here is my config

OIDCProviderIssuer accounts.google.com
OIDCProviderAuthorizationEndpoint https://accounts.google.com/o/oauth2/auth?approval_prompt=force
OIDCProviderTokenEndpoint https://accounts.google.com/o/oauth2/token
OIDCProviderTokenEndpointAuth client_secret_post
OIDCProviderUserInfoEndpoint https://www.googleapis.com/plus/v1/people/me/openIdConnect
OIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs

OIDCClientID 431631896232-kdioacia46qnhv0uvp8rfh6es9t6rbp5.apps.googleusercontent.com
OIDCClientSecret XXXXXXXXXXXXXX

OIDCScope "openid email profile"
OIDCRedirectURI https://www.example.com:1443/example/redirect_uri
OIDCCryptoPassphrase password

<Location /example/>
Authtype openid-connect
require valid-user

wstrange · 2014-05-16T19:26:35Z

Note: Looks like some of the angle brackets got stripped when I pasted the apache config. They are present

jimfox · 2014-05-16T20:08:21Z

Couple of things you might try:

Make sure the redirect url is protected by the module.
Set the cookie path to /, e.g.

  OIDCCookiePath /

Otherwise only the return url path sees it.

Jim

On Fri, 16 May 2014, Warren Strange wrote:

Date: Fri, 16 May 2014 11:37:30 -0700
From: Warren Strange notifications@github.com
To: pingidentity/mod_auth_openidc mod_auth_openidc@noreply.github.com
Reply-To: pingidentity/mod_auth_openidc
<reply+i-33699049-2efe93b35f74a1fc6d40e8f2bbb46f7f0b064dd5-5649383@reply.g
ithub.com>
Subject: [mod_auth_openidc] Redirect issue with sample google configuration
(#7)

This could be an issue with my configuration

I am attempting to configure google as the OIDC provider. Using the 1.2 release on Ubuntu 14.04.

It kind of works, but has odd behaviour:

open https://www.example.com:1443/example

Get redirected to google, go through the consent dance..

Get redirected back to https://www.example.com:1443/example/redirect_uri

It simply hangs at this point - on both firefox and chrome.

However - if I let it timeout, and then reload the /example page - it comes up OK!, and I can see that the oidc cookie is set.

I tried fiddling with the redirect url (/redirect_uri with and without trailing /) but that did not make a difference. So it appears that the odic
module processes the assertion OK from google- but gets hung up trying to redirect back the original URL.

Here is my config

OIDCProviderIssuer accounts.google.com
OIDCProviderAuthorizationEndpoint https://accounts.google.com/o/oauth2/auth?approval_prompt=force
OIDCProviderTokenEndpoint https://accounts.google.com/o/oauth2/token
OIDCProviderTokenEndpointAuth client_secret_post
OIDCProviderUserInfoEndpoint https://www.googleapis.com/plus/v1/people/me/openIdConnect
OIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs

OIDCClientID 431631896232-kdioacia46qnhv0uvp8rfh6es9t6rbp5.apps.googleusercontent.com
OIDCClientSecret XXXXXXXXXXXXXX

OIDCScope "openid email profile"
OIDCRedirectURI https://www.example.com:1443/example/redirect_uri
OIDCCryptoPassphrase password

Authtype openid-connect
require valid-user

—
Reply to this email directly or view it onGitHub.[5649383__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxNTg4NDY1MCwiZGF0YSI6eyJpZCI6MzI0MzIzMjB9fQ==--df4f86e67110fc376b4929a2b4351d
e9ff785a55.gif]

zandbelt · 2014-05-16T20:25:27Z

I run it on Ubuntu 14.04 ok, apache 2.4.7-1ubuntu4, but have to say it is the trunk so it differs from 1.2; can you enable the debug logs try trunk and send the output to me?

zandbelt · 2014-05-16T20:27:11Z

Jim, I will fix the sample config on the cookie path

wstrange · 2014-05-16T20:53:12Z

I get
Syntax error on line 15 of /etc/apache2/conf-enabled/auth_google.conf:

OIDCCookiePath not allowed here

So I assume that is a newer feature?

On Fri, May 16, 2014 at 2:27 PM, Hans Zandbelt notifications@github.comwrote:

Jim, I will fix the sample config on the cookie path

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/7#issuecomment-43375693
.

jimfox · 2014-05-16T20:58:39Z

I get
Syntax error on line 15 of /etc/apache2/conf-enabled/auth_google.conf:

OIDCCookiePath not allowed here

It can't go in the main section. I do like this (/oidc-return/ is my return url)

<Location /oidc-return/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

I don't protect the entire site. That's always a bad idea. I use

<Location /oidc/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

to protect the content at /oidc/...

Jim

jimfox · 2014-05-16T21:04:10Z

Hans,

Seems like OIDCCookiePath and OIDCCookie could be RSRC_CONF as well as ACCESS_CONF|OR_AUTHCFG.

Most sites I expect would use just one setting for both of them.

Jim

On Fri, 16 May 2014, Hans Zandbelt wrote:

Date: Fri, 16 May 2014 13:27:10 -0700
From: Hans Zandbelt notifications@github.com
To: pingidentity/mod_auth_openidc mod_auth_openidc@noreply.github.com
Cc: jimfox fox@washington.edu
Reply-To: pingidentity/mod_auth_openidc
<reply+i-33699049-2efe93b35f74a1fc6d40e8f2bbb46f7f0b064dd5-5649383@reply.g
ithub.com>
Subject: Re: [mod_auth_openidc] Redirect issue with sample google
configuration (#7)

Jim, I will fix the sample config on the cookie path

—
Reply to this email directly or view it onGitHub.[5649383__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxNTg5MTIzMCwiZGF0YSI6eyJpZCI6MzI0MzIzMjB9fQ==--307678e5c390a80ac257688c37f310
dd7ab6f636.gif]

zandbelt · 2014-05-16T21:06:08Z

agreed, I will patch it separately; also curious if using OIDCCookiePath in its current form solves this issue

wstrange · 2014-05-16T21:07:19Z

Apache does not complain anymore - but I get the same behaviour. Hangs
until timeout, but then I can reload the page and it works.

I see the oidcstate cookie now (based on your example).
This is my config:

OIDCProviderIssuer accounts.google.com

OIDCProviderAuthorizationEndpoint
https://accounts.google.com/o/oauth2/auth?approval_prompt=force

OIDCProviderTokenEndpoint https://accounts.google.com/o/oauth2/token

OIDCProviderTokenEndpointAuth client_secret_post

OIDCProviderUserInfoEndpoint
https://www.googleapis.com/plus/v1/people/me/openIdConnect

OIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs

OIDCClientID
431631896232-kdioacia46qnhv0uvp8rfh6es9t6rbp5.apps.googleusercontent.com

OIDCClientSecret XXXXXX

OIDCScope "openid email profile"

OIDCRedirectURI https://www.example.com:1443/example/redirect_uri

OIDCCryptoPassphrase password

OIDCCookiePath /

OIDCCookie oidcstate

Authtype openid-connect

require valid-user

On Fri, May 16, 2014 at 2:58 PM, jimfox notifications@github.com wrote:

I get
Syntax error on line 15 of /etc/apache2/conf-enabled/auth_google.conf:

OIDCCookiePath not allowed here

It can't go in the main section. I do like this (/oidc-return/ is my
return url)

<Location /oidc-return/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

I don't protect the entire site. That's always a bad idea. I use

<Location /oidc/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

to protect the content at /oidc/...

Jim

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/7#issuecomment-43378710
.

jimfox · 2014-05-16T21:11:25Z

With your redirect URL you would want locationmatch, i.e.

<LocationMatch /example/>
OIDCCookiePath /
OIDCCookie oidcstate
Authtype openid-connect
require valid-user

or else

<Location /example/redirect_uri>
...

Jim

On Fri, 16 May 2014, Warren Strange wrote:

Date: Fri, 16 May 2014 14:07:19 -0700
From: Warren Strange notifications@github.com
To: pingidentity/mod_auth_openidc mod_auth_openidc@noreply.github.com
Cc: jimfox fox@washington.edu
Reply-To: pingidentity/mod_auth_openidc
<reply+i-33699049-2efe93b35f74a1fc6d40e8f2bbb46f7f0b064dd5-5649383@reply.g
ithub.com>
Subject: Re: [mod_auth_openidc] Redirect issue with sample google
configuration (#7)

Apache does not complain anymore - but I get the same behaviour. Hangs
until timeout, but then I can reload the page and it works.

I see the oidcstate cookie now (based on your example).
This is my config:

OIDCProviderIssuer accounts.google.com

OIDCProviderAuthorizationEndpoint
https://accounts.google.com/o/oauth2/auth?approval_prompt=force

OIDCProviderTokenEndpoint https://accounts.google.com/o/oauth2/token

OIDCProviderTokenEndpointAuth client_secret_post

OIDCProviderUserInfoEndpoint
https://www.googleapis.com/plus/v1/people/me/openIdConnect

OIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs

OIDCClientID
431631896232-kdioacia46qnhv0uvp8rfh6es9t6rbp5.apps.googleusercontent.com

OIDCClientSecret XXXXXX

OIDCScope "openid email profile"

OIDCRedirectURI https://www.example.com:1443/example/redirect_uri

OIDCCryptoPassphrase password

<Location /example/>

OIDCCookiePath /

OIDCCookie oidcstate

Authtype openid-connect

require valid-user

On Fri, May 16, 2014 at 2:58 PM, jimfox notifications@github.com wrote:

I get
Syntax error on line 15 of /etc/apache2/conf-enabled/auth_google.conf:

OIDCCookiePath not allowed here

It can't go in the main section. I do like this (/oidc-return/ is my
return url)

<Location /oidc-return/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

I don't protect the entire site. That's always a bad idea. I use

<Location /oidc/>
Authtype openid-connect
OIDCCookie oidcstate
OIDCCookiePath /
require valid-user

to protect the content at /oidc/...

Jim

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/7#issuecomment-43378710
.

—
Reply to this email directly or view it onGitHub.[5649383__eyJzY29wZSI6Ik5ld3NpZXM6QmVhY29uIiwiZXhwaXJlcyI6MTcxNTg5MzYzOSwiZGF0YSI6eyJpZCI6MzI0MzIzMjB9fQ==--650be188848bf4e2391bd25138db29
4da6225a71.gif]

wstrange · 2014-05-19T18:28:50Z

Still getting this error.

I have tried a bunch of different combinations of the above Location and LocationMatch, and they have the same issue. I am now using the latest build (from source).

One thing I see in the Apache logs is:
redirecting to original url: https://www.example.com:1443:1443/example2/index.html,

So the redirect URL is getting messed up (note the extra :1443). Are you guys doing your testing with default http ports? (:80 :443?).

Firefox eventual times out with a "Corrupted Content" error. Reloading the original page works (i.e. the cookie is getting set just fine, protected access works).

This is not a show stopper for me right now - so not a big deal.

zandbelt · 2014-05-19T21:56:49Z

indeed using a non-standard port was the problem and is fixed in 1d9dada; please see if that solves it for you

wstrange · 2014-05-19T22:28:01Z

Yup - that fixed the problem.

Thanks Hans

wstrange closed this as completed May 19, 2014

ultimoamore mentioned this issue Oct 31, 2017

mod_auth_openidc Segfaults Apache with 2.1.6 & 2.3.1-2 (but not 1.6) #306

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Redirect issue with sample google configuration #7

Redirect issue with sample google configuration #7

wstrange commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

zandbelt commented May 16, 2014

zandbelt commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

jimfox commented May 16, 2014

zandbelt commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

wstrange commented May 19, 2014

zandbelt commented May 19, 2014

wstrange commented May 19, 2014

Redirect issue with sample google configuration #7

Redirect issue with sample google configuration #7

Comments

wstrange commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

zandbelt commented May 16, 2014

zandbelt commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

jimfox commented May 16, 2014

zandbelt commented May 16, 2014

wstrange commented May 16, 2014

jimfox commented May 16, 2014

wstrange commented May 19, 2014

zandbelt commented May 19, 2014

wstrange commented May 19, 2014