Issue

Description of problem: oidc_content_handler is not called to generate a discovery response if a ProxyPass matches the request. Version-Release number of selected component (if applicable): How reproducible: Always with default configs loading mod_proxy before mod_auth_openidc Steps to Reproduce: 1. Configure mod_auth_openidc and mod_proxy together something like below: OIDCMetadataDir /var/cache/httpd/mod_auth_openidc/metadata OIDCSSLValidateServer Off OIDCRedirectURI is a vanity URL that must point to a path protected by this module but must NOT point to any content OIDCRedirectURI http://localhost/protected OIDCCryptoPassphrase somepassword OIDCClaimPrefix "PREFIX_" <Location /protected> AuthType openid-connect Require valid-user </Location> <Location /helloworld> OIDCDiscoverURL http://localhost/protected?iss=https%3A%2F%2Flocalhost%2F AuthType openid-connect Require claim accessAllowed:true ProxyPreserveHost on ProxyPass http://localhost:8080/helloworld disablereuse=On ProxyPassReverse http://localhost:8080/helloworld </Location> 2. Attempt a /helloworld request Actual results: mod_auth_openidc defers the discovery response to be given during the handler hook: [Thu May 18 11:46:05.017987 2023] [auth_openidc:debug] [pid 121870:tid 140413968389888] src/mod_auth_openidc.c(2277): [client 127.0.0.1:44966] oidc_authenticate_user: enter [Thu May 18 11:46:05.017989 2023] [auth_openidc:debug] [pid 121870:tid 140413968389888] src/mod_auth_openidc.c(2288): [client 127.0.0.1:44966] oidc_authenticate_user: defer discovery to the content handler [Thu May 18 11:46:05.017993 2023] [auth_openidc:debug] [pid 121870:tid 140413968389888] src/mod_auth_openidc.c(4045): [client 127.0.0.1:44966] oidc_authz_checker: enter: require_args="accessAllowed:true" [Thu May 18 11:46:05.017996 2023] [authz_core:debug] [pid 121870:tid 140413968389888] mod_authz_core.c(820): [client 127.0.0.1:44966] AH01626: authorization result of Require claim accessAllowed:true: granted [Thu May 18 11:46:05.017999 2023] [authz_core:debug] [pid 121870:tid 140413968389888] mod_authz_core.c(820): [client 127.0.0.1:44966] AH01626: authorization result of <RequireAny>: granted But mod_proxy handles the request first in the hook handler phase so mod_auth_openidc does not process it: [Thu May 18 11:46:05.018020 2023] [proxy:debug] [pid 121870:tid 140413968389888] mod_proxy.c(1265): [client 127.0.0.1:44966] AH01143: Running scheme http handler (attempt 0) [Thu May 18 11:46:05.018024 2023] [proxy_ajp:debug] [pid 121870:tid 140413968389888] mod_proxy_ajp.c(764): [client 127.0.0.1:44966] AH00894: declining URL http://localhost/helloworld/ [Thu May 18 11:46:05.018027 2023] [proxy_fcgi:debug] [pid 121870:tid 140413968389888] mod_proxy_fcgi.c(1021): [client 127.0.0.1:44966] AH01076: url: http://localhost/helloworld/ proxyname: (null) proxyport: 0 [Thu May 18 11:46:05.018030 2023] [proxy_fcgi:debug] [pid 121870:tid 140413968389888] mod_proxy_fcgi.c(1024): [client 127.0.0.1:44966] AH01077: declining URL http://localhost/helloworld/ [Thu May 18 11:46:05.018041 2023] [proxy:debug] [pid 121870:tid 140413968389888] proxy_util.c(2353): AH00942: HTTP: has acquired connection for (localhost) [Thu May 18 11:46:05.018045 2023] [proxy:debug] [pid 121870:tid 140413968389888] proxy_util.c(2408): [client 127.0.0.1:44966] AH00944: connecting http://localhost/helloworld/ to localhost:80 [Thu May 18 11:46:05.018204 2023] [proxy:debug] [pid 121870:tid 140413968389888] proxy_util.c(2634): [client 127.0.0.1:44966] AH00947: connected /helloworld/ to localhost:80 [Thu May 18 11:46:05.018283 2023] [proxy:debug] [pid 121870:tid 140413968389888] proxy_util.c(3095): (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:80 (localhost) failed [Thu May 18 11:46:05.018326 2023] [proxy:error] [pid 121870:tid 140413968389888] (13)Permission denied: AH00957: HTTP: attempt to connect to 127.0.0.1:80 (localhost) failed [Thu May 18 11:46:05.018333 2023] [proxy_http:error] [pid 121870:tid 140413968389888] [client 127.0.0.1:44966] AH01114: HTTP: failed to make connection to backend: localhost Expected results: discovery response comes from mod_auth_openidc in the handler hook: [Thu May 18 11:50:44.614402 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(626): [client 127.0.0.1:58214] oidc_get_current_url: current URL 'http://localhost/helloworld/' [Thu May 18 11:50:44.614404 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/mod_auth_openidc.c(2277): [client 127.0.0.1:58214] oidc_authenticate_user: enter [Thu May 18 11:50:44.614407 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/mod_auth_openidc.c(2288): [client 127.0.0.1:58214] oidc_authenticate_user: defer discovery to the content handler [Thu May 18 11:50:44.614413 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/mod_auth_openidc.c(4045): [client 127.0.0.1:58214] oidc_authz_checker: enter: require_args="accessAllowed:true" [Thu May 18 11:50:44.614416 2023] [authz_core:debug] [pid 122794:tid 140048650852096] mod_authz_core.c(820): [client 127.0.0.1:58214] AH01626: authorization result of Require claim accessAllowed:true: granted [Thu May 18 11:50:44.614418 2023] [authz_core:debug] [pid 122794:tid 140048650852096] mod_authz_core.c(820): [client 127.0.0.1:58214] AH01626: authorization result of <RequireAny>: granted [Thu May 18 11:50:44.614447 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(1388): [client 127.0.0.1:58214] oidc_util_request_matches_url: comparing "/helloworld/"=="/protected" [Thu May 18 11:50:44.614455 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/mod_auth_openidc.c(2120): [client 127.0.0.1:58214] oidc_discovery: enter [Thu May 18 11:50:44.614459 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(2521): [client 127.0.0.1:58214] oidc_util_hdr_in_get: Host=localhost [Thu May 18 11:50:44.614462 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(2521): [client 127.0.0.1:58214] oidc_util_hdr_in_get: Host=localhost [Thu May 18 11:50:44.614466 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(626): [client 127.0.0.1:58214] oidc_get_current_url: current URL 'http://localhost/helloworld/' [Thu May 18 11:50:44.614471 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/proto.c(75): [client 127.0.0.1:58214] oidc_proto_generate_random_bytes: apr_generate_random_bytes call for 8 bytes [Thu May 18 11:50:44.614534 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/proto.c(77): [client 127.0.0.1:58214] oidc_proto_generate_random_bytes: apr_generate_random_bytes returned [Thu May 18 11:50:44.614594 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/mod_auth_openidc.c(2158): [client 127.0.0.1:58214] oidc_discovery: redirecting to external discovery page: http://localhost/protected?iss=https%3A%2F%2Flocalhost%2Fauth%2Frealms%2FInternalApps&target_link_uri=http%3A%2F%2Flocalhost%2Fhelloworld%2F&method=get&oidc_callback=http%3A%2F%2Flocalhost%2Fprotected&x_csrf=HuH603-hy8w [Thu May 18 11:50:44.614600 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(1112): [client 127.0.0.1:58214] oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found [Thu May 18 11:50:44.614608 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(2599): [client 127.0.0.1:58214] oidc_util_hdr_err_out_add: Set-Cookie: x_csrf=HuH603-hy8w; Path=/; HttpOnly [Thu May 18 11:50:44.614612 2023] [auth_openidc:debug] [pid 122794:tid 140048650852096] src/util.c(2577): [client 127.0.0.1:58214] oidc_util_hdr_table_set: Location: http://localhost/protected?iss=https%3A%2F%2Flocalhost%2Fauth&target_link_uri=http%3A%2F%2Flocalhost%2Fhelloworld%2F&method=get&oidc_callback=http%3A%2F%2Flocalhost%2Fprotected&x_csrf=HuH603-hy8w Additional info: The oidc response should come from the oidc_content_handler while the proxied response would come from the proxy_handler. Checking source of these modules show the oidc_content_handler registered as APR_HOOK_FIRST: https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.9.4/src/config.c#L2726 And so is the proxy_handler: https://github.com/apache/httpd/blob/trunk/modules/proxy/mod_proxy.c#L3463 So a workaround is to adjust the proxy conf files so that those module files are loaded after /etc/httpd/conf.modules.d/10-auth_openidc.conf and mod_auth_openidc is then called before mod_proxy in the handler hook phase: $ mv /etc/httpd/conf.modules.d/00-proxy.conf /etc/httpd/conf.modules.d/20-proxy.conf $ mv /etc/httpd/conf.modules.d/10-proxy_h2.conf /etc/httpd/conf.modules.d/30-proxy_h2.conf Would we consider adjusting the order between the mod_auth_openidc and proxy conf files loading these modules? Or switching mod_auth_openidc to be earlier as APR_HOOK_REALLY_FIRST in the handler hook?

Release Notes

No. of Comments

Resolution

Unresolved