Difference between oauth.ssl_validate_server and provider.ssl_validate_server

[mschmidt72]

Hi OpenIDC Team,

In our configuration we have deactivated the SSL validation by
OIDCSSLValidateServer Off

This works fine on initial authentication and if the access token is refreshed. However, if the token is expiring or the user loggs out (on purpose) the module tries to revoke refresh token and then also the access token and both fails with:
oidc_util_http_call: curl_easy_perform() failed on: url=[our OP revoke endpoint] (SSL certificate problem: unable to get local issuer certificate)

--
with debugging on we saw then that the call has ssl_validate_server=1 activated:
oidc_util_http_call: url=[our OP revoke endpoint], data=client_id=&client_secret=[our client secret];token_type_hint=refresh_token&token=[token], content_type=application/x-www-form-urlencoded, basic_auth=null, bearer_token=(null), ssl_validate_server=1, ...

--
while for regular refreshing token it is ssl_validate=server=0 (like it is expected for OIDCSSLValidateServer Off):
oidc_util_http_call: url=[our OP access token endpoint], data=grant_type=refresh_token&refresh_token=&scope=email&client_id=[our client id]&client_secret=[our client secret], content_type=application/x-www-form-urlencoded, basic_auth=null, bearer_token=(null), ssl_validate_server=0, ...

--
So I checked there is a difference in
https://github.com/OpenIDC/mod_auth_openidc/blob/master/src/mod_auth_openidc.c#L2954
for revoking the tokens is using oauth.ssl_validate_server

while in
https://github.com/OpenIDC/mod_auth_openidc/blob/master/src/proto.c#L1801
for refreshing the tokens is using provider->ssl_validate_server

As I'm not an expert in mod_auth_openidc module nor C++ programming - I'm not sure if this is an issue or not. But the question for us is - how can we achieve that
OIDCSSLValidateServer Off
is applied in both cases (on refreshing the token and on revoking the token)

Thx for your help or any hint on this.

[zandbelt]

that is indeed an unintended side-effect of the split between OAuth 2.0 and OIDC in the module's configuration; you can use

OIDCSSLValidateServer Off
OIDCOAuthSSLValidateServer Off

see https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.14.4/auth_openidc.conf#L439-L441 for the time being and we'll look into a more comprehensive solution

FWIW: turning off SSL server certificate validation should not be used in production

[zandbelt]

actually it turned out to be a bug indeed, fixed in 7624c40

[mschmidt72]

Thx for the fast response.

So, as workaround until we use the newer version we can set additionally
OIDCOAuthSSLValidateServer Off
?

[zandbelt]

that is correct

[zandbelt]

this is now in 2.4.15 https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.15