Connect application to two providers #791

markooslaj · 2022-02-14T14:41:17Z

markooslaj
Feb 14, 2022

We are trying to connect our application to two different OP providers. (OKTA)
Our application has two login point, one for the customers and one for admins.
The application is running on one subdomain with one virtual host, the only way we can separate the logins in Apache config is by Location.
What we want to achieve is when a user comes to one location, let’s say /users, he will be redirected to one OKTA login for users and when an admin comes to /admin he will be redirected to the OKTA login page for admins.
As stated in the wiki, you must use the .conf, .provider, .client files for the configuration by multiple OPs.
We did that, but the redirect aren’t working.

<VirtualHost _default_:443>
        ServerName sub.domain.net:443
        RedirectMatch 302 ^/$ https://sub.domain.net/external
 
                OIDCMetadataDir /etc/httpd/conf.d/openidcmetadata/metadata
                OIDCProviderTokenEndpointAuth client_secret_basic
                OIDCCryptoPassphrase some-crypto-pass
                OIDCRedirectURI https://sub.domain.net/authorization-code/callback
                OIDCRemoteUserClaim otrs_username
                OIDCSessionInactivityTimeout 5600
 
                <Location "/chat">
                        Order deny,allow
                        Deny from all
                </Location>
 
                <Location "/authorization_code">
                        AuthType openid-connect
                        Require valid-user
                </Location>
 
                <Location “/users”>
                                AuthType openid-connect
                                #Require valid-user
                                OIDCDiscoverURL https://sub.domain.net/authorzation-code/callback?iss=https%3A%2F%2FfirstOP.com
                                Require claim iss:https://firstop.com/
                                RequestHeader set REMOTE_USER %{REMOTE_USER}s
                                RequestHeader set REMOTE_USER_SECRET ‘SomeSecret’
                                LogLevel debug
                        </Else>
                </Location>
 
                <Location “/admin>
                        AuthType openid-connect
                        #Require valid-user
                        OIDCDiscoverURL https://sub.domain.net/authorzation-code/callback?iss=https%3A%2F%2FsecondOP.com
                        Require claim iss:https://secondop.com/
                        #RequestHeader set REMOTE_USER %{REMOTE_USER}s
                        #RequestHeader set REMOTE_USER_SECRET ’SomeSecret’
                        LogLevel debug
                </Location>
</VirtualHost>

Is the config wrong? Is it possible to have 2 OP for 2 Locations?

mod_auth_openidc version: 1.8.8

Thank you.

BR

zandbelt · 2022-02-14T15:31:17Z

zandbelt
Feb 14, 2022
Maintainer

I think that should work, what is happening and what do the server debug logs say?

5 replies

zandbelt Feb 14, 2022
Maintainer

oh wait, 1.8.8 is almost 6 years old, no guarantees there... you really should upgrade

markooslaj Feb 14, 2022
Author

Can you provide any upgrade instructions, we are still running Centos 7.8.
Thank you.

markooslaj Feb 15, 2022
Author

We upgraded to version mod_auth_openidc-2.3.4
It's still not working.
Here is the error log.

[Tue Feb 15 14:15:27.783824 2022] [auth_openidc:debug] [pid 18641] src/mod_auth_openidc.c(3469): [client 195.3.81.25:31463] oidc_authz_checker: enter
[Tue Feb 15 14:15:27.783914 2022] [authz_core:debug] [pid 18641] mod_authz_core.c(809): [client 195.3.81.25:31463] AH01626: authorization result of Require claim iss:https://portal-test.okta.net: denied (no authenticated user yet)
[Tue Feb 15 14:15:27.783920 2022] [authz_core:debug] [pid 18641] mod_authz_core.c(809): [client 195.3.81.25:31463] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[Tue Feb 15 14:15:27.783934 2022] [auth_openidc:debug] [pid 18641] src/mod_auth_openidc.c(3363): [client 195.3.81.25:31463] oidc_check_user_id: incoming request: “/users?(null)", ab_is_initial_req(r)=1
[Tue Feb 15 14:15:27.783961 2022] [auth_openidc:debug] [pid 18641] src/util.c(2192): [client 195.3.81.25:31463] oidc_util_hdr_in_get: Cookie=x_csrf=e-E3u5AVbM0
[Tue Feb 15 14:15:27.783966 2022] [auth_openidc:debug] [pid 18641] src/util.c(1002): [client 195.3.81.25:31463] oidc_util_get_cookie: returning "mod_auth_openidc_session" = <null>
[Tue Feb 15 14:15:27.784035 2022] [auth_openidc:debug] [pid 18641] src/util.c(1154): [client 195.3.81.25:31463] oidc_util_request_matches_url: comparing “/users”=="/authorization-code/callback"
[Tue Feb 15 14:15:27.784057 2022] [auth_openidc:debug] [pid 18641] src/util.c(2192): [client 195.3.81.25:31463] oidc_util_hdr_in_get: Host=sub.domain.net
[Tue Feb 15 14:15:27.784061 2022] [auth_openidc:debug] [pid 18641] src/util.c(2192): [client 195.3.81.25:31463] oidc_util_hdr_in_get: Host=sub.domain.net
[Tue Feb 15 14:15:27.784064 2022] [auth_openidc:debug] [pid 18641] src/util.c(492): [client 195.3.81.25:31463] oidc_get_current_url: current URL 'https://sub.domain.net/users’
[Tue Feb 15 14:15:27.784083 2022] [auth_openidc:debug] [pid 18641] src/mod_auth_openidc.c(2179): [client 195.3.81.25:31463] oidc_authenticate_user: enter
[Tue Feb 15 14:15:27.784086 2022] [auth_openidc:debug] [pid 18641] src/mod_auth_openidc.c(2020): [client 195.3.81.25:31463] oidc_discovery: enter
[Tue Feb 15 14:15:27.784089 2022] [auth_openidc:debug] [pid 18641] src/util.c(2192): [client 195.3.81.25:31463] oidc_util_hdr_in_get: Host=sub.domain.net
[Tue Feb 15 14:15:27.784091 2022] [auth_openidc:debug] [pid 18641] src/util.c(2192): [client 195.3.81.25:31463] oidc_util_hdr_in_get: Host=sub.domain.net
[Tue Feb 15 14:15:27.784094 2022] [auth_openidc:debug] [pid 18641] src/util.c(492): [client 195.3.81.25:31463] oidc_get_current_url: current URL 'https://sub.domain.net/users’
[Tue Feb 15 14:15:27.784206 2022] [auth_openidc:debug] [pid 18641] src/mod_auth_openidc.c(2058): [client 195.3.81.25:31463] oidc_discovery: redirecting to external discovery page: https://sub.domain.net/authorization-code/callback?iss=https%3A%2F%2Fportal-test.okta.net&target_link_uri=https%3A%2F%2Fsub.domain.net%2Fexternal&method=get&oidc_callback=https%3A%2F%2Fsub.domain.net%2Fauthorization-code%2Fcallback&x_csrf=QnD54ruK8Sg
[Tue Feb 15 14:15:27.784216 2022] [auth_openidc:debug] [pid 18641] src/util.c(2246): [client 195.3.81.25:31463] oidc_util_hdr_err_out_add: Set-Cookie: x_csrf=QnD54ruK8Sg; Path=/; Secure; HttpOnly
[Tue Feb 15 14:15:27.784220 2022] [auth_openidc:debug] [pid 18641] src/util.c(2224): [client 195.3.81.25:31463] oidc_util_hdr_table_set: Location: https://sub.domain.net/authorization-code/callback?iss=https%3A%2F%2Fportal-test.okta.net&target_link_uri=https%3A%2F%2Fsub.domain.net%2Fexternal&method=get&oidc_callback=https%3A%2F%2Fsub.domain.net%2Fauthorization-code%2Fcallback&x_csrf=QnD54ruK8Sg

zandbelt Feb 15, 2022
Maintainer

please use 2.4.11 https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.11 (Assets)

markooslaj Feb 16, 2022
Author

Upgraded to 2.4.11.

Logs:

[Wed Feb 16 12:30:16.159276 2022] [auth_openidc:debug] [pid 20236] src/mod_auth_openidc.c(4084): [client 195.3.81.25:21799] oidc_authz_checker: enter: (r->user=(null)) require_args="iss:https://portal-test.okta.net"
[Wed Feb 16 12:30:16.159322 2022] [authz_core:debug] [pid 20236] mod_authz_core.c(809): [client 195.3.81.25:21799] AH01626: authorization result of Require claim iss:https://portal-test.okta.net: denied (no authenticated user yet)
[Wed Feb 16 12:30:16.159327 2022] [authz_core:debug] [pid 20236] mod_authz_core.c(809): [client 195.3.81.25:21799] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[Wed Feb 16 12:30:16.159334 2022] [auth_openidc:debug] [pid 20236] src/mod_auth_openidc.c(3953): [client 195.3.81.25:21799] oidc_check_user_id: incoming request: “/users?(null)", ap_is_initial_req(r)=1
[Wed Feb 16 12:30:16.159340 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Cookie=x_csrf=qzvH8IMEXBM
[Wed Feb 16 12:30:16.159344 2022] [auth_openidc:debug] [pid 20236] src/util.c(1226): [client 195.3.81.25:21799] oidc_util_get_cookie: returning "mod_auth_openidc_session" = <null>
[Wed Feb 16 12:30:16.159348 2022] [auth_openidc:debug] [pid 20236] src/util.c(1388): [client 195.3.81.25:21799] oidc_util_request_matches_url: comparing “/users”=="/authorization-code/callback"
[Wed Feb 16 12:30:16.159352 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Sec-Fetch-Mode=navigate
[Wed Feb 16 12:30:16.159354 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Sec-Fetch-Mode=navigate
[Wed Feb 16 12:30:16.159357 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Sec-Fetch-Dest=document
[Wed Feb 16 12:30:16.159359 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Sec-Fetch-Dest=document
[Wed Feb 16 12:30:16.159362 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Accept=text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
[Wed Feb 16 12:30:16.159366 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Host=sub.domain.net
[Wed Feb 16 12:30:16.159369 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Host=sub.domain.net
[Wed Feb 16 12:30:16.159383 2022] [auth_openidc:debug] [pid 20236] src/util.c(630): [client 195.3.81.25:21799] oidc_get_current_url: current URL 'https://sub.domain.net/users'
[Wed Feb 16 12:30:16.159394 2022] [auth_openidc:debug] [pid 20236] src/mod_auth_openidc.c(2255): [client 195.3.81.25:21799] oidc_authenticate_user: enter
[Wed Feb 16 12:30:16.159397 2022] [auth_openidc:debug] [pid 20236] src/mod_auth_openidc.c(2096): [client 195.3.81.25:21799] oidc_discovery: enter
[Wed Feb 16 12:30:16.159400 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Host=sub.domain.net
[Wed Feb 16 12:30:16.159403 2022] [auth_openidc:debug] [pid 20236] src/util.c(2473): [client 195.3.81.25:21799] oidc_util_hdr_in_get: Host=sub.domain.net
[Wed Feb 16 12:30:16.159407 2022] [auth_openidc:debug] [pid 20236] src/util.c(630): [client 195.3.81.25:21799] oidc_get_current_url: current URL 'https://sub.domain.net/‘users
[Wed Feb 16 12:30:16.159462 2022] [auth_openidc:debug] [pid 20236] src/proto.c(69): [client 195.3.81.25:21799] oidc_proto_generate_random_bytes: apr_generate_random_bytes call for 8 bytes
[Wed Feb 16 12:30:16.159601 2022] [auth_openidc:debug] [pid 20236] src/proto.c(71): [client 195.3.81.25:21799] oidc_proto_generate_random_bytes: apr_generate_random_bytes returned
[Wed Feb 16 12:30:16.159865 2022] [auth_openidc:debug] [pid 20236] src/mod_auth_openidc.c(2134): [client 195.3.81.25:21799] oidc_discovery: redirecting to external discovery page: https://sub.domain.net/authorization-code/callback?iss=https%3A%2F%2Fportal-test.okta.net&target_link_uri=https%3A%2F%2Fsub.domain.net%2Fexternal&method=get&oidc_callback=https%3A%2F%2Fsub.domain.net%2Fauthorization-code%2Fcallback&x_csrf=ddQZcp2X9Kk
[Wed Feb 16 12:30:16.160481 2022] [auth_openidc:debug] [pid 20236] src/util.c(1121): [client 195.3.81.25:21799] oidc_util_set_cookie_append_value: cookie append environment variable OIDC_SET_COOKIE_APPEND="; found
[Wed Feb 16 12:30:16.160603 2022] [auth_openidc:debug] [pid 20236] src/util.c(2551): [client 195.3.81.25:21799] oidc_util_hdr_err_out_add: Set-Cookie: x_csrf=ddQZcp2X9Kk; Path=/; Secure; HttpOnly; ";
[Wed Feb 16 12:30:16.160696 2022] [auth_openidc:debug] [pid 20236] src/util.c(2529): [client 195.3.81.25:21799] oidc_util_hdr_table_set: Location: https://sub.domain.netauthorization-code/callback?iss=https%3A%2F%2Fportal-test.okta.net&target_link_uri=https%3A%2F%2Fsub.domain.net%2Fexternal&method=get&oidc_callback=https%3A%2F%2Fsub.domain.net%2Fauthorization-code%2Fcallback&x_csrf=ddQZcp2X9Kk

zandbelt · 2022-02-16T12:07:30Z

zandbelt
Feb 16, 2022
Maintainer

when I correct the following errors in the config:

1. <Location “/admin> -> <Location “/admin">
2. authorzation -> authorization
3. -code -> _code

the redirect works fine

8 replies

markooslaj Feb 18, 2022
Author

Log: log.txt
VirtualHost Config: vh.txt

zandbelt Feb 18, 2022
Maintainer

RequestHeader set REMOTE_USER %{REMOTE_USER}s

is trying to pull REMOTE_USER from an SSL environment variable (%{VAR}s) but it should get it from the regular environment (%{VAR}e) and I'd pull it directly from the environment variables set by mod_auth_openidc, so:

RequestHeader set REMOTE_USER %{OIDC_CLAIM_otrs_username}e

markooslaj Feb 21, 2022
Author

The solution:

RequestHeader set REMOTE_USER %{OIDC_CLAIM_otrs_username}e

is not working. Is there something else I can try?

zandbelt Mar 1, 2022
Maintainer

the RequestHeader would be added on a request that is proxied downstream; are you actually proxying or trying to do something else?

markooslaj Mar 2, 2022
Author

We have an application (OTRS) that is running on the Mojolicious web framework, Apache is some sort of proxy for the application.
We would like to pass the otrs_username claim as REMOTE_USER RequestHeader to the underlaying application. We heave two logins, one for customers in the location /external and one for the admins in location /otrs. The application is configured to accept the username in the RequestHeader and authenticate the user.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Connect application to two providers #791

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 13 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Select a reply

Connect application to two providers #791

markooslaj Feb 14, 2022

Replies: 2 comments · 13 replies

zandbelt Feb 14, 2022 Maintainer

zandbelt Feb 14, 2022 Maintainer

markooslaj Feb 14, 2022 Author

markooslaj Feb 15, 2022 Author

zandbelt Feb 15, 2022 Maintainer

markooslaj Feb 16, 2022 Author

zandbelt Feb 16, 2022 Maintainer

markooslaj Feb 18, 2022 Author

zandbelt Feb 18, 2022 Maintainer

markooslaj Feb 21, 2022 Author

zandbelt Mar 1, 2022 Maintainer

markooslaj Mar 2, 2022 Author

markooslaj
Feb 14, 2022

Replies: 2 comments 13 replies

zandbelt
Feb 14, 2022
Maintainer

zandbelt Feb 14, 2022
Maintainer

markooslaj Feb 14, 2022
Author

markooslaj Feb 15, 2022
Author

zandbelt Feb 15, 2022
Maintainer

markooslaj Feb 16, 2022
Author

zandbelt
Feb 16, 2022
Maintainer

markooslaj Feb 18, 2022
Author

zandbelt Feb 18, 2022
Maintainer

markooslaj Feb 21, 2022
Author

zandbelt Mar 1, 2022
Maintainer

markooslaj Mar 2, 2022
Author