Federated Keystone support OIDC with Auth0 using mod_auth_openidc

[AnirudhPokala]

Hi I am trying to configure our federated keystone to support OIDC protocol through Auth0 Idp, for the same using mod_auth_openidc and configured the virtual host wsgi configuration as shown below. But the logs shows errors. Can anyone help me on this.

#Specs:
#OS: Centos
#Apache: httpd
# Configure OIDC
    OIDCClaimPrefix "OIDC-"
    OIDCResponseType "id_token"
    OIDCScope "openid email profile"
    OIDCProviderMetadataURL https://<auth0domain>/.well-known/openid-configuration
    OIDCClientID <auth0_clientid>
    OIDCClientSecret <auth0_secret>
    OIDCCryptoPassphrase openstack
    # added the callback URL in auth0 also
    OIDCRedirectURI http://<FQDN>/keystone/v3/OS-FEDERATION/identity_providers/IDP/protocols/openid/auth/redirect
    OIDCStateTimeout 3000
    OIDCSessionInactivityTimeout 5000
    OIDCCookieSameSite On
    # For keystone
    <LocationMatch /keystone/v3/OS-FEDERATION/identity_providers/.*?/protocols/openid/auth/redirect>
        AuthType openid-connect
        Require valid-user
        LogLevel debug
    </LocationMatch>

But when I fire the login request I see these in logs:

[Thu Mar 10 12:59:39.259790 2022] [authz_core:debug] [pid 31259:tid 140445707372288] mod_authz_core.c(809): [client] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259794 2022] [authz_core:debug] [pid 31259:tid 140445707372288] mod_authz_core.c(809): [client] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259808 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/mod_auth_openidc.c(3953): [client] oidc_check_user_id: incoming request: "/keystone/v3/OS-FEDERATION/identity_providers/ipd1/protocols/openid/auth/redirect?(null)", ap_is_initial_req(r)=1, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259834 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(1388): [clien] oidc_util_request_matches_url: comparing "/keystone/v3/OS-FEDERATION/identity_providers/IDP/protocols/openid/auth/redirect"=="/keystone/v3/OS-FEDERATION/identity_providers/IDP/protocols/openid/auth/redirect", referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259841 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/mod_auth_openidc.c(2041): [client] oidc_handle_post_authorization_response: enter, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259846 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(2473): [client] oidc_util_hdr_in_get: Content-Type=application/x-www-form-urlencoded, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259897 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(1712): [client] oidc_util_read_form_encoded_params: read: id_token=<***TOKEN***>, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259926 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(1712): [client] oidc_util_read_form_encoded_params: read: state=zZHGKy1D1KYS2qkvxfQ4_DAcceuaZwZx, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259930 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(1717): [client] oidc_util_read_form_encoded_params: parsed: 1168 bytes into 2 elements, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259937 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/mod_auth_openidc.c(1896): [client] oidc_handle_authorization_response: enter, response_mode=form_post, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259940 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/mod_auth_openidc.c(1525): [client] oidc_authorization_response_match_state: enter (state=zZHGKy1D1KYS2qkvxfQ4_DAcceuaZwZx), referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259943 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/mod_auth_openidc.c(616): [client] oidc_restore_proto_state: enter, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259950 2022] [auth_openidc:debug] [pid 31259:tid 140445707372288] src/util.c(1226): [client] oidc_util_get_cookie: returning "mod_auth_openidc_state_zZHGKy1D1KYS2qkvxfQ4_DAcceuaZwZx" = <null>, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259956 2022] [auth_openidc:error] [pid 31259:tid 140445707372288] [client] oidc_restore_proto_state: no "mod_auth_openidc_state_zZHGKy1D1KYS2qkvxfQ4_DAcceuaZwZx" state cookie found: check domain and samesite cookie settings, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259959 2022] [auth_openidc:error] [pid 31259:tid 140445707372288] [client] oidc_authorization_response_match_state: unable to restore state, referer: https://<auth0_domain>/
[Thu Mar 10 12:59:39.259962 2022] [auth_openidc:error] [pid 31259:tid 140445707372288] [client] oidc_handle_authorization_response: invalid authorization response state and no default SSO URL is set, sending an error..., referer: https://<auth0_domain>/

[zandbelt]

OIDCCookieSameSite On may be in the way here

[AnirudhPokala]

Yes, we are debugging in the developer mode only while auth0 login, and got to know that there are no cookie found when sending POST call. Sure will also disable mod_shib completely.

[AnirudhPokala]

Hi @zandbelt , please find the below snapshot of debugging using developer mode during loign. As we see there is no cookie set. And I am using oidcdebugger.com, to test things. And for CORS cookies, isn't it our server set them.

[AnirudhPokala]

So how is this going to be handled @zandbelt ?

[zandbelt]

this is an issue with your setup and/or browser but I have no time to dig into specific use cases; if you use this in a large enterprise deployment it may be worth to subscribe to commercial support via [email protected]

[AnirudhPokala]

Yes its issue with browser, and few configuration settings in keystone.conf, vhost conf. After that mod_auth_openidc is setting a state cookie and also session.

[AnirudhPokala]

Done