Loading auth_openidc_module in apache conf causes working WSGI Django app to error on page load.

[Rumsey-The-Hobo]

I've spent the last 2 days trying to fix this issue trying everything I can from the WSGI side without success. I understand this is likely related to my specific environment but I would be very grateful for any help on the issue.

I have a functioning Apache webpage using Django/WSGI. When I load auth_openidc_module by uncommenting the following line
LoadModule auth_openidc_module modules/mod_auth_openidc.so
my page will crash upon refresh giving the following errors in the apache error_log:

[Wed Mar 01 15:06:22.916668 2023] [wsgi:error] [pid 55676] [client ] Truncated or oversized response headers received from daemon process 'site': /var/www/html/site/site/wsgi.py
[Wed Mar 01 15:06:23.462905 2023] [core:notice] [pid 55674] AH00052: child pid 55675 exit signal Segmentation fault (11)

Note the page goes from working to this error only by loading the module even before I add OIDC lines into the conf.

However, when I add the following to my conf, all of my cgi python scripts work and have OIDC headers in the python env, but my wsgi django application on the same server crashes with the errors above.

OIDCProviderMetadataURL removed
OIDCClientID "removed"
OIDCRedirectURI removed
OIDCResponseType code
OIDCScope "openid profile email"
OIDCCryptoPassphrase secret
OIDCPassClaimsAs environment
OIDCClaimPrefix USERINFO-
OIDCPassIDTokenAs payload
<Location "/">
    Require valid-user
    AuthType openid-connect
</Location>

Here are some details from apache log on my server (not i have tried different versions of mod_auth_openidc without luck):
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_wsgi/4.9.4 Python/3.10
mod_auth_openidc-2.1.6 - init - OpenSSL 1.0.1e-fips 11 Feb 2013, Elliptic Curve (EC)=yes, Galois Counter Mode (GCM)=yes, Redis=yes

And here is the part of my apache conf for my wsgi django app

LoadModule wsgi_module /usr/local/bin/anaconda3/lib/python3.10/site-packages/mod_wsgi/server/mod_wsgi-py310.cpython-310-x86_64-linux-gnu.so
WSGIPythonHome /usr/local/bin/anaconda3
WSGIDaemonProcess esda python-path=/var/www/html/esda:/usr/local/bin/anaconda3:/usr/local/bin/anaconda3/bin:/usr/local/bin/anaconda3/lib/python3.10/site-packages
WSGIProcessGroup esda
WSGIScriptAlias /esda /var/www/html/esda/mysite/wsgi.py

<Directory /var/www/html/esda>
AddHandler wsgi-script .py
Options +ExecCGI
</Directory>

<Directory /var/www/html/esda>

   order deny,allow
  Allow from all
</Directory>
WSGIApplicationGroup %{GLOBAL}

Please let me know what else I can provide to try and figure this out.
Greatly appreciate the help,
Taylor

[zandbelt]

you should really upgrade to the latest version, downloadable from the Releases page here

[Rumsey-The-Hobo]

I enabled LogLevel Debug, for some reason the truncated error message didn't show this time, just the segmentation fault:

[Thu Mar 02 09:09:15.789287 2023] [proxy:debug] [pid 58845] proxy_util.c(1843): AH00925: initializing worker proxy:reverse shared
[Thu Mar 02 09:09:15.789363 2023] [proxy:debug] [pid 58845] proxy_util.c(1888): AH00927: initializing worker proxy:reverse local
[Thu Mar 02 09:09:15.789389 2023] [proxy:debug] [pid 58845] proxy_util.c(1939): AH00931: initialized single connection worker in child 58845 for (*)
[Thu Mar 02 09:09:15.789459 2023] [wsgi:info] [pid 58845] mod_wsgi (pid=58845): Python home /usr/local/bin/anaconda3.
[Thu Mar 02 09:09:15.789500 2023] [wsgi:info] [pid 58845] mod_wsgi (pid=58845): Initializing Python.
[Thu Mar 02 09:09:15.804394 2023] [wsgi:info] [pid 58845] mod_wsgi (pid=58845): Attach interpreter ''.
[Thu Mar 02 09:09:15.807792 2023] [wsgi:info] [pid 58845] mod_wsgi (pid=58845): Imported 'mod_wsgi'.
[Thu Mar 02 09:09:16.789100 2023] [core:notice] [pid 58451] AH00052: child pid 58485 exit signal Segmentation fault (11)
[Thu Mar 02 09:09:16.789149 2023] [wsgi:info] [pid 58451] mod_wsgi (pid=58485): Process 'esda' has died, deregister and restart it.
[Thu Mar 02 09:09:16.789166 2023] [wsgi:info] [pid 58451] mod_wsgi (pid=58485): Process 'esda' terminated by signal 11
[Thu Mar 02 09:09:16.789172 2023] [wsgi:info] [pid 58451] mod_wsgi (pid=58485): Process 'esda' has been deregistered and will no longer be monitored.
[Thu Mar 02 09:09:16.790257 2023] [wsgi:info] [pid 58847] mod_wsgi (pid=58847): Starting process 'esda' with uid=48, gid=48 and threads=15.
[Thu Mar 02 09:09:16.790496 2023] [wsgi:info] [pid 58847] mod_wsgi (pid=58847): Python home /usr/local/bin/anaconda3.
[Thu Mar 02 09:09:16.790559 2023] [wsgi:info] [pid 58847] mod_wsgi (pid=58847): Initializing Python.

[Rumsey-The-Hobo]

The truncated or oversized response error followed by the segmentation fault occurs when I run the page with https, when I load the page without https only the Segmentation fault occurs. With OIDC/SSL not loaded in apache, the page loads without error without https.

[zandbelt]

that looks like an OpenSSL versioning issue between different stacks/modules/servers compiled against OpenSSL and running with another version

[Rumsey-The-Hobo]

reinstalling python and all modules solved the issue. thanks for your help.

[hmoffatt]

This is probably a good time to switch from mod_wsgi to running your Python app in a separate process with something like gunicorn.