Implementation of this mod in a server to server environment

[nestle2377]

Hi to all, I've implemented this mod authenticating apache users aganist a keycloak environment.

the user is redirect to keycloak login page (if not already authenticated) and after this the module can correctly intercept the jwt token to authenticate the users.

I wonder how it can work in case of direct conversation between two servers. I try to explain myself better.
I have an A server that will send a request to an apache reverse proxy B with this mod installed; the request will be populated with the authorization header containing the bearer token. In this case, is the mod able to intercept the header and proceed with the authentication and possibly with the extraction of the claims? i tried but the server is redirected to the keycloak login page even though i have a valid bearer token in the authorization header.
Making the request from a browser and then with a valid keycloak cookie instead the apache reverse proxy with the mod works correctly.

it seems that the authorization header is not correctly read from apache with the mod, otherwise passing through the keycloak authentication the authorization header created by the keycloak server is read correctly
any idea?

thanks!

[zandbelt]

mod_auth2 is suited for that use case https://github.com/zmartzone/mod_oauth2

[nestle2377]

thanks for reply! is not possible with this module (mod_auth_openidc) to validate a bearer token in the authorization header? would prefer to use this module instead of the other one.
thanks!

[nestle2377]

the bearer token is received from apache, but it seems there are some crypto error, so maybe I've to configure still something:

[Fri Mar 03 10:54:23.172596 2023] [http:trace4] [pid 19136] http_request.c(428): [client 192.168.124.1:63519] authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJaWHBTREZNeS0yM0ZucnpRUVZMNDhiUElwVXRlTGFHS0VaeTRLdkctRWtjIn0.eyJleHAiOjE2Nzc4MzcwMTgsImlhdCI6MTY3NzgzNjk1OCwiYXV0aF90aW1lIjoxNjc3ODM2OTU4LCJqdGkiOiI4OGIyYTFkNS1kOGUyLTRkZTItOTI0Ny03NmJlMzRkOTBjNTgiLCJpc3MiOiJodHRwOi8vMTkyLjE2OC4xMjQuMTMzOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjpbIm1hc3Rlci1yZWFsbSIsImFjY291bnQiXSwic3ViIjoiZDAxYmI2NjItMDhmNC00MmQ1LWI4ODYtY2VkMTQyNWM1MWM4IiwidHlwIjoiQmVhcmVyIiwiYXpwIjoidGVzdC1vaWRjIiwibm9uY2UiOiJpdkV3YmVhMmZzOVR2Vnl1MUVKSDZmanpjR1JKY1N2QjAtUzdyMWhYV0ZzIiwic2Vzc2lvbl9zdGF0ZSI6ImUzNGJjMzBiLWFjZjAtNGU1MS1hNDgzLTdkMjQ3NTVhMDViNyIsImFjciI6IjEiLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsiY3JlYXRlLXJlYWxtIiwiZGVmYXVsdC1yb2xlcy1tYXN0ZXIiLCJvZmZsaW5lX2FjY2VzcyIsImFkbWluIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJtYXN0ZXItcmVhbG0iOnsicm9sZXMiOlsidmlldy1yZWFsbSIsInZpZXctaWRlbnRpdHktcHJvdmlkZXJzIiwibWFuYWdlLWlkZW50aXR5LXByb3ZpZGVycyIsImltcGVyc29uYXRpb24iLCJjcmVhdGUtY2xpZW50IiwibWFuYWdlLXVzZXJzIiwicXVlcnktcmVhbG1zIiwidmlldy1hdXRob3JpemF0aW9uIiwicXVlcnktY2xpZW50cyIsInF1ZXJ5LXVzZXJzIiwibWFuYWdlLWV2ZW50cyIsIm1hbmFnZS1yZWFsbSIsInZpZXctZXZlbnRzIiwidmlldy11c2VycyIsInZpZXctY2xpZW50cyIsIm1hbmFnZS1hdXRob3JpemF0aW9uIiwibWFuYWdlLWNsaWVudHMiLCJxdWVyeS1ncm91cHMiXX0sImFjY291bnQiOnsicm9sZXMiOlsibWFuYWdlLWFjY291bnQiLCJtYW5hZ2UtYWNjb3VudC1saW5rcyIsInZpZXctcHJvZmlsZSJdfX0sInNjb3BlIjoib3BlbmlkIGVtYWlsIHByb2ZpbGUiLCJzaWQiOiJlMzRiYzMwYi1hY2YwLTRlNTEtYTQ4My03ZDI0NzU1YTA1YjciLCJlbWFpbF92ZXJpZmllZCI6ZmFsc2UsInByZWZlcnJlZF91c2VybmFtZSI6ImFkbWluIn0.as3FXelrZIGiR7IKh8ZWmCcTD4swbGENx5lfjLrXVJ0zpZuJUhndlWVQFGMSO03RMLWrhH7UbsS8xcKgE3Q0FpBnugtePr_wZ523UzUNPVUyYVvhdzkNQBdinQSCBTS11N1VI3rtRjnmb0YrNBVCNUCLsZ9N4r_U97XKYwvMjWY2YoEzkKVnXu8-qjJoatGl93dAf5g-PCcHBGucAKOXODwkbzkQ-msz8MPHCMgI23y5aHSrwgBD3FWJrubcMD0OR_bK4HVA5L7zyFJ1yjt4dTd6tAnrkk8Eci0AMMjztkvs8W-NxYiAhNs6hOitE3__RsKnZkX7AvEMar3vX6rCFg
[Fri Mar 03 10:54:23.172659 2023] [authz_core:debug] [pid 19136] mod_authz_core.c(809): [client 192.168.124.1:63519] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[Fri Mar 03 10:54:23.172661 2023] [authz_core:debug] [pid 19136] mod_authz_core.c(809): [client 192.168.124.1:63519] AH01626: authorization result of : denied (no authenticated user yet)
[Fri Mar 03 10:54:23.172701 2023] [auth_openidc:debug] [pid 19136] src/mod_auth_openidc.c(2633): [client 192.168.124.1:63519] oidc_check_user_id: incoming request: "/aci/prova.html?(null)", ap_is_initial_req(r)=1
[Fri Mar 03 10:54:23.172767 2023] [auth_openidc:debug] [pid 19136] src/util.c(813): [client 192.168.124.1:63519] oidc_util_get_cookie: returning "mod_auth_openidc_session" =
[Fri Mar 03 10:54:23.172826 2023] [auth_openidc:debug] [pid 19136] src/session.c(83): [client 192.168.124.1:63519] oidc_session_load:
[Fri Mar 03 10:54:23.172829 2023] [auth_openidc:debug] [pid 19136] src/util.c(852): [client 192.168.124.1:63519] oidc_util_request_matches_url: comparing "/aci/prova.html"=="/aci"
[Fri Mar 03 10:54:23.172833 2023] [auth_openidc:debug] [pid 19136] src/util.c(374): [client 192.168.124.1:63519] oidc_get_current_url: current URL 'https://192.168.124.133/aci/prova.html'
[Fri Mar 03 10:54:23.172840 2023] [auth_openidc:debug] [pid 19136] src/mod_auth_openidc.c(1724): [client 192.168.124.1:63519] oidc_authenticate_user: enter
[Fri Mar 03 10:54:23.172843 2023] [auth_openidc:debug] [pid 19136] src/cache/shm.c(156): [client 192.168.124.1:63519] oidc_cache_shm_get: enter, section="provider", key="http://192.168.124.133:8080/auth/realms/master/.well-known/openid-configuration"
[Fri Mar 03 10:54:23.172978 2023] [auth_openidc:debug] [pid 19136] src/mod_auth_openidc.c(166): [client 192.168.124.1:63519] oidc_get_browser_state_hash: enter
> [Fri Mar 03 10:54:23.173110 2023] [auth_openidc:error] [pid 19136] [client 192.168.124.1:63519] oidc_crypto_aes_decrypt: EVP_DecryptFinal_ex failed: error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt
[Fri Mar 03 10:54:23.173115 2023] [auth_openidc:error] [pid 19136] [client 192.168.124.1:63519] oidc_base64url_decode_decrypt_string: oidc_crypto_aes_decrypt failed
[Fri Mar 03 10:54:23.173118 2023] [auth_openidc:debug] [pid 19136] src/util.c(690): [client 192.168.124.1:63519] oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found
[Fri Mar 03 10:54:23.173121 2023] [auth_openidc:debug] [pid 19136] src/util.c(773): [client 192.168.124.1:63519] oidc_util_set_cookie: adding outgoing header: Set-Cookie: mod_auth_openidc_state_VtTbBdsWdF97lapkVrRHRcpkiVw=XljmW7T-npVH60XrfYRRykPmlDQz8Ld1ERZTtkyXioqc9Urn46AZ3kfpNZmd_mHgTOIbdALtfCLA7PkHyDaRMu52E42_F7QFq1crcZaEwShEFDQUUeK8-znu6cs90E8s5TbFSA_hB3NoG9TT--3YCcOx0u5rPBgKy0AyYFNSII119zlHQgin12SlNThcV1q29m3tPLM0YlnVwWYI3hROq3LouVOr4OJIakvBMP-QklW1MM79ihcrFnOshINyQNx3hlFI_dsNLvnjME1qKW5aNw0wQIq8xYTGAZWnKTfD399-iOCS66pJUpdzlSs2Irohf2gMsOD4nb8pfp6fexSH6btNK5fFj0Nxv9muSRhGVss;Path=/;Secure;HttpOnly
[Fri Mar 03 10:54:23.173128 2023] [auth_openidc:debug] [pid 19136] src/proto.c(113): [client 192.168.124.1:63519] oidc_proto_authorization_request: enter, issuer=http://192.168.124.133:8080/auth/realms/master, redirect_uri=https://192.168.124.133/aci, state=VtTbBdsWdF97lapkVrRHRcpkiVw, proto_state={"original_url": "https://192.168.124.133/aci/prova.html", "original_method": "get", "issuer": "http://192.168.124.133:8080/auth/realms/master", "response_type": "code token", "nonce": "lwpMbdNAEYqJ4unlyR5FwkLrViXwS8sP5rlFpaInkTY", "timestamp": 1677837263}, code_challenge=(null)
[Fri Mar 03 10:54:23.173195 2023] [auth_openidc:debug] [pid 19136] src/proto.c(220): [client 192.168.124.1:63519] oidc_proto_authorization_request: adding outgoing header: Location: http://192.168.124.133:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code%20token&scope=openid%20email%20profile&client_id=test-oidc&state=VtTbBdsWdF97lapkVrRHRcpkiVw&redirect_uri=https%3A%2F%2F192.168.124.133%2Faci&nonce=lwpMbdNAEYqJ4unlyR5FwkLrViXwS8sP5rlFpaInkTY
[Fri Mar 03 10:54:23.173197 2023] [core:trace3] [pid 19136] request.c(119): [client 192.168.124.1:63519] auth phase 'check user' gave status 302: /aci/prova.html
[Fri Mar 03 10:54:23.173216 2023] [http:trace3] [pid 19136] http_filters.c(1129): [client 192.168.124.1:63519] Response sent with status 302, headers:
[Fri Mar 03 10:54:23.173218 2023] [http:trace5] [pid 19136] http_filters.c(1136): [client 192.168.124.1:63519] Date: Fri, 03 Mar 2023 09:54:23 GMT
[Fri Mar 03 10:54:23.173219 2023] [http:trace5] [pid 19136] http_filters.c(1139): [client 192.168.124.1:63519] Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
[Fri Mar 03 10:54:23.173221 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Set-Cookie: mod_auth_openidc_state_VtTbBdsWdF97lapkVrRHRcpkiVw=XljmW7T-npVH60XrfYRRykPmlDQz8Ld1ERZTtkyXioqc9Urn46AZ3kfpNZmd_mHgTOIbdALtfCLA7PkHyDaRMu52E42_F7QFq1crcZaEwShEFDQUUeK8-znu6cs90E8s5TbFSA_hB3NoG9TT--3YCcOx0u5rPBgKy0AyYFNSII119zlHQgin12SlNThcV1q29m3tPLM0YlnVwWYI3hROq3LouVOr4OJIakvBMP-QklW1MM79ihcrFnOshINyQNx3hlFI_dsNLvnjME1qKW5aNw0wQIq8xYTGAZWnKTfD399-iOCS66pJUpdzlSs2Irohf2gMsOD4nb8pfp6fexSH6btNK5fFj0Nxv9muSRhGVss;Path=/;Secure;HttpOnly
[Fri Mar 03 10:54:23.173224 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Location: http://192.168.124.133:8080/auth/realms/master/protocol/openid-connect/auth?response_type=code%20token&scope=openid%20email%20profile&client_id=test-oidc&state=VtTbBdsWdF97lapkVrRHRcpkiVw&redirect_uri=https%3A%2F%2F192.168.124.133%2Faci&nonce=lwpMbdNAEYqJ4unlyR5FwkLrViXwS8sP5rlFpaInkTY
[Fri Mar 03 10:54:23.173226 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Content-Length: 490
[Fri Mar 03 10:54:23.173228 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Keep-Alive: timeout=5, max=100
[Fri Mar 03 10:54:23.173230 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Connection: Keep-Alive
[Fri Mar 03 10:54:23.173231 2023] [http:trace4] [pid 19136] http_filters.c(958): [client 192.168.124.1:63519] Content-Type: text/html; charset=iso-8859-1
[Fri Mar 03 10:54:23.173241 2023] [ssl:trace4] [pid 19136] ssl_engine_io.c(1515): [client 192.168.124.1:63519] coalesce: have 0 bytes, adding 981 more
[Fri Mar 03 10:54:23.173250 2023] [core:trace6] [pid 19136] core_filters.c(525): [client 192.168.124.1:63519] core_output_filter: flushing because of FLUSH bucket
[Fri Mar 03 10:54:23.174643 2023] [core:trace6] [pid 19136] core_filters.c(525): [client 192.168.124.1:63519] core_output_filter: flushing because of FLUSH bucket
[Fri Mar 03 10:54:23.174699 2023] [ssl:trace4] [pid 19136] ssl_engine_io.c(2079): [client 192.168.124.1:63519] OpenSSL: I/O error, 5 bytes expected to read on BIO#55b4e595f8e0 [mem: 55b4e5966f53]
[Fri Mar 03 10:54:23.174829 2023] [core:trace6] [pid 19136] core_filters.c(525): [client 192.168.124.1:63519] core_output_filter: flushing because of FLUSH bucket
[Fri Mar 03 10:54:23.175039 2023] [core:trace6] [pid 19136] core_filters.c(525): [client 192.168.124.1:63519] core_output_filter: flushing because of FLUSH bucket