mod_auth_openidc_session not saved on GCP Cloud run when mapped to a Custom Domain

[ihabzee]

Hi There,

I installed mod_auth_openidc on both dev and prod instances of GCP Cloud run. It's working with no issues on dev instance because it's not mapped to a custom domain. But for prod mod_auth_openidc_session cookie is not saved. And Every page is trying to authenticate with SSO. Is there any extra configuration I need to add?

default Cloud run url: xxx-yyy-2134dfghfgh-uw.a.run.app
custom mapped domain: subdomain.example.com

OIDCClientID my_client
OIDCClientSecret mysecret
OIDCRedirectURI https://subdomain.example.com/oauth2callback
OIDCScope "openid email"
OIDCRemoteUserClaim email
OIDCPassClaimsAs environment
OIDCCryptoPassphrase 123456789
OIDCCookieDomain subdomain.example.com
OIDCCookiePath /
OIDCXForwardedHeaders X-Forwarded-Proto Forwarded
OIDCStateInputHeaders x-forwarded-for

# ALLOW OPEN CALLBACK
<Location "/oauth2callback">
AuthType openid-connect
Require valid-user
LogLevel debug
</Location>

<Location />
AuthType openid-connect
OIDCUnAuthAction auth
Require valid-user
LogLevel debug
</Location>

[auth_openidc:debug] [pid 23] src/mod_auth_openidc.c(828): [client 169.254.1.1:59268] oidc_log_session_expires: session inactivity timeout: Tue, 28 Mar 2023 18:31:27 GMT (in 299 secs from now)
[auth_openidc:debug] [pid 23] src/util.c(2509): [client 169.254.1.1:59268] oidc_util_hdr_in_get: Cookie=laravel_token=eyJpdiI6IkRGTUlySDI4Q1FUUCttbGltQm5ySlE9PSIsInZhbHVlIjoiK3FoMStrOVlhREswMjJwMmE1VmVPaGdsWjdMb2xtWlRvQUdMQmpaMytrY2F0emNzSWRDdnpFcm9VSWVkenpWc3B2RmVyOFQyQmlWWEJ3aDZDODYyaWpEWThnMGdOdEJPSHRnVERIemJKM1hLY2NIT0VtYitIZWQ5cEkxU2ttR0M0Wjk5eG1wYlFjVnpNdzJPMmx6THpvemF0ZFRMR0ViT3ZlMlNhWUw1dWowSVBJNUhpSXJtWmhFVHdkWUw2alhpSVlFWGRLZkR1a1liN01aRFphTnZsRHlBUW1yc3p6T2pBOEdiTW96VElaYS80UytsRWpsM0xzdUhPZ2ZpK2VzL3dTYUxPeGs4dkJzancwalVYSnNzVkVEcnFKRkduKzcwRDE4ZUdkQTAzeUFhRStQMDZPZWUrRnhBSkJYYnNHS2ciLCJtYWMiOiI0NjQ1NjVkYTcyNzdjODFjNmMwNjZmYzkyNWU0NmYwNjE0NTMzYThhMDdmMjU2NWVkMDU1YjljZjYwNDM5ODQ4IiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6Iml1TWp4aGZ4aTdyUGtpQ3Q0SjFab3c9PSIsInZhbHVlIjoiMitpUFJkamNIRlRyek8rQ0VLNHB3SWZGeXdBbzB0SXJZMGRzaE9TdlVlVWRQaFZBcmRuVkQ1amVmNi9rZ0JpWXJjVDhJaThmZzcrTGVxYmtOcnM5OXZlcFJJK2ZhTmE2djQrQnQ0YVlqVDBxald5Y3BZSjJqbkRPbmtNR3FyeDAiLCJtYWMiOiJmMmYzM2FlMThjNmUwMjk2M2YzM2FlM2ZhZTlmMDFmODdiNzMwOGNhYjE2ZjFhMjNjNWMyMjlhMjlhYjg1ODI0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVreEhKdjN4YUtXckEyekt3dFA5WHc9PSIsInZhbHVlIjoiZVF4UzhXQU9ycS9GV3ZwaUhDb2diS1VueFkweXlKQ1g4SzRleVRJMzFpZDRkcThIQTMyZ2ptZThEcUxEb2NuNUZpM2RWcU1xYWtrbzMza3grdnY3UmRwbkNzVHI0QkZTYkZFdlk3SlV3bForbzVhUmMwZEltV0R5SVBBc1N2N0YiLCJtYWMiOiJmNmUxODlkYjlkMDM3MWRiZTk2MzZhNTQzMjNmOGM5N2Y0MDdjZjg3MGU2MDlmMWVkMDljYzQyMGE0ZTcyMjNlIiwidGFnIjoiIn0%3D; mod_auth_openidc_session=fd78dd55-cc91-4f97-a7d4-bdc6625f4a8c
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of Require valid-user : granted
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of <RequireAny>: granted
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of Require valid-user : denied (no authenticated user yet)
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet)
[auth_openidc:debug] [pid 23] src/mod_auth_openidc.c(4027): [client 169.254.1.1:59268] oidc_check_user_id: incoming request: "/index.php?(null)", ap_is_initial_req(r)=0
[auth_openidc:debug] [pid 23] src/mod_auth_openidc.c(3910): [client 169.254.1.1:59268] oidc_check_userid_openidc: recycling user '[USER_EMAIL]' from initial request for sub-request
[auth_openidc:debug] [pid 23] src/util.c(2509): [client 169.254.1.1:59268] oidc_util_hdr_in_get: Cookie=laravel_token=eyJpdiI6IkRGTUlySDI4Q1FUUCttbGltQm5ySlE9PSIsInZhbHVlIjoiK3FoMStrOVlhREswMjJwMmE1VmVPaGdsWjdMb2xtWlRvQUdMQmpaMytrY2F0emNzSWRDdnpFcm9VSWVkenpWc3B2RmVyOFQyQmlWWEJ3aDZDODYyaWpEWThnMGdOdEJPSHRnVERIemJKM1hLY2NIT0VtYitIZWQ5cEkxU2ttR0M0Wjk5eG1wYlFjVnpNdzJPMmx6THpvemF0ZFRMR0ViT3ZlMlNhWUw1dWowSVBJNUhpSXJtWmhFVHdkWUw2alhpSVlFWGRLZkR1a1liN01aRFphTnZsRHlBUW1yc3p6T2pBOEdiTW96VElaYS80UytsRWpsM0xzdUhPZ2ZpK2VzL3dTYUxPeGs4dkJzancwalVYSnNzVkVEcnFKRkduKzcwRDE4ZUdkQTAzeUFhRStQMDZPZWUrRnhBSkJYYnNHS2ciLCJtYWMiOiI0NjQ1NjVkYTcyNzdjODFjNmMwNjZmYzkyNWU0NmYwNjE0NTMzYThhMDdmMjU2NWVkMDU1YjljZjYwNDM5ODQ4IiwidGFnIjoiIn0%3D; XSRF-TOKEN=eyJpdiI6Iml1TWp4aGZ4aTdyUGtpQ3Q0SjFab3c9PSIsInZhbHVlIjoiMitpUFJkamNIRlRyek8rQ0VLNHB3SWZGeXdBbzB0SXJZMGRzaE9TdlVlVWRQaFZBcmRuVkQ1amVmNi9rZ0JpWXJjVDhJaThmZzcrTGVxYmtOcnM5OXZlcFJJK2ZhTmE2djQrQnQ0YVlqVDBxald5Y3BZSjJqbkRPbmtNR3FyeDAiLCJtYWMiOiJmMmYzM2FlMThjNmUwMjk2M2YzM2FlM2ZhZTlmMDFmODdiNzMwOGNhYjE2ZjFhMjNjNWMyMjlhMjlhYjg1ODI0IiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IjVreEhKdjN4YUtXckEyekt3dFA5WHc9PSIsInZhbHVlIjoiZVF4UzhXQU9ycS9GV3ZwaUhDb2diS1VueFkweXlKQ1g4SzRleVRJMzFpZDRkcThIQTMyZ2ptZThEcUxEb2NuNUZpM2RWcU1xYWtrbzMza3grdnY3UmRwbkNzVHI0QkZTYkZFdlk3SlV3bForbzVhUmMwZEltV0R5SVBBc1N2N0YiLCJtYWMiOiJmNmUxODlkYjlkMDM3MWRiZTk2MzZhNTQzMjNmOGM5N2Y0MDdjZjg3MGU2MDlmMWVkMDljYzQyMGE0ZTcyMjNlIiwidGFnIjoiIn0%3D; mod_auth_openidc_session=fd78dd55-cc91-4f97-a7d4-bdc6625f4a8c
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of Require valid-user : granted
[authz_core:debug] [pid 23] mod_authz_core.c(820): [client 169.254.1.1:59268] AH01626: authorization result of <RequireAny>: granted
[auth_openidc:debug] [pid 23] src/util.c(1424): [client 169.254.1.1:59268] oidc_util_request_matches_url: comparing "/"=="/oauth2callback"

Thanks in advance!

[zandbelt]

I'm not sure what you mean by "cookie is not saved"; the logs refer to the mod_auth_openidc_session cookie:

[auth_openidc:debug] [<snip>] oidc_util_hdr_in_get: Cookie=laravel_token=<snip>; mod_auth_openidc_session=fd78dd55-cc91-4f97-a7d4-bdc6625f4a8c

which means that the cookie was returned to the browser earlier, was saved in the browser and replayed by the browser in the current request

[ihabzee]

Thanks @zandbelt for the quick reply. I can see the cookie on dev instance but not on prod.

[ihabzee]

Not sure if this would help but looks like there is an error when the module tries to set cookie:

[auth_openidc:debug] [pid 14] src/cache/common.c(389): [client 169.254.1.1:35232] oidc_cache_set: successfully stored 5516 bytes in shm cache backend for key 7c231767-5c2e-40c8-8981-df18274a425a
[auth_openidc:debug] [pid 14] src/util.c(2509): [client 169.254.1.1:35232] oidc_util_hdr_in_get: Forwarded=for="171.66.135.159";proto=https
[auth_openidc:debug] [pid 14] src/util.c(2509): [client 169.254.1.1:35232] oidc_util_hdr_in_get: Forwarded=for="171.66.135.159";proto=https
DEFAULT 2023-03-28T22:06:47.917896Z 169.254.1.1 - [EMAIL] [28/Mar/2023:22:06:47 +0000] "GET /oauth2callback?state=WLegc0gqGYcsVmI-wwZ-ztf-4YY&session_state=26414be6-dc48-46f2-805a-795a9ad594ed&code=0a3af48f-3017-4c53-aec3-5a77fb91ab09.26414be6-dc48-46f2-805a-795a9ad594ed.def460cf-3d1d-4c12-9948-2bffd49f3668 HTTP/1.1" 302 871 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"
[auth_openidc:debug] [pid 14] src/util.c(1152): [client 169.254.1.1:35232] oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found
[auth_openidc:debug] [pid 14] src/util.c(2587): [client 169.254.1.1:35232] oidc_util_hdr_err_out_add: Set-Cookie: mod_auth_openidc_session=7c231767-5c2e-40c8-8981-df18274a425a; Path=/; Domain=subdomain.example.com; Secure; HttpOnly; SameSite=None
[auth_openidc:debug] [pid 14] src/mod_auth_openidc.c(2005): [client 169.254.1.1:35232] oidc_handle_authorization_response: set remote_user to "[EMAIL]" in new session "7c231767-5c2e-40c8-8981-df18274a425a"

[zandbelt]

there's no error, these are all debug logs; calls to oidc_util_hdr_err_out_add refer to the headers set on non HTTP 200 responses

check log entries of oidc_get_current_url against the URL that you use in the browser to access the application