openid / oauth with Wild Apricot

[immauss]

My Goal:

An apache server that requires authentication from WildApricot for access.

My configuration:

OIDCProviderIssuer https://oauth.wildapricot.org/auth
OIDCProviderAuthorizationEndpoint https://mydomain.com/sys/login/OAuthLogin
OIDCProviderTokenEndpoint https://oauth.wildapricot.org/auth/token
OIDCClientID <CID from WA>
OIDCClientSecret <Secret from WA>
OIDCRedirectURI https://video.mydomain.com/protected/oauth2callback
OIDCCryptoPassphrase <API Key from WA>
OIDCScope openid
OIDCRemoteUserClaim sub
OIDCSessionInactivityTimeout 3600
OIDCSessionMaxDuration 7200
OIDCSSLValidateServer Off
OIDCStateMaxNumberOfCookies 10 true

<Location /protected>
    AuthType openid-connect
    Require valid-user
</Location>

In the apache access log, when trying to access "/protected"

79.207.95.100 - "" [30/Mar/2023:07:47:59 +0000] "GET /protected/oauth2callback?code=b4be02cc39e0c8b13706c20d4d71ea1b&state=q_PDO1shVBBhqi_i6NxESuPrSmc HTTP/1.1" 200 335 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"
79.207.95.100 - - [30/Mar/2023:07:47:59 +0000] "GET /favicon.ico/ HTTP/1.1" 200 48276 "https://video.vcisocatalyst.org/protected/oauth2callback?code=b4be02cc39e0c8b13706c20d4d71ea1b&state=q_PDO1shVBBhqi_i6NxESuPrSmc" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36"

In the apache error log, when trying to access "/protected"

[Thu Mar 30 07:47:59.765829 2023] [auth_openidc:error] [pid 17217:tid 17385] [client 79.207.95.100:64905] oidc_proto_validate_code_response: requested flow is "code" but no "id_token" parameter found in the code response
[Thu Mar 30 07:47:59.766221 2023] [auth_openidc:error] [pid 17217:tid 17385] [client 79.207.95.100:64905] oidc_proto_resolve_code_and_validate_response: code response validation failed

I've banged my head against this for a while now... I know it should work, but I'm missing something in the config or my understanding of the whole thing . . . .

From a similar thread here, I added:

OIDCResponseType id_token

This just fails differently. There is now no traffic from the web server to WA, and I get the beginnings of the login page, but then an error message in red: " An error has occured. Please try again later. If the problem persists, contact Admin." And there is nothing in the apache logs.

Any ideas what I'm doing wrong?

Thanks,
Scott

[zandbelt]

It doesn't seem that WildApricot is an OpenID Connect provider that would allow users to login, but it is merely an OAuth 2.0 provider.

From their webpage https://www.wildapricot.com/features/integrations it also seems that the company providing WildApricot is seriously confused about OAuth 2.0 and OpenID Connect: it falls right into trap described at https://oauth.net/articles/authentication/ by suggesting that you can do SSO with OAuth 2.0 and exposes users to a a wide range of vulnerabilities by doing so.

[immauss]

Ouch.... , but thank you.

First, thanks for the quick response. Very appreciated.

So ... for my particular use case, I only really need authorization to connect to the Apache server. The intent is for it to store videos which would take up more storage than WA has available. Ideally, these videos would only be accessible to someone already authenticated to the WA site. I had this working via a Drupal plugin, which is where I got most of the config bits, but I felt like having an entire Drupal install just to serve videos was massive overkill.

   Do you think there is anyway to get mod_auth_openidc to work with WA or am I making this more difficult than it needs to be and there is a simple easy way to get where I'm trying to go? 

Thanks,
Scott

[zandbelt]

there's no way to get mod_auth_openidc to work with WildApricot and if you would pursue this anyway you'd end up with an insecure system; and yes, this also means that the Drupal integration is vulnerable e.g. to an attacker setting up their own integration to phish access tokens and impersonate users at your Drupal site (or vice versa...)

[immauss]

Awesome
Thank you. I do appreciate your time and effort.
I'll have to find another solution.