Nothing happens after "oidc_proto_get_key_from_jwks: search for kid "xxxxxxx" or thumbprint x5t "(null)"" while integrating with Keycloak

[gautamcparmar]

Hello,
I was able to successfully build "mod_auth_openidc.so" for Amazon Linux 2023 OS. I have followed all the steps mentioned in WIKI page for enabling authentication with Keycloak. I also find that Keycloak sends authorization code post authentication which is being exchanged for ID and ACCESS tokens as well. When module tries to validate JWT token, it searches for JWK for its signature. But I don't find any logs after it initiates the search and UI shows "502 Bad Gateway" after redirection. Has anyone faced such issue in past? Your help would be much appreciated. I am trying to enable SSO for Nagios Core. I am running EC2 machine behind ALB in AWS.

[gautamcparmar]

Any advice or suggestion on the issue above is most welcome. I am stuck with this. Please help.

[zandbelt]

it would help if you:
a. provide the version/commit number of mod_auth_openidc
b. set LogLevel auth_openidc:debug and provide the server error log here

[gautamcparmar]

mod_auth_openidc_logs.txt
I am building from the latest code "https://github.com/OpenIDC/mod_auth_openidc.git" in master branch. I have attached the logs for your reference.

[zandbelt]

that input works for me so I'm suspecting a compilation issue e.g. with the version of cjose or other dependencies; I think you should be able to use the el9 (or el8) packages from the releases page https://github.com/OpenIDC/mod_auth_openidc/releases/

[gautamcparmar]

None of those packages worked on Amazon Linux 2023. Do you have any package built for Amazon Linux 2023?

[zandbelt]

we don't provide packages for Amazon Linux 2023

FWIW:
a. you're not using the latest code
b. I noticed that the kid (ef_uSuyVkY5kDkKRXnsY6Qv-0p5-TZtskeYGzgu0Z2c) in the ID Token JWT header is not actually present in the list of keys pulled from the jwks_uri, there's only a signing key with a kid value of ef_uSuyVkY5kDkKRXnsY6Qv-0p5-TZtskeYGzgu0Z2d; i.e. the last character differs: that is rather suspicious and not something that was ever reported before by other Keycloak users

[gautamcparmar]

I redacted the actual values from the log and probably that's why you find the difference. I saw in the logs that the kid being picked by module was correct one.