curl_easy_perform(1/2) failed

[TheNailer]

Hello,

I have configured a new RHEL9 Server with mod_auth_openidc-2.4.15.7 now getting some strange error messages and therefore I am not able to connect to my Keycloak server:

[Tue Jul 23 15:17:02.521956 2024] [auth_openidc:debug] [pid 10860:tid 10935] src/http.c(528): [remote xxx.xxx.xxx.xxx:48425] oidc_http_call: url=https://KeycloakServer/.well-known/openid-configuration, data=(null), content_type=(null), basic_auth=null, bearer_token=(null), ssl_validate_server=0, request_timeout=5, connect_timeout=2, retries=1, retry_interval=300, outgoing_proxy=proxy.com:8080:(null):-1, pass_cookies=0, ssl_cert=(null), ssl_key=(null), ssl_key_pwd=(null)
[Tue Jul 23 15:17:02.521998 2024] [auth_openidc:debug] [pid 10860:tid 10935] src/http.c(603): [remote xxx.xxx.xxx.xxx:48425] oidc_http_call: set HTTP request header User-Agent to: [TargetServer:443:10860] mod_auth_openidc-2.4.15.7 libcurl-7.76.1 openssl-3.0.7
[Tue Jul 23 15:17:02.525477 2024] [auth_openidc:error] [pid 10860:tid 10935] [remote xxx.xxx.xxx.xxx:48425] oidc_http_call: curl_easy_perform(1/2) failed for https://KeycloakServer/.well-known/openid-configuration with: [<n/a>]
[Tue Jul 23 15:17:02.826303 2024] [auth_openidc:error] [pid 10860:tid 10935] [remote xxx.xxx.xxx.xxx:48425] oidc_http_call: curl_easy_perform(2/2) failed for https://KeycloakServer/.well-known/openid-configuration with: [<n/a>]
[Tue Jul 23 15:17:02.826438 2024] [auth_openidc:error] [pid 10860:tid 10935] [remote xxx.xxx.xxx.xxx:48425] oidc_provider_static_config: could not retrieve metadata from url: https://KeycloakServer/.well-known/openid-configuration

I am performing behind a proxy server, but when I run curl directly exporting https_proxy=proxy.com it works.
I do have almost the exact same configuration running on another RHEL9 Server with the exact same version which is working fine in the same network.
Specially the "with: [<n/a>]" looks strange.

If you have any hints maybe also on how to get more logging information about that, I would appreciate any help.

Regards

[zandbelt]

you'll need to configure the proxy with OIDCOutgoingProxy see https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.15.7/auth_openidc.conf#L891-L894

[TheNailer]

Hello I have done that and as you can see in the first line it is also recognized: "outgoing_proxy=proxy.com:8080"
However its exactly the behaviour if I kept it out of the configuration on my working server, so something is not working with this proxy line it seems...

[zandbelt]

the syntax is congruent with https://curl.se/libcurl/c/CURLOPT_PROXY.html

[TheNailer]

Yes I have used it as: OIDCOutgoingProxy proxy.com:8080
It it somehow possible to raise the Debug log Level on the libcurl to gather more information what this is about!?

[zandbelt]

the equivalent of https_proxy=proxy.com is OIDCOutgoingProxy https://proxy.com

[TheNailer]

okay, sure, but this does not change anything. So there is no way to get more detailed logging?

[Wed Jul 24 10:26:47.971667 2024] [auth_openidc:debug] [pid 460587:tid 460592] src/http.c(528): [remote xxx.xxx.xxx.xxx:25206] oidc_http_call: url=https://KeycloakServer/.well-known/openid-configuration, data=(null), content_type=(null), basic_auth=null, bearer_token=(null), ssl_validate_server=0, request_timeout=5, connect_timeout=2, retries=1, retry_interval=300, outgoing_proxy=https://proxy.com:8080:(null):-1, pass_cookies=0, ssl_cert=(null), ssl_key=(null), ssl_key_pwd=(null)
[Wed Jul 24 10:26:47.971696 2024] [auth_openidc:debug] [pid 460587:tid 460592] src/http.c(603): [remote xxx.xxx.xxx.xxx:25206] oidc_http_call: set HTTP request header User-Agent to: [TargetServer:443:460587] mod_auth_openidc-2.4.15.7 libcurl-7.76.1 openssl-3.0.7
[Wed Jul 24 10:26:47.975217 2024] [auth_openidc:error] [pid 460587:tid 460592] [remote xxx.xxx.xxx.xxx:25206] oidc_http_call: curl_easy_perform(1/2) failed for https://KeycloakServer/.well-known/openid-configuration with: [<n/a>]
[Wed Jul 24 10:26:48.275919 2024] [auth_openidc:error] [pid 460587:tid 460592] [remote xxx.xxx.xxx.xxx:25206] oidc_http_call: curl_easy_perform(2/2) failed for https://KeycloakServer/.well-known/openid-configuration with: [<n/a>]
[Wed Jul 24 10:26:48.276038 2024] [auth_openidc:error] [pid 460587:tid 460592] [remote xxx.xxx.xxx.xxx:25206] oidc_provider_static_config: could not retrieve metadata from url: https://KeycloakServer/.well-known/openid-configuration