Invalid parameter: redirect_uri #635

lucassena · 2021-08-04T20:52:43Z

lucassena
Aug 4, 2021

Hello, we are using Keycloak as a provider, we use our environment on an AWS Kubernetes. But it looks like we're having a problem with something related to SSL or protocols, because when I try to access a protected URL it redirects to Keycloak with the error:

"We are sorry...
Invalid parameter: redirect_uri"

The url where this error appears is:

https://my.web.com/auth/realms/Corporate/protocol/openid-connect/auth?response_type=code&scope=openid%20email&client_id=myclient&state=63Gvqqb-fwxACySc3TGGmdu3LYA&redirect_uri=http%3A%2F%2Fmy.web.com%2Fredirect_uri.html&nonce=3wMNQtanYxErMQjnTZYZhAF69keKAk1QeW6EkO06wP8

The expected was to redirect to the login screen (with username and password) of Keycloak.

What I noticed is that the redirect_uri is set to "http" (see the 2 in the image), but we are using https and the settings in Keycloak are all set to "https" as well. The referer is a https URL correctly (see the 1 in the image).

And my apache conf is:

ServerName my.web.com

<VirtualHost *:80>
    ServerAdmin [email protected]

    DocumentRoot htdocs/

    ErrorLog /proc/self/fd/1
    CustomLog /proc/self/fd/2 combined

    SSLProxyEngine On
    SSLProxyVerify none 
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerName off
    SSLProxyCheckPeerExpire off
    RequestHeader set X-Forwarded-Proto https
    ProxyPreserveHost On
    ProxyPass "/auth/"  "https://keycloak.provider.com/auth/"
    <Location "/auth/">
        OIDCUnAuthAction pass
    </Location>

    OIDCCryptoPassphrase my-random-secret-used-by-apache-oidc-and-balancer

    OIDCProviderMetadataURL https://my.web.com/auth/realms/Corporate/.well-known/openid-configuration

    OIDCClientID myclient
    OIDCClientSecret 7656976g-f8e5-153e-405e-6123741984f4
    OIDCScope "openid email"
    OIDCRedirectURI /redirect_uri.html
    OIDCPassClaimsAs both

    OIDCRemoteUserClaim preferred_username

    OIDCInfoHook userinfo

    <LocationMatch "^((?!.*(index|_tela-inicial)).*\.html$)">
        AuthType openid-connect
        Require valid-user
    </LocationMatch>
</VirtualHost>

We have been trying to resolve this for a few days. It's very complicated, we've tried to look for the solution on the internet but nothing yet.

I really appreciate if anyone can help me.

zandbelt · 2021-08-04T21:53:44Z

zandbelt
Aug 4, 2021
Maintainer

apparently the website is enabled on plain http and you're trying to access it over that as well; so disable plain http and use the https URL in your browser

5 replies

lucassena Aug 4, 2021
Author

Thanks for the quick response @zandbelt . I forgot to mention that we are running behind a Load Balancer with SSL ACM certificate.

So my apache VirtualHost is listening on port 80 (http).

I'm sending two images to show that we are configuring and accessing as "https". The second image is how the configuration is in Keycloak (I don't know if this can help my questioning).

zandbelt Aug 5, 2021
Maintainer

make the LB set the X-Forwarded-Proto header as documented in https://github.com/zmartzone/mod_auth_openidc/wiki#8-how-do-i-run-mod_auth_openidc-behind-a-reverse-proxy

lucassena Aug 6, 2021
Author

Hi @zandbelt , after some changes we managed to get to the Keycloak login screen, after authentication the user is returned to the redirect_uri with error:

https://my.web.com/redirect_uri.html?state=3fOo5D5TJr6FX2mtu8cYkbiFrs8&session_state=a35984a9-1897-4884-befc-f207a4425c9e&code=f057f22f-f68a-4dad-951f-c946eb3ad1da.a35984a9-1897-4884-befc-f207a4425c9e.0a2d1634-40f7-45e2-b12a-5dce9b444c5b

Error:

OpenID Connect Provider error: Error in handling response type.

Can you tell me if this might be setting on the Keycloak side?

Thank you for your attention

zandbelt Aug 6, 2021
Maintainer

the Apache server log will tell you what happened

lucassena Aug 7, 2021
Author

The log is telling me the token is invalid, but I don't know why. Can you give me any tips?

[Fri Aug 06 18:24:59.080010 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(728): [client 127.0.0.1:39490] oidc_util_http_add_form_url_encoded_param: processing: redirect_uri=http://mysite.staging.corporationsite.io/redirect_uri.html
[Fri Aug 06 18:24:59.080024 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(774): [client 127.0.0.1:39490] oidc_util_http_form_encoded_data: data=grant_type=authorization_code&code=efa245ed-4d48-4c28-8b64-51db9fd7351e.a35984a9-1897-4884-befc-f207a4425c9e.0a2d1634-40f7-45e2-b12a-5dce9b444c5b&redirect_uri=http%3A%2F%2Fmysite.staging.corporationsite.io%2Fredirect_uri.html
[Fri Aug 06 18:24:59.080029 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(800): [client 127.0.0.1:39490] oidc_util_http_call: url=https://mysite.staging.corporationsite.io/auth/realms/Corporate/protocol/openid-connect/token, data=grant_type=authorization_code&code=efa245ed-4d48-4c28-8b64-51db9fd7351e.a35984a9-1897-4884-befc-f207a4425c9e.0a2d1634-40f7-45e2-b12a-5dce9b444c5b&redirect_uri=http%3A%2F%2Fmysite.staging.corporationsite.io%2Fredirect_uri.html, content_type=application/x-www-form-urlencoded, basic_auth=****, bearer_token=(null), ssl_validate_server=1, timeout=60, outgoing_proxy=(null), pass_cookies=0, ssl_cert=(null), ssl_key=(null), ssl_key_pwd=(null)
[Fri Aug 06 18:24:59.146415 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(993): [client 127.0.0.1:39490] oidc_util_http_call: HTTP response code=403
[Fri Aug 06 18:24:59.146441 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(998): [client 127.0.0.1:39490] oidc_util_http_call: response={"message":"Invalid token.","status_code":403}
[Fri Aug 06 18:24:59.146609 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/proto.c(2688): [client 127.0.0.1:39490] oidc_proto_validate_code_response: enter
[Fri Aug 06 18:24:59.146630 2021] [auth_openidc:error] [pid 10:tid 140455631124224] [client 127.0.0.1:39490] oidc_proto_validate_code_response: requested flow is "code" but no "id_token" parameter found in the code response
[Fri Aug 06 18:24:59.146634 2021] [auth_openidc:error] [pid 10:tid 140455631124224] [client 127.0.0.1:39490] oidc_proto_resolve_code_and_validate_response: code response validation failed
[Fri Aug 06 18:24:59.146666 2021] [authz_core:debug] [pid 10:tid 140455631124224] mod_authz_core.c(818): [client 127.0.0.1:39490] AH01626: authorization result of Require valid-user : granted
[Fri Aug 06 18:24:59.146681 2021] [authz_core:debug] [pid 10:tid 140455631124224] mod_authz_core.c(818): [client 127.0.0.1:39490] AH01626: authorization result of <RequireAny>: granted
[Fri Aug 06 18:24:59.146700 2021] [auth_openidc:debug] [pid 10:tid 140455631124224] src/util.c(1388): [client 127.0.0.1:39490] oidc_util_request_matches_url: comparing "/redirect_uri.html"=="/redirect_uri.html"
127.0.0.1 - "" [06/Aug/2021:18:24:59 +0000] "GET /redirect_uri.html?state=n9nFMREYj-k_YGVokoG35ZpDXW8&session_state=a35984a9-1897-4884-befc-f207a4425c9e&code=efa245ed-4d48-4c28-8b64-51db9fd7351e.a35984a9-1897-4884-befc-f207a4425c9e.0a2d1634-40f7-45e2-b12a-5dce9b444c5b HTTP/1.1" 200 335 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"

zandbelt · 2021-08-07T15:04:36Z

zandbelt
Aug 7, 2021
Maintainer

your provider does not return an id_token ("no "id_token" parameter found") so probably it has configured your client as an OAuth 2.0 client rather than an OpenID Connect client

1 reply

lucassena Aug 11, 2021
Author

I was able to find out where the problem was, it was a security system within our infrastructure. Anyway, I really appreciate your help.

lucassena · 2021-08-13T14:08:54Z

lucassena
Aug 13, 2021
Author

@zandbelt Unfortunately, we are still having this problem:

[Thu Aug 12 18:43:59.816394 2021] [auth_openidc:error] [pid 640:tid 140533368338176] [client 127.0.0.1:33148] oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!, referer: https://my.url.com/

In the field "Valid Redirect URI" we are using https://my.url.com/redirect_uri, and we are accessing https://my.url.com/. But even so, it seems that Keycloak understands as if we were accessing http.

Do you see anything in our setup that might be incorrect?

Thank you very much in advance for your attention and thank you very much for your work on this module.

1 reply

zandbelt Aug 13, 2021
Maintainer

see: #635 (reply in thread)
you'll need to provide that header on the LB

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Invalid parameter: redirect_uri #635

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 3 comments 7 replies

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

Select a reply

Invalid parameter: redirect_uri #635

lucassena Aug 4, 2021

Replies: 3 comments · 7 replies

zandbelt Aug 4, 2021 Maintainer

lucassena Aug 4, 2021 Author

zandbelt Aug 5, 2021 Maintainer

lucassena Aug 6, 2021 Author

zandbelt Aug 6, 2021 Maintainer

lucassena Aug 7, 2021 Author

zandbelt Aug 7, 2021 Maintainer

lucassena Aug 11, 2021 Author

lucassena Aug 13, 2021 Author

zandbelt Aug 13, 2021 Maintainer

lucassena
Aug 4, 2021

Replies: 3 comments 7 replies

zandbelt
Aug 4, 2021
Maintainer

lucassena Aug 4, 2021
Author

zandbelt Aug 5, 2021
Maintainer

lucassena Aug 6, 2021
Author

zandbelt Aug 6, 2021
Maintainer

lucassena Aug 7, 2021
Author

zandbelt
Aug 7, 2021
Maintainer

lucassena Aug 11, 2021
Author

lucassena
Aug 13, 2021
Author

zandbelt Aug 13, 2021
Maintainer