Error after upgrading from version 1.8.8 to 2.4.0

[nadav213000]

Hey,

I have tried to upgrade mod_auth_openidc module from version 1.8.8 to 2.4.0. The module worked good in the old version, but after upgrading to the new version, without changing any configuration the authentication has stopped working.

My configuration looks like this (there may be some typos in this configuration):

LoadModule auth_openidc_module modules/mod_auth_openidc.so

<VirtualHost *:443>
  OIDCProvidermetadataURL <op_proivder>/.well-known/openid-configuration
  OIDCSSLValidateServer off
  OIDCClientID <client_id>
  OIDCClientSecret <client_secret>
  OIDCRedirectURI <url_location>/redirect_uri
  OIDCCryptoPassphrase <passphrase>
  OIDCJWKSRefreshInterval 3600
  OIDCScope "openid email profile"
  OIDCRemoteUserClaim ...
  OIDCOAuthVerifyJwksUri ...
  OIDCPassClaimsAs environment
  OIDCStateTimeout 3600
  OIDCSessionMaxDuration 86400
  
  <LocationMatch "^\/((?!api\/).)*$">
  AuthType openid-connect
  require valid-user
  
  RequestHeader set ...
  ProxyPass <my_server>
  ProxyPassReverse <my_server>
  </LocationMatch>
</VirtualHost>

I have also changed the log level to debug and the logs look like that:

[auth_opendc:debug] oidc_util_http_call: response={"error": "unauthorized_client", "error_description":"Invalid client secret"} ...
[auth_openidc::error] ... oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""unauthorized_client"", referer: <my_server>/reirect_uri?state=....&session_state=...&code=...
[auth_openidc:error] oidc_proto_resolve_code_and_validate_response: failed to resolve the code, referer: <my_server>/reirect_uri?state=....&session_state=...&code=...
...
[ssl:info] The timeout specified has expired ... AH01991: SSL input filter read failed.
[ssl:debug] ssl_engine_io.c(993) ... AH02001: Connection closed to child 2 with standard shutdown ...

I haven't changed any configuration so invalid client secret seems weird, I have also have checked the client secret again to make sure it is right, and it is.

In the browser I get the error:

Error:
OpenID Connect Provider error: Error in handling response type.

Other details:

• httpd version - 2.4.6
• os_version - rhel 7
• mod_auth_openidc old version - 1.8.8
• mod_auth_openidc old version - 2.4.0

Do you know why version upgrading can cause this problem? also I haven't updated any other packages, only the one required by the mod_auth_openidc.

[zandbelt]

probably your secret contains characters that are not url-encoding safe; the older version did not encode those characters as the spec dictates, that is fixed in the newer version; your OP may not properly check (yet), so better change the client secret for now; also, upgrade to the latest release, 2.4.9, please