UUIDv4 vs UUIDv1 for mod_auth_openidc Session

[dwseiber]

We use apache 2.4.46.

We currently are only able to get UUIDv1 to generate. We are using the mod_auth_openidc 1.8.10 module.

I have tried using different versions of the mod_auth_openidc module, but I am not able to get anything besides UUIDv1 to generate. I looked at the documentation for 2.4.48, but I have not been able to find anything concerning UUID. At this point, we are looking at going RedHat apache 2.4.6 to see if the their standard install provides for UUIDv4.

Can UUIDv4 be generated using apache 2.4.46 or apache 2.4.48?

[zandbelt]

mod_auth_openidc uses libapr's http://apr.apache.org/docs/apr/trunk/group___a_p_r___u_u_i_d.html to generate UUIDs; I'm not even sure what version that is but cannot be changed without adapting the source code.

also: don't use 1.8.10 anymore, its almost 5 years old and has known vulnerabilities.

[dwseiber]

Thanks for your reply. We'll compare the version of mod_auth_openidc in any environments where UUID is being generated as v4. We'll then upgrade mod_auth_openidc to the relative version. I did research into those apr_uuid_get and apr_uuid_format functions, but was unable to find their source to see exactly how the UUID is being generated and formatted. Is this aspect of httpd's library not available to the public?

[zandbelt]

see also https://github.com/zmartzone/mod_auth_openidc/issues/431#issuecomment-1312811669