Error in handling response type when using private_key_jwt #885

tpimh · 2022-07-20T08:33:13Z

tpimh
Jul 20, 2022

Still trying to enable MLE on Signicat, still failing. I have tried a lot of different configuration combinations, but the result is always the same. I have set up a local server with the hostname 'labs.signicat.com' and a self-signed SSL certificate: Error in handling response type. The actual response from the server is {"error":"invalid_client","error_description":"The client ID provided is not recognized in this Authorization server."} with status code 400.

I'm trying to copy the flow of their official demo OIDC-MLE example.

My config:

OIDCProviderMetadataURL https://preprod.signicat.com/oidc/.well-known/openid-configuration
OIDCClientID demo-ftnenc
OIDCClientSecret mqZ-_75-f2wNsiQTONb7On4aAZ7zc218mrRVk1oufa8
OIDCPathAuthRequestParams acr_values=urn:signicat:oidc:method:ftn-op-auth&ui_locales=en
OIDCPublicKeyFiles "/app/demo-preprod.key.pub"
OIDCPrivateKeyFiles "/app/demo-preprod.key"
OIDCProviderTokenEndpointAuth private_key_jwt
OIDCScope "openid profile"
OIDCStateMaxNumberOfCookies 10 true
OIDCUnAuthAction auth true
OIDCCookieSameSite On

OIDCRedirectURI /redirect
OIDCCryptoPassphrase TestingSignicat

ServerName labs.signicat.com
DocumentRoot /app/public
DirectoryIndex index.php
LogLevel debug

<Location /redirect>
AuthType openid-connect
Require valid-user
</Location>
<Location /signicat>
AuthType openid-connect
Require valid-user
</Location>

Public key:

Private key:

The full log:

oidc_check_user_id: incoming request: "/signicat?(null)", ap_is_initial_req(r)=1
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect
oidc_util_hdr_in_get: Cookie=PHPSESSID=4ejct6phqukrj3br36p9acb0o6; mod_auth_openidc_state_KEHRlgA_f4iyFKiMAfGICnN4_G0=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..dVJ14Ren53rJngSt.c1tFjvoNBTkUEiQqYGu8n5PIjHWKED5tHp9yfsiRU4fUPrNTuqd1qdluk-x51-UIT-xr0uvBNaYMOlbyr6Z7ncNULtHa-nx5LuV0Z22RJDtMoO2LfstTc5l6wfJA7fNWGtI3zHO728sZeXLATomt8UFsP9sdWLncl2sZFWdZlZfOi1MReOloNq2J4SF6yBm9V7dAKUb9V9jkntBs89KE8ZX5UhDgPHeE3Qj9D94H1FQSJ7IWuo3c1f6ulyziL6VbUCo1ZNkISH_yYBsyNtqY--1Dz8n9FCcGeSamiD8Lx48pzKpTUWJ3MEtOuUbyuyK-oVD23esIeovEzKK86GTTeSuYp4kWlPRHYKcYLl9M9nv4naVlL9I1JtA5cZnbArvV-_w5J0PCiZ96o3kW6BV-ah_jWYP-FESDsnHp5x8ENFwKraV64POOeV1CGewXYbZD7VSgcgcyUQVWG7d34Q4OebmOoidT5_rjf8eeKd5rMW6fOm_EiPArNslZMgT0ywhFB6FfnWrvTocksfpwoscSLMCC-9g7wTvkx0Bprg39YoD5pQ6PsxnWthkb2AEdy8o4lgB0J61AZOn09uW8WWVmdG-Oh6szxkzj0ecm0FEcPJ1TR56puRcsFdBA7wf4zTXn-hkAEoCStf2Qa4c3QGcScOB8uJQDSG3dg68hJ69wt6pkzZfTFW1LDto.2yJAHgHfS4zj-F1q-OR1jw
oidc_util_get_cookie: returning "mod_auth_openidc_session" = <null>
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect
oidc_util_request_matches_url: comparing "/signicat"=="/redirect"
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_current_url: current URL 'https://labs.signicat.com/signicat'
oidc_authenticate_user: enter
oidc_cache_get: enter: https://preprod.signicat.com/oidc/.well-known/openid-configuration (section=p, decrypt=0, type=shm)
oidc_cache_get: cache miss from shm cache backend for key https://preprod.signicat.com/oidc/.well-known/openid-configuration
oidc_util_http_query_encoded_url: url=https://preprod.signicat.com/oidc/.well-known/openid-configuration
oidc_util_http_call: url=https://preprod.signicat.com/oidc/.well-known/openid-configuration, data=(null), content_type=(null), basic_auth=(null), bearer_token=(null), ssl_validate_server=1, timeout=5, outgoing_proxy=(null), pass_cookies=0, ssl_cert=(null), ssl_key=(null)
oidc_util_http_call: HTTP response code=200
oidc_util_http_call: response={"issuer":"https://preprod.signicat.com/oidc","authorization_endpoint":"https://preprod.signicat.com/oidc/authorize","token_endpoint":"https://preprod.signicat.com/oidc/token","userinfo_endpoint":"https://preprod.signicat.com/oidc/userinfo","jwks_uri":"https://preprod.signicat.com/oidc/jwks.json","scopes_supported":["openid","profile","email","address","phone","offline_access"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token","client_credentials"],"subject_types_supported":["pairwise"],"id_token_signing_alg_values_supported":["RS256","RS256"],"id_token_encryption_alg_values_supported":["RSA1_5","RSA-OAEP","dir","A128KW","A256KW","ECDH-ES"],"id_token_encryption_enc_values_supported":["A128CBC-HS256"],"userinfo_signing_alg_values_supported":["RS256","RS256"],"userinfo_encryption_alg_values_supported":["RSA1_5","RSA-OAEP","dir","A128KW","A256KW","ECDH-ES"],"userinfo_encryption_enc_values_supported":["A128CBC-HS256"],"request_object_signing_alg_values_supported":["RS256","RS256"],"request_object_encryption_alg_values_supported":["RSA-OAEP"],"request_object_encryption_enc_values_supported":["A128CBC-HS256","A256CBC-HS512","A128GCM","A256GCM"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","client_secret_jwt","private_key_jwt"],"claim_types_supported":["normal","aggregated"],"claims_supported":["sub","name","family_name","given_name","middle_name","nickname","preferred_username","profile","picture","website","gender","birthdate","zoneinfo","locale","updated_at","email","email_verified","phone_number","phone_number_verified","address","address.formatted","address.street_address","address.locality","address.region","address.postal_code","address.country"],"service_documentation":"https://developer.signicat.com/","claims_parameter_supported":true,"request_parameter_supported":true,"request_uri_parameter_supported":false,"require_request_uri_registration":true,"op_policy_uri":"https://www.signicat.com/privacy-and-cookies/","check_session_iframe":"https://preprod.signicat.com/oidc/session/check","end_session_endpoint":"https://preprod.signicat.com/oidc/session/end","backchannel_logout_supported":true,"backchannel_logout_session_supported":false}
oidc_cache_set: enter: https://preprod.signicat.com/oidc/.well-known/openid-configuration (section=p, len=2295, encrypt=0, ttl(s)=86399, type=shm)
oidc_cache_set: successfully stored 2295 bytes in shm cache backend for key https://preprod.signicat.com/oidc/.well-known/openid-configuration
oidc_proto_generate_random_bytes: apr_generate_random_bytes call for 32 bytes
oidc_proto_generate_random_bytes: apr_generate_random_bytes returned
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect
oidc_util_request_matches_url: comparing "/signicat"=="/redirect"
oidc_get_browser_state_hash: enter
oidc_util_hdr_in_get: X-Forwarded-For=10.0.17.2
oidc_util_hdr_in_get: User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
oidc_util_create_symmetric_key: key_len=32
oidc_util_hdr_in_get: Cookie=PHPSESSID=4ejct6phqukrj3br36p9acb0o6; mod_auth_openidc_state_KEHRlgA_f4iyFKiMAfGICnN4_G0=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..dVJ14Ren53rJngSt.c1tFjvoNBTkUEiQqYGu8n5PIjHWKED5tHp9yfsiRU4fUPrNTuqd1qdluk-x51-UIT-xr0uvBNaYMOlbyr6Z7ncNULtHa-nx5LuV0Z22RJDtMoO2LfstTc5l6wfJA7fNWGtI3zHO728sZeXLATomt8UFsP9sdWLncl2sZFWdZlZfOi1MReOloNq2J4SF6yBm9V7dAKUb9V9jkntBs89KE8ZX5UhDgPHeE3Qj9D94H1FQSJ7IWuo3c1f6ulyziL6VbUCo1ZNkISH_yYBsyNtqY--1Dz8n9FCcGeSamiD8Lx48pzKpTUWJ3MEtOuUbyuyK-oVD23esIeovEzKK86GTTeSuYp4kWlPRHYKcYLl9M9nv4naVlL9I1JtA5cZnbArvV-_w5J0PCiZ96o3kW6BV-ah_jWYP-FESDsnHp5x8ENFwKraV64POOeV1CGewXYbZD7VSgcgcyUQVWG7d34Q4OebmOoidT5_rjf8eeKd5rMW6fOm_EiPArNslZMgT0ywhFB6FfnWrvTocksfpwoscSLMCC-9g7wTvkx0Bprg39YoD5pQ6PsxnWthkb2AEdy8o4lgB0J61AZOn09uW8WWVmdG-Oh6szxkzj0ecm0FEcPJ1TR56puRcsFdBA7wf4zTXn-hkAEoCStf2Qa4c3QGcScOB8uJQDSG3dg68hJ69wt6pkzZfTFW1LDto.2yJAHgHfS4zj-F1q-OR1jw
oidc_util_jwt_verify: enter: JWT header={"alg": "dir", "enc": "A256GCM"}
oidc_util_create_symmetric_key: key_len=32
oidc_clean_expired_state_cookies: state (mod_auth_openidc_state_KEHRlgA_f4iyFKiMAfGICnN4_G0) has expired (original_url=https://labs.signicat.com/redirect/?code=qhK3BdbZuTxFqSxVcbMPY1PcxqX6Dtz8&state=leIroEpk5gzXp8vsSsAqzZFhY8Q&session_state=8db34cdfec69dae2010dac93a95b6bbc7a5cf6fc4dff6337565065429dc8f4b6.AQxaVNoZdt3SCMVw)
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found
oidc_util_hdr_err_out_add: Set-Cookie: mod_auth_openidc_state_KEHRlgA_f4iyFKiMAfGICnN4_G0=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; HttpOnly; SameSite=None
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found
oidc_util_hdr_err_out_add: Set-Cookie: mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..sFOv_vF7y6bOhPq9.AHTZnOFGtQHwZt9QKN_TZHJxucFPeQEj9dQO30AQ3Qv6X58up8ieEUnua6rgKMCmePwtKMEDXSmxMlieVgvzlOleo_WJK5rN-_hI0mXeq5J4ERq8GYB9CEdF19PRqGVNmghIbSTSwVf2_ca0Vdx_KS-2XOObBtZKVNAnMipMY5cX1j_fOglQ_iwYuTYjijzhYLqvq7AXEdiq30WOLLHxQ_KbEpPk_nPrxTRpTUs2W2q-tHtONDR3p6YS9eTfX8CzDSEwE1yfiQBdrBwtGdEEjHe7aWGeBMFCd6fVUzvwu-NZkPOhBm3nHsDLfli9lK881AYMvNRHwpnbkhWVwhKVnONzZdZk8IZjM0Xew86EmUnhQ1jr_Xwf2Vobb95l9Visw-lK3VolEQ.oscsOuFI_4st5FvnHBL6oQ; Path=/; Secure; HttpOnly; SameSite=Lax
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: Host=labs.signicat.com
oidc_util_hdr_in_get: X-Forwarded-Proto=https
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect
oidc_proto_authorization_request: enter, issuer=https://preprod.signicat.com/oidc, redirect_uri=https://labs.signicat.com/redirect, state=3ChKW_a2KFukH3ciaEpVLPzGDHo, proto_state={"ou":"https://labs.signicat.com/signicat","om":"get","i":"https://preprod.signicat.com/oidc","rt":"code","n":"p72g2sx9vHh1nS9QbHLSCpGPkPFjSpueCnEqa0eLFGA","t":1658304559}, code_challenge=(null), auth_request_params=acr_values=urn:signicat:oidc:method:ftn-op-auth&ui_locales=en, path_scope=(null)
oidc_util_http_add_form_url_encoded_param: processing: response_type=code
oidc_util_http_add_form_url_encoded_param: processing: scope=openid profile
oidc_util_http_add_form_url_encoded_param: processing: client_id=demo-ftnenc
oidc_util_http_add_form_url_encoded_param: processing: state=3ChKW_a2KFukH3ciaEpVLPzGDHo
oidc_util_http_add_form_url_encoded_param: processing: redirect_uri=https://labs.signicat.com/redirect
oidc_util_http_add_form_url_encoded_param: processing: nonce=p72g2sx9vHh1nS9QbHLSCpGPkPFjSpueCnEqa0eLFGA
oidc_util_http_add_form_url_encoded_param: processing: acr_values=urn:signicat:oidc:method:ftn-op-auth
oidc_util_http_add_form_url_encoded_param: processing: ui_locales=en
oidc_util_http_query_encoded_url: url=https://preprod.signicat.com/oidc/authorize?response_type=code&scope=openid%20profile&client_id=demo-ftnenc&state=3ChKW_a2KFukH3ciaEpVLPzGDHo&redirect_uri=https%3A%2F%2Flabs.signicat.com%2Fredirect&nonce=p72g2sx9vHh1nS9QbHLSCpGPkPFjSpueCnEqa0eLFGA&acr_values=urn%3Asignicat%3Aoidc%3Amethod%3Aftn-op-auth&ui_locales=en
oidc_util_hdr_table_set: Location: https://preprod.signicat.com/oidc/authorize?response_type=code&scope=openid%20profile&client_id=demo-ftnenc&state=3ChKW_a2KFukH3ciaEpVLPzGDHo&redirect_uri=https%3A%2F%2Flabs.signicat.com%2Fredirect&nonce=p72g2sx9vHh1nS9QbHLSCpGPkPFjSpueCnEqa0eLFGA&acr_values=urn%3Asignicat%3Aoidc%3Amethod%3Aftn-op-auth&ui_locales=en
oidc_util_hdr_err_out_add: Cache-Control: no-cache, no-store, max-age=0
oidc_proto_authorization_request: return: 302
AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: https://preprod.signicat.com/
AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: https://preprod.signicat.com/
oidc_check_user_id: incoming request: "/redirect?code=NWF0COjS1cOcneuFZK4CSDAIUH26t_XR&state=3ChKW_a2KFukH3ciaEpVLPzGDHo&session_state=d85eaa64b60b31b326096dbd860325b1f0f20f13c81b4baf399ea4f479a562e6.aLNv1j_gxdMjujef", ap_is_initial_req(r)=1, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Cookie=PHPSESSID=4ejct6phqukrj3br36p9acb0o6; mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..sFOv_vF7y6bOhPq9.AHTZnOFGtQHwZt9QKN_TZHJxucFPeQEj9dQO30AQ3Qv6X58up8ieEUnua6rgKMCmePwtKMEDXSmxMlieVgvzlOleo_WJK5rN-_hI0mXeq5J4ERq8GYB9CEdF19PRqGVNmghIbSTSwVf2_ca0Vdx_KS-2XOObBtZKVNAnMipMY5cX1j_fOglQ_iwYuTYjijzhYLqvq7AXEdiq30WOLLHxQ_KbEpPk_nPrxTRpTUs2W2q-tHtONDR3p6YS9eTfX8CzDSEwE1yfiQBdrBwtGdEEjHe7aWGeBMFCd6fVUzvwu-NZkPOhBm3nHsDLfli9lK881AYMvNRHwpnbkhWVwhKVnONzZdZk8IZjM0Xew86EmUnhQ1jr_Xwf2Vobb95l9Visw-lK3VolEQ.oscsOuFI_4st5FvnHBL6oQ, referer: https://preprod.signicat.com/
oidc_util_get_cookie: returning "mod_auth_openidc_session" = <null>, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect, referer: https://preprod.signicat.com/
oidc_util_request_matches_url: comparing "/redirect"=="/redirect", referer: https://preprod.signicat.com/
oidc_handle_redirect_authorization_response: enter, referer: https://preprod.signicat.com/
oidc_util_read_form_encoded_params: read: code=NWF0COjS1cOcneuFZK4CSDAIUH26t_XR, referer: https://preprod.signicat.com/
oidc_util_read_form_encoded_params: read: state=3ChKW_a2KFukH3ciaEpVLPzGDHo, referer: https://preprod.signicat.com/
oidc_util_read_form_encoded_params: read: session_state=d85eaa64b60b31b326096dbd860325b1f0f20f13c81b4baf399ea4f479a562e6.aLNv1j_gxdMjujef, referer: https://preprod.signicat.com/
oidc_util_read_form_encoded_params: parsed: 167 bytes into 3 elements, referer: https://preprod.signicat.com/
oidc_handle_authorization_response: enter, response_mode=query, referer: https://preprod.signicat.com/
oidc_authorization_response_match_state: enter (state=3ChKW_a2KFukH3ciaEpVLPzGDHo), referer: https://preprod.signicat.com/
oidc_restore_proto_state: enter, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Cookie=PHPSESSID=4ejct6phqukrj3br36p9acb0o6; mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..sFOv_vF7y6bOhPq9.AHTZnOFGtQHwZt9QKN_TZHJxucFPeQEj9dQO30AQ3Qv6X58up8ieEUnua6rgKMCmePwtKMEDXSmxMlieVgvzlOleo_WJK5rN-_hI0mXeq5J4ERq8GYB9CEdF19PRqGVNmghIbSTSwVf2_ca0Vdx_KS-2XOObBtZKVNAnMipMY5cX1j_fOglQ_iwYuTYjijzhYLqvq7AXEdiq30WOLLHxQ_KbEpPk_nPrxTRpTUs2W2q-tHtONDR3p6YS9eTfX8CzDSEwE1yfiQBdrBwtGdEEjHe7aWGeBMFCd6fVUzvwu-NZkPOhBm3nHsDLfli9lK881AYMvNRHwpnbkhWVwhKVnONzZdZk8IZjM0Xew86EmUnhQ1jr_Xwf2Vobb95l9Visw-lK3VolEQ.oscsOuFI_4st5FvnHBL6oQ, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Cookie=PHPSESSID=4ejct6phqukrj3br36p9acb0o6; mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo=eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..sFOv_vF7y6bOhPq9.AHTZnOFGtQHwZt9QKN_TZHJxucFPeQEj9dQO30AQ3Qv6X58up8ieEUnua6rgKMCmePwtKMEDXSmxMlieVgvzlOleo_WJK5rN-_hI0mXeq5J4ERq8GYB9CEdF19PRqGVNmghIbSTSwVf2_ca0Vdx_KS-2XOObBtZKVNAnMipMY5cX1j_fOglQ_iwYuTYjijzhYLqvq7AXEdiq30WOLLHxQ_KbEpPk_nPrxTRpTUs2W2q-tHtONDR3p6YS9eTfX8CzDSEwE1yfiQBdrBwtGdEEjHe7aWGeBMFCd6fVUzvwu-NZkPOhBm3nHsDLfli9lK881AYMvNRHwpnbkhWVwhKVnONzZdZk8IZjM0Xew86EmUnhQ1jr_Xwf2Vobb95l9Visw-lK3VolEQ.oscsOuFI_4st5FvnHBL6oQ, referer: https://preprod.signicat.com/
oidc_util_get_cookie: returning "mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo" = "eyJhbGciOiAiZGlyIiwgImVuYyI6ICJBMjU2R0NNIn0..sFOv_vF7y6bOhPq9.AHTZnOFGtQHwZt9QKN_TZHJxucFPeQEj9dQO30AQ3Qv6X58up8ieEUnua6rgKMCmePwtKMEDXSmxMlieVgvzlOleo_WJK5rN-_hI0mXeq5J4ERq8GYB9CEdF19PRqGVNmghIbSTSwVf2_ca0Vdx_KS-2XOObBtZKVNAnMipMY5cX1j_fOglQ_iwYuTYjijzhYLqvq7AXEdiq30WOLLHxQ_KbEpPk_nPrxTRpTUs2W2q-tHtONDR3p6YS9eTfX8CzDSEwE1yfiQBdrBwtGdEEjHe7aWGeBMFCd6fVUzvwu-NZkPOhBm3nHsDLfli9lK881AYMvNRHwpnbkhWVwhKVnONzZdZk8IZjM0Xew86EmUnhQ1jr_Xwf2Vobb95l9Visw-lK3VolEQ.oscsOuFI_4st5FvnHBL6oQ", referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_util_set_cookie_append_value: no cookie append environment variable OIDC_SET_COOKIE_APPEND found, referer: https://preprod.signicat.com/
oidc_util_hdr_err_out_add: Set-Cookie: mod_auth_openidc_state_3ChKW_a2KFukH3ciaEpVLPzGDHo=; Path=/; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; HttpOnly; SameSite=None, referer: https://preprod.signicat.com/
oidc_util_jwt_verify: enter: JWT header={"alg": "dir", "enc": "A256GCM"}, referer: https://preprod.signicat.com/
oidc_util_create_symmetric_key: key_len=32, referer: https://preprod.signicat.com/
oidc_get_browser_state_hash: enter, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-For=10.0.17.2, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: User-Agent=Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0, referer: https://preprod.signicat.com/
oidc_restore_proto_state: restored state: {"ou":"https://labs.signicat.com/signicat","om":"get","i":"https://preprod.signicat.com/oidc","rt":"code","n":"p72g2sx9vHh1nS9QbHLSCpGPkPFjSpueCnEqa0eLFGA","t":1658304559,"s":"3ChKW_a2KFukH3ciaEpVLPzGDHo"}, referer: https://preprod.signicat.com/
oidc_cache_get: enter: https://preprod.signicat.com/oidc/.well-known/openid-configuration (section=p, decrypt=0, type=shm), referer: https://preprod.signicat.com/
oidc_cache_get: cache hit: return 2295 bytes from shm cache backend for key https://preprod.signicat.com/oidc/.well-known/openid-configuration, referer: https://preprod.signicat.com/
oidc_proto_handle_authorization_response_code: enter, referer: https://preprod.signicat.com/
oidc_proto_validate_issuer_client_id: iss and/or client_id matched OK: (null), https://preprod.signicat.com/oidc, (null), demo-ftnenc, referer: https://preprod.signicat.com/
oidc_proto_resolve_code: enter, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect, referer: https://preprod.signicat.com/
oidc_proto_token_endpoint_auth: token_endpoint_auth=private_key_jwt, referer: https://preprod.signicat.com/
oidc_proto_endpoint_auth_private_key_jwt: enter, referer: https://preprod.signicat.com/
oidc_proto_generate_random_bytes: apr_generate_random_bytes call for 16 bytes, referer: https://preprod.signicat.com/
oidc_proto_generate_random_bytes: apr_generate_random_bytes returned, referer: https://preprod.signicat.com/
oidc_util_http_add_form_url_encoded_param: processing: grant_type=authorization_code, referer: https://preprod.signicat.com/
oidc_util_http_add_form_url_encoded_param: processing: code=NWF0COjS1cOcneuFZK4CSDAIUH26t_XR, referer: https://preprod.signicat.com/
oidc_util_http_add_form_url_encoded_param: processing: redirect_uri=https://labs.signicat.com/redirect, referer: https://preprod.signicat.com/
oidc_util_http_add_form_url_encoded_param: processing: client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer, referer: https://preprod.signicat.com/
oidc_util_http_add_form_url_encoded_param: processing: client_assertion=eyJhbGciOiAiUlMyNTYiLCAia2lkIjogIjRtNVNlcndtOUpQdDJEbWNFZjBuRWRmLUtIMFJRdl8yS0JjcmI1SUwwencifQ.eyJpc3MiOiJkZW1vLWZ0bmVuYyIsInN1YiI6ImRlbW8tZnRuZW5jIiwiYXVkIjoiaHR0cHM6Ly9wcmVwcm9kLnNpZ25pY2F0LmNvbS9vaWRjL3Rva2VuIiwianRpIjoic0dKSlpDMml1MnpNbkxEajRVSW9sQSIsImV4cCI6MTY1ODMwNDYyNiwiaWF0IjoxNjU4MzA0NTY2fQ.fIZvnCRSdqW_xGMdrprAqM0Zz3NMUzxs9pJn5nEnyfaglmbyqC545LXrwVw1Jz8LAjovRHPVG_vhfqaZ5qQMCxKx1U2XoRfPDwglKTgOGkERH6SzuoCAOl4o9QkG8HzalNzKHDbsQdnh0CUBNKcA1Ic9oxA-eI6PcbuUe1w4sHKH3lVDSCJ_s8UdV_CTR--hJqUMpK0SWp5wKoNf7kmNUbRzVwJe8d4x-JlreBIASeYl1uAlPSzcwnT_QmywV-rMwPY7I2O71QuoD9LwDYLPWOFV343RGJhFJJ8on6NR60KrNzcNA3F5cVihQHd1jR29q0QeLqaqS12YItoAklzn18mW659GmefLLWKHmFw_m1fbhd3ZF1bpvRB_np12mhiU6lc7Ml10yCSGCT7JHD0xHfUQXWAnSdrk_hC3PqpVVfsKNJ30_7JCctKQEJAm4J_Es3EaLyePs2ahSdfueh1wxUwJsSpLUDqidjguvWmcx7wmajxzyiKpzkrNGk-AeaXvxaih4NtlQnIy4wOg9sAStKimJVmePI33fbMNaU1jcCrghRkGCtnwLEbzIjw3KrP0b8iEfUlB8doCKy_0H_MZR00Vf9guX2tTB-g59jgKqnbHcbd1Rrx8da2DBmSgxWNDJ14V94laMU05Dqend5xxVEVgP10kmhmWqwP17FRQlz0, referer: https://preprod.signicat.com/
oidc_util_http_form_encoded_data: data=grant_type=authorization_code&code=NWF0COjS1cOcneuFZK4CSDAIUH26t_XR&redirect_uri=https%3A%2F%2Flabs.signicat.com%2Fredirect&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=eyJhbGciOiAiUlMyNTYiLCAia2lkIjogIjRtNVNlcndtOUpQdDJEbWNFZjBuRWRmLUtIMFJRdl8yS0JjcmI1SUwwencifQ.eyJpc3MiOiJkZW1vLWZ0bmVuYyIsInN1YiI6ImRlbW8tZnRuZW5jIiwiYXVkIjoiaHR0cHM6Ly9wcmVwcm9kLnNpZ25pY2F0LmNvbS9vaWRjL3Rva2VuIiwianRpIjoic0dKSlpDMml1MnpNbkxEajRVSW9sQSIsImV4cCI6MTY1ODMwNDYyNiwiaWF0IjoxNjU4MzA0NTY2fQ.fIZvnCRSdqW_xGMdrprAqM0Zz3NMUzxs9pJn5nEnyfaglmbyqC545LXrwVw1Jz8LAjovRHPVG_vhfqaZ5qQMCxKx1U2XoRfPDwglKTgOGkERH6SzuoCAOl4o9QkG8HzalNzKHDbsQdnh0CUBNKcA1Ic9oxA-eI6PcbuUe1w4sHKH3lVDSCJ_s8UdV_CTR--hJqUMpK0SWp5wKoNf7kmNUbRzVwJe8d4x-JlreBIASeYl1uAlPSzcwnT_QmywV-rMwPY7I2O71QuoD9LwDYLPWOFV343RGJhFJJ8on6NR60KrNzcNA3F5cVihQHd1jR29q0QeLqaqS12YItoAklzn18mW659GmefLLWKHmFw_m1fbhd3ZF1bpvRB_np12mhiU6lc7Ml10yCSGCT7JHD0xHfUQXWAnSdrk_hC3PqpVVfsKNJ30_7JCctKQEJAm4J_Es3EaLyePs2ahSdfueh1wxUwJsSpLUDqidjguvWmcx7wmajxzyiKpzkrNGk-AeaXvxaih4NtlQnIy4wOg9sAStKimJVmePI33fbMNaU1jcCrghRkGCtnwLEbzIjw3KrP0b8iEfUlB8doCKy_0H_MZR00Vf9guX2tTB-g59jgKqnbHcbd1Rrx8da2DBmSgxWNDJ14V94laMU05Dqend5xxVEVgP10kmhmWqwP17FRQlz0, referer: https://preprod.signicat.com/
oidc_util_http_call: url=https://preprod.signicat.com/oidc/token, data=grant_type=authorization_code&code=NWF0COjS1cOcneuFZK4CSDAIUH26t_XR&redirect_uri=https%3A%2F%2Flabs.signicat.com%2Fredirect&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&client_assertion=eyJhbGciOiAiUlMyNTYiLCAia2lkIjogIjRtNVNlcndtOUpQdDJEbWNFZjBuRWRmLUtIMFJRdl8yS0JjcmI1SUwwencifQ.eyJpc3MiOiJkZW1vLWZ0bmVuYyIsInN1YiI6ImRlbW8tZnRuZW5jIiwiYXVkIjoiaHR0cHM6Ly9wcmVwcm9kLnNpZ25pY2F0LmNvbS9vaWRjL3Rva2VuIiwianRpIjoic0dKSlpDMml1MnpNbkxEajRVSW9sQSIsImV4cCI6MTY1ODMwNDYyNiwiaWF0IjoxNjU4MzA0NTY2fQ.fIZvnCRSdqW_xGMdrprAqM0Zz3NMUzxs9pJn5nEnyfaglmbyqC545LXrwVw1Jz8LAjovRHPVG_vhfqaZ5qQMCxKx1U2XoRfPDwglKTgOGkERH6SzuoCAOl4o9QkG8HzalNzKHDbsQdnh0CUBNKcA1Ic9oxA-eI6PcbuUe1w4sHKH3lVDSCJ_s8UdV_CTR--hJqUMpK0SWp5wKoNf7kmNUbRzVwJe8d4x-JlreBIASeYl1uAlPSzcwnT_QmywV-rMwPY7I2O71QuoD9LwDYLPWOFV343RGJhFJJ8on6NR60KrNzcNA3F5cVihQHd1jR29q0QeLqaqS12YItoAklzn18mW659GmefLLWKHmFw_m1fbhd3ZF1bpvRB_np12mhiU6lc7Ml10yCSGCT7JHD0xHfUQXWAnSdrk_hC3PqpVVfsKNJ30_7JCctKQEJAm4J_Es3EaLyePs2ahSdfueh1wxUwJsSpLUDqidjguvWmcx7wmajxzyiKpzkrNGk-AeaXvxaih4NtlQnIy4wOg9sAStKimJVmePI33fbMNaU1jcCrghRkGCtnwLEbzIjw3KrP0b8iEfUlB8doCKy_0H_MZR00Vf9guX2tTB-g59jgKqnbHcbd1Rrx8da2DBmSgxWNDJ14V94laMU05Dqend5xxVEVgP10kmhmWqwP17FRQlz0, content_type=application/x-www-form-urlencoded, basic_auth=(null), bearer_token=(null), ssl_validate_server=1, timeout=60, outgoing_proxy=(null), pass_cookies=0, ssl_cert=(null), ssl_key=(null), referer: https://preprod.signicat.com/
oidc_util_http_call: HTTP response code=400, referer: https://preprod.signicat.com/
oidc_util_http_call: response={"error":"invalid_client","error_description":"The client ID provided is not recognized in this Authorization server."}, referer: https://preprod.signicat.com/
oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""invalid_client"", referer: https://preprod.signicat.com/
oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error_description" entry with value: ""The client ID provided is not recognized in this Authorization server."", referer: https://preprod.signicat.com/
oidc_proto_resolve_code_and_validate_response: failed to resolve the code, referer: https://preprod.signicat.com/
AH01626: authorization result of Require valid-user : granted, referer: https://preprod.signicat.com/
AH01626: authorization result of <RequireAny>: granted, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: Host=labs.signicat.com, referer: https://preprod.signicat.com/
oidc_util_hdr_in_get: X-Forwarded-Proto=https, referer: https://preprod.signicat.com/
oidc_get_redirect_uri: determined absolute redirect uri: https://labs.signicat.com/redirect, referer: https://preprod.signicat.com/
oidc_util_request_matches_url: comparing "/redirect"=="/redirect", referer: https://preprod.signicat.com/

Sorry for this wall of text. I think I'm missing something very trivial, but everything except for the very last step in authentication seems correct. Are there any obvious errors in my configuration?

zandbelt · 2022-07-20T08:43:55Z

zandbelt
Jul 20, 2022
Maintainer

Are you sure that your Provider supports private_key_jwt in the standardized way, i.e. is the software OpenID Connect certified? Because it seems that the Provider is rejecting the client based on the client ID ("demo-ftnenc") that is correctly sent by mod_auth_openidc in the sub claim of the assertion, which is what the standard dictates.

8 replies

tpimh Jul 21, 2022
Author

Thank you very much for your suggestion! Unfortunately, it didn't help, I still get the same result from the token endpoint (error 400). To me, both implementation seem to have all the same information, mod_auth_openidc sends some extra fields, but these should just be ignored by the OP and shouldn't cause this error.

authorize endpoint should receive these: ui_locales, scope, acr_values, response_type, redirect_uri, state, client_id. mod_auth_openidc sends these: ui_locales, scope, acr_values, response_type, redirect_uri, state, client_id, nonce.

token endpoint should receive these: client_id, redirect_uri, grant_type, code.
mod_auth_openidc sends these: client_id, redirect_uri, grant_type, code, client_assertion_type, client_assertion.

Since the extra fields shouldn't be a problem, I have no idea what can be causing this error.

zandbelt Jul 21, 2022
Maintainer

Looking at that Python code you should not be using private_key_jwt but just client_secret_basicsince that code sends its credentials in the Authorization header instead of a signed assertion.

tpimh Jul 21, 2022
Author

The authorize request is actually encrypted using the JWT encrypted request, and token endpoint is using client_secret_basic.

zandbelt Jul 21, 2022
Maintainer

sure, you can implement the request using OIDCRequestObject but apparently the query-based authorization request just works fine and gets you to the token request already

tpimh Jul 21, 2022
Author

Yes, I have noticed that the authorize works, but the token fails. I am now switching to an alternative solution. Thank you very much for your help! I hope I will solve it at some point.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Error in handling response type when using private_key_jwt #885

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 8 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Error in handling response type when using private_key_jwt #885

Uh oh!

tpimh Jul 20, 2022

Replies: 1 comment · 8 replies

Uh oh!

zandbelt Jul 20, 2022 Maintainer

Uh oh!

tpimh Jul 21, 2022 Author

Uh oh!

zandbelt Jul 21, 2022 Maintainer

Uh oh!

tpimh Jul 21, 2022 Author

Uh oh!

zandbelt Jul 21, 2022 Maintainer

Uh oh!

tpimh Jul 21, 2022 Author

tpimh
Jul 20, 2022

Replies: 1 comment 8 replies

zandbelt
Jul 20, 2022
Maintainer

tpimh Jul 21, 2022
Author

zandbelt Jul 21, 2022
Maintainer

tpimh Jul 21, 2022
Author

zandbelt Jul 21, 2022
Maintainer

tpimh Jul 21, 2022
Author