Response body replaced with error body when using RequireAny and OIDCUnAuthzAction #934

takesson · 2022-10-13T20:45:29Z

takesson
Oct 13, 2022

I had these Require statements at one point and saw some strange behaviour.

<Location /something >
  <RequireAll>
    Require valid-user
    Require method GET
    <RequireAny>
      Require claim roles:CmsAdmin
      Require claim roles:CmsUser
    </RequireAny>
  </RequireAll>
</Location>

The response was 200 OK but the body was replaces with:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <title>Authorization Error Redirect</title>
    <meta http-equiv="refresh" content="0; url=/openidc/errors/roles/">
  </head>
  <body>
<p></p>
  </body>
</html>

Seems to happen in combination with:

OIDCUnAutzAction 302 /openidc/errors/roles/

It can be worked around in this case by replacing RequireAny-section with a single Require claim regex.

zandbelt · 2022-10-14T06:50:21Z

zandbelt
Oct 14, 2022
Maintainer

thanks for the heads up, this limitation was indeed not documented; I have added a note here and to the wiki https://github.com/zmartzone/mod_auth_openidc/wiki/Step-up-Authentication

2 replies

takesson Oct 14, 2022
Author

Good, do you think it is incompatible with RequireAll?

Thanks

zandbelt Oct 14, 2022
Maintainer

edit: it is incompatible with RequireAny and multiple Require statements since the module is only called for every Require statement individually but is unaware of the overall result, which may involve other authentication methods/modules as well

as it happens, it does work for RequireAll since the overall result is determined by the invididual Require statement as evaluated by the module, I'l adapt the docs for that

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Response body replaced with error body when using RequireAny and OIDCUnAuthzAction #934

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

Response body replaced with error body when using RequireAny and OIDCUnAuthzAction #934

Uh oh!

takesson Oct 13, 2022

Replies: 1 comment · 2 replies

Uh oh!

zandbelt Oct 14, 2022 Maintainer

Uh oh!

takesson Oct 14, 2022 Author

Uh oh!

Uh oh!

zandbelt Oct 14, 2022 Maintainer

takesson
Oct 13, 2022

Replies: 1 comment 2 replies

zandbelt
Oct 14, 2022
Maintainer

takesson Oct 14, 2022
Author

zandbelt Oct 14, 2022
Maintainer