Installation mod_oauth2

[ftaddia]

In my Docker image based on "registry.redhat.io/ubi10/httpd-24:latest," I've already installed "mod_auth_openidc" via "dnf." I wanted to install "mod_oauth2" because I need to manage introspection with two IdPs via "OAuth2TokenVerify." I was wondering how I could use this module in my Docker image.

Thanks

[zandbelt]

you'll need to compile from source until a RHEL 10 package is provided in the next release cycle

[ftaddia]

Yes, ok, but even if I were to use UBI9 and copy the rpm file compiled by you, the required dependencies would still not be installed and I would have to manage everything manually, even risking making mistakes. This does not happen when I install mod_auth_openidc. Isn't it possible to have the same simplicity for the mod_oauth2 package as well?

NOTE: If it's not possible to have the same simplicity as mod_auth_openidc, can you show me the steps to correctly install the module, since it's not mentioned in the documentation?

Thanks

[zandbelt]

RHEL 9 RPM is available from https://github.com/OpenIDC/mod_oauth2/releases

[ftaddia]

Yes, thank you, but as I was saying, by installing the rpm file directly, the dependencies are not resolved and therefore their installation becomes complex, since it has to be done manually.

[ftaddia]

I managed to install mod_oauth2 (with some difficulty).

This is my basic Dockerfile (I also have another Dockerfile with which:

FROM registry.redhat.io/ubi9/httpd-24:latest

USER root

COPY common.conf cin_security.conf /etc/httpd/conf.d/

COPY deps/*.rpm /deps/

RUN mkdir -p /etc/httpd/include /etc/httpd/config-maps /etc/httpd/oidc-providers \
    && chmod 777 /etc/httpd/include /etc/httpd/oidc-providers \
    && rm -f /var/www/html/index.html /etc/httpd/conf.d/welcome.conf \
    && sed -i 's/LogLevel warn/LogLevel error/g' ${HTTPD_MAIN_CONF_PATH}/httpd.conf \
    && sed -i 's/.*LogFormat .* common/LogFormat "%a %l %u %t \\"%r\\" %>s %b \\"%{Referer}i\\" \\"%{User-Agent}i\\" %{JSESSIONID}C %T" common/g' ${HTTPD_MAIN_CONF_PATH}/httpd.conf \
    && sed -i 's/.*LogFormat .* combined/LogFormat "%a %l %u %t \\"%r\\" %>s %b \\"%{Referer}i\\" \\"%{User-Agent}i\\" %{JSESSIONID}C %T" combined/g' ${HTTPD_MAIN_CONF_PATH}/httpd.conf \
    && dnf -y update \
    && dnf -y install ncurses nmap-ncat iputils libmemcached-awesome.x86_64 mod_auth_openidc \
    && dnf -y install /deps/hiredis-1.0.2-2.el9.x86_64.rpm \
    && rpm -ivh --nodeps /deps/liboauth2-2.1.1-1.el9.x86_64.rpm \
    && dnf -y install /deps/liboauth2-apache-2.1.1-1.el9.x86_64.rpm \
    && rpm -ivh --nodeps /deps/mod_oauth2-4.0.0-1.el9.x86_64.rpm \
    && dnf clean all \
    && rm -rf /deps/ \
    && usermod -a -G apache default

ENV HOME='/home'

USER 1001

The problem is that I get coredumps, which I can't explain why, after installing mod_oauth2.

These are the complete logs:

enigmi-httpd-84c96789d-bmlj4-enigmi-httpd.log

This is the configuration for oidc:

OIDCMetadataDir /etc/httpd/oidc-providers
OIDCRedirectURI "https://${FQDN_URL}/callback"
OIDCScope "${OIDC_SCOPE}"
OIDCRemoteUserClaim "${OIDC_REMOTE_USER}"
OIDCCryptoPassphrase "${OIDC_PASSPHRASE}"
OIDCPathAuthRequestParams "${OIDC_ACR_VALUES}"
OIDCSessionMaxDuration 86400
OIDCSessionInactivityTimeout 14400
OIDCInfoHook access_token id_token userinfo remote_user
OIDCDiscoverURL https://${FQDN_URL}/callback?iss=https%3A%2F%2F${OIDC_ISSUER}


<Location "/callback">
    AuthType openid-connect
    Require claim aud:ac_oic_client
</Location>


<Location "/login">
    AuthType openid-connect
    Require valid-user
    Header add Set-Cookie "remoteUser=%{OIDC_CLAIM_${OIDC_REMOTE_USER}}e; Path=/; Secure" env=OIDC_CLAIM_${OIDC_REMOTE_USER}
    Header add Set-Cookie "accessToken=%{OIDC_access_token}e; Path=/; Secure" env=OIDC_access_token
    Header add Set-Cookie "fiscalCode=%{OIDC_CLAIM_fiscalCode}e; Path=/; Secure" env=OIDC_CLAIM_fiscalCode
    Header add Set-Cookie "impersonatorUsername=%{OIDC_CLAIM_impersonator_username}e; Path=/; Secure" env=OIDC_CLAIM_impersonator_username
</Location>

<LocationMatch "/resources">
    AuthType openid-connect
    Require valid-user
</LocationMatch>

<LocationMatch "/resProc">
    AuthType openid-connect
    Require claim ${OIDC_REMOTE_USER}~^(${INTERNAL_USERS_REGEX})$
</LocationMatch>

<Location /xway/application/xdocway/engine>
    AuthType openid-connect
    Require valid-user
</Location>

<Location /xway/application/xdocway/engine/xdocwayadm.jsp>
    AuthType openid-connect
    <RequireAny>
        Require claim ${OIDC_REMOTE_USER}~^(${INTERNAL_USERS_REGEX})$
        Require claim ${OIDC_REMOTE_USER}~^(${ADM_USERS_REGEX})$
    </RequireAny>
</Location>

<Location /xway/base/acl/engine>
    AuthType openid-connect
    Require valid-user
</Location>

<LocationMatch "^/xway/(trasparenza|titulus_ws_rest)">
    AuthType openid-connect
    Require valid-user
</LocationMatch>

<LocationMatch "^/albo/(adm|servlet)">
    AuthType openid-connect
    Require valid-user
</LocationMatch>

<LocationMatch "^/(TitulusConsole|Scheduler)">
    AuthType openid-connect
    Require claim ${OIDC_REMOTE_USER}~^(${INTERNAL_USERS_REGEX})$
</LocationMatch>

This is the one for oauth2:

OAuth2TokenVerify metadata https://${OIDC_ISSUER}/.well-known/openid-configuration introspect.auth=client_secret_post&client_id=${OIDC_CLIENT_ID}&client_secret=${OIDC_SECRET}
OAuth2TokenVerify metadata https://${CINECA_OIDC_ISSUER}/.well-known/openid-configuration introspect.auth=client_secret_post&client_id=${CINECA_OIDC_CLIENT_ID}&client_secret=${CINECA_OIDC_SECRET}

<LocationMatch "/resJwt">
    AuthType oauth2
    Require valid-user
</LocationMatch>

I hope I've provided all the information you need to get support and understand how to solve problems.

Thanks

[zandbelt]

the core dump seems bad indeed but I don't have the time to reproduce