How should OIDCHTMLErrorTemplate be replaced?

[studersi]

Since version 2.4.14, the OIDCHTMLErrorTemplate is deprecated. How should this be replaced?

The release comment for versions 2.4.14* state that the directive OIDCHTMLErrorTemplate is deprecated and the Apache Error Page handling should be used instead. For compatibility, the deprecated keyword can be used. However, neither of these options are documented as far as I could tell.

The documentation still shows the old description of the OIDCHTMLErrorTemplate: https://github.com/OpenIDC/mod_auth_openidc/blob/v2.4.14.2/auth_openidc.conf#L723-L734

Leaving OIDCHTMLErrorTemplate /path/to/template as it was before still works, except in rare edge cases, where it does not (we do not know why yet but the use of this has broken logins in our setup and disabling the directive fixed the issue).

Using OIDCHTMLErrorTemplate deprecated reverts to the old behaviour but only the default page can be used. Specifying a custom page (e.g. OIDCHTMLErrorTemplate deprecated /path/to/template) does not work.

The solution using standard error pages appears more straight forward, as it uses well-documented Apache functionality. However, what would this look like for mod_auth_openidc? Which error pages need to be adapted (we have seen 401 and 500)?

Why do we get 500 Internal Server Error with a message Invalid Request, shouldn't those be in the 400s?

[zandbelt]

OIDCHTMLErrorTemplate /path/to/template should still work as before, except in some "stepup authentication" cases, we could dig in but I'd rather have you switch to the new setup; OIDCHTMLErrorTemplate deprecated is there to use the old internal template; error codes may include 400, 401, 403, 404, 500, 503 and 410/407 when configured in OIDCUnAuthAction; the most relevant to customize and display the error messages is 401, the others may be less useful for using facing messages

[studersi]

Ok, thanks for the info. We will be switching to the new setup, as you suggest and update the error pages accordingly.