Server responds with 200 on OIDC error redirect #1221
-
|
I have everything set up so it almost works to my liking :) There's just one thing. When the OIDC server encounters an error and reports it back using a redirect (with the GET /oauth_redir?error=access_denied&state=<some-state>&iss=<my-url-encoded-issuer-uri><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Error</title>
</head>
<body>
<p>Error: <pre>Invalid Request</pre></p><p>Description: <pre>SSO to this module without specifying a "target_link_uri" parameter is not possible because OIDCDefaultURL is not set.</pre></p>
</body>
</html>By accident I discovered that, when simulating the same flow without the GET /oauth_redir?error=access_denied&state=<some-state><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Error</title>
</head>
<body>
<p>Error: <pre>OpenID Connect Provider error: access_denied</pre></p>
</body>
</html>Strangely, the Apache log claims this is a 500 error, but I'm very certain that this is not what is actually sent to the client. I have built a very short test script with hurl to replicate this: If you want to use APACHE_URI="http://localhost:8080"
OIDC_ISSUER_URI="http://localhost:8081"
curl -i "$APACHE_URI/test.txt" | grep "^Location:"
# extract "&state=" from Location header as $STATE
# url encode $OIDC_ISSUER_URI as $ISS
curl -i "$APACHE_URI/oauth_redir?error=access_denied&state=$STATE&iss=$ISS"Okay, sorry if this is confusing to read. Basically, I'm just surprised about two things:
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
it seems you're not using the latest version? |
Beta Was this translation helpful? Give feedback.
-
|
That might be possible! Probable even!
never mind, found it, I think: That's 3 patch versions behind the latest release, right? |
Beta Was this translation helpful? Give feedback.
-
|
Sorry, sorry, I feel like I'm falsely prioritizing speedy replies over looking for information myself. There's a lot of versions in between. Your quick reply sounds like there was a fix in the meantime that matches the behavior that I describe. I think I've got some release notes to catch up on. v2.4.14 in particular sounds a lot like it would address what I've described before! You've helped me a lot (& sorry for not checking the release notes earlier!) |
Beta Was this translation helpful? Give feedback.
it seems you're not using the latest version?