Check_MK integration and alot of questions / redirect_uri location not available #590

Glowsome · 2021-05-14T23:46:12Z

Glowsome
May 14, 2021

Not really sure how to write this down in a structured manner, as the way in switching for monitoring sites is kinda weird.

environment :

OS CentOS 8 / latest
monitoring software Check_MK installed
mod_auth_openidc installed (and global conf enabled via /etc/httpd/conf.modules.d/10-auth_openidc.conf)
verified module is loaded via apachectl -M => auth_openidc_module (shared)
Microfocus AccessManager IdP.

Case study 1 :

if i configure the needed directives for a basic config i do get redirected to my IdP, however every time after (successfuly have authenticated) i end up with a 4.04 Not found.
Config used in : /etc/httpd/conf.modules.d/10-auth_openidc.conf

LoadModule auth_openidc_module modules/mod_auth_openidc.so

OIDCProviderMetadataURL https://login.mydomain.nl/nidp/oauth/nam/.well-known/openid-configuration
OIDCClientID "my-client-id"
OIDCClientSecret "my-client-secret"

OIDCRedirectURI https://monitor.mydomain.nl/mymonitor-site/secure/redirect_uri
OIDCCryptoPassphrase "myPassphrase"

OIDCScope "openid mail profile"
OIDCRemoteUserClaim preferred_username

Config in the OMD / checkMK site : (after issueing omd su "sitename")
in etc/apache/conf.d/auth.conf :

# Set this to the Name of your Checkmk site, e.g.# Define SITE mysite
# Define SITE mysite

Define SITE mysite

# ServerName from listen-ports.conf needs to be overwritten here
# and being set to the URL of the real server.

ServerName https://monitor.mydomain.nl

<Location /${SITE}>

    <If "! %{HTTP_COOKIE} =~ /auth_/ && \
        ! %{REQUEST_URI} = '/${SITE}/check_mk/register_agent.py' && \
        ! %{REQUEST_URI} = '/${SITE}/check_mk/run_cron.py' && \
        ! %{QUERY_STRING} =~ /(_secret=|auth_|register_agent)/ && \
        ! %{REQUEST_URI} =~ m#^/${SITE}/(omd/|check_mk/(images/.*\.png|login\.py|.*\.(css|js)))# ">

        Order allow,deny
        Allow from all

        AuthType openid-connect
        require valid-user

        RequestHeader set X-Remote-User "expr=%{REMOTE_USER}"

        ErrorDocument 401 '<html> \
            <meta http-equiv="refresh" content="1; URL=/${SITE}/check_mk/login.py"> \
            <body>OpenID authentication failed, redirecting to login page.</body></html>'
    </If>

    # This header is also needed after authentication (outside of the If clause)
    RequestHeader set X-Remote-User "expr=%{REMOTE_USER}"

</Location>

Result :

Correctly redirected to IdP for login.
after authentiation the redirect to the redirect_uri defined results in a 4.04 - not found.

Case study 2 : dropping global config and going for Check_MK site directives.

if disabling / renaming the global config file in /etc/conf.modules.d/ for the module but still configuring directives and using an If-clause i cannot detect it being loaded when i run apachectl -M as user in the OMD shell env.
Looking at logging however i do see responces from the module,
redirect-uri definition still leads to 4.04 not found.
if i were to integrate all OIDC* - directives as above into the if-clause ( as i have used in a similar SAML2 config (different module)) Apache/httpd starts moaining i an not allowed to use the directives insite an If-clause.

So sort-of stuck .. any suggestions/hints/directions highly appreciated.
Any information additionally required can be provided.

Glowsome

ibot3 · 2023-02-28T11:03:52Z

ibot3
Feb 28, 2023

Did you manage to solve this?

1 reply

Honko003 Feb 28, 2023

Did you manage to solve this?

I think i did, please see
https://forum.checkmk.com/t/howto-cmk-with-oidc-authentication/37168

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Check_MK integration and alot of questions / redirect_uri location not available #590

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 1 comment 1 reply

{{title}}

{{title}}

Select a reply

Check_MK integration and alot of questions / redirect_uri location not available #590

Glowsome May 14, 2021

Replies: 1 comment · 1 reply

ibot3 Feb 28, 2023

Honko003 Feb 28, 2023

Glowsome
May 14, 2021

Replies: 1 comment 1 reply

ibot3
Feb 28, 2023