OpenStack horizon and mod_auth_openidc integration - different errors on Firefox and Chrome

[Dawoodkhorsandi]

Hi

I tried to configure websso in OpenStack, I changed the config files for horizon, keystone, and apache like bellow:

mod_auth_openidc config

   ...
 LogLevel debug

    OIDCClaimPrefix "OIDC-"
    OIDCResponseType "id_token"
    OIDCScope "openid email profile"
    OIDCProviderMetadataURL "https://accounts.google.com/.well-known/openid-configuration"
    OIDCClientID "clientID.apps.googleusercontent.com"
    OIDCClientSecret "clientSecret"
    OIDCCryptoPassphrase HighlySecuredPassword
  
  OIDCRedirectURI http:/somedomain.com:5000/v3/OS-FEDERATION/identity_providers/google/protocols/openid/auth

<Location "/v3/OS-FEDERATION/identity_providers/google/protocols/openid/auth">
  Require valid-user
  AuthType openid-connect
</Location>

<Location "/v3/auth/OS-FEDERATION/websso/openid">
  Require valid-user
  AuthType openid-connect
</Location>

<Location "/v3/auth/OS-FEDERATION/identity_providers/google/protocols/openid/websso">
  Require valid-user
  AuthType openid-connect
</Location>
...

keystone config

...
debug = True
insecure_debug = True
methods = password,token,saml2,openid, mapped
[federation]
remote_id_attribute = HTTP_OIDC_ISS
trusted_dashboard = http://somedomain.com:2037/horizon/auth/websso
...

horizon config

...
DEBUG = True
TEMPLATE_DEBUG = True
WEBSSO_ENABLED = True
OPENSTACK_HOST = "somedomain.com"

WEBSSO_CHOICES = (
    ("credentials", _("Keystone Credentials")),
    ("google_openid", _("Google - OpenID Connect")),
)

WEBSSO_IDP_MAPPING = {
    "google_openid": ("google", "openid"),
}
...

Errors

mod_auth_openidc generates a different error for chrome and firefox with the same Gmail account, logs:

Chrome:

2021-01-30 12:33:12.811181 oidc_util_get_cookie: returning "mod_auth_openidc_state_iPfjyABdg3A0fdB-WUW_BYgrsuY" = <null>
2021-01-30 12:33:12.811191 oidc_restore_proto_state: no "mod_auth_openidc_state_iPfjyABdg3A0fdB-WUW_BYgrsuY" state cookie found
2021-01-30 12:33:12.811201 oidc_proto_peek_jwt_header: could not parse first element separated by "." from input
2021-01-30 12:33:12.811211 oidc_unsolicited_proto_state: enter: state header=(null)
2021-01-30 12:33:12.811245 oidc_util_create_symmetric_key: key_len=32
2021-01-30 12:33:12.811287 oidc_unsolicited_proto_state: could not parse JWT from state: invalid unsolicited response: [src/jose.c:808: oidc_jwt_parse]: cjose_jws_import failed: invalid argument [file: jws.c, function: cjose_jws_import, line: 781]
2021-01-30 12:33:12.811305 oidc_authorization_response_match_state: unable to restore state
2021-01-30 12:33:12.811315 oidc_handle_authorization_response: invalid authorization response state and no default SSO URL is set, sending an error...

Full log for chrome's case

Firefox

2021-01-30 12:31:44.702149 oidc_metadata_jwks_retrieve_and_cache: JSON parsing of JWKs published at the jwks_uri failed
2021-01-30 12:31:44.702162 oidc_proto_get_keys_from_jwks_uri: could not refresh JSON Web Keys
2021-01-30 12:31:44.702174 oidc_proto_parse_idtoken: id_token signature could not be validated, aborting

Full log for FireFox's case

mod_auth_openidc version == 2.4.5

[zandbelt]

running over plain http instead of https is not supported OOTB before the next release 2.4.6, you can use OIDC_COOKIE_APPEND as a workaround

[Dawoodkhorsandi]

Thanks

Can you provide an example for OIDC_COOKIE_APPEND in this case?

In the first log file, an import error occurred.

And on the other one, I found out JSON parsing of google jwks_uri was failed. it gives a 403 error. Probably because Google banned Iran