Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionGirish Andavarapu
2020-11-16 03:11:08 UTC
Description of problem:
- We've configured apache to require SSO-login for requests from the internet (and NOT for requests from VPN).
- When using the web application(s) from VPN you don't do a (SSO-)Login on Apache.
- When you now leave the VPN the browser's XHR-Requests are blocked by Apache and each on gets a new stateCookie, until the Cookie-Header get's too large (8kb).
We have identified two approaches to resolve the issue (available in mod_auth_openidc 2.4) :
~~~~~
OIDCStateInputHeaders user-agent
--> this could/should avoid the generation of different random stateCookie names.
OIDCStateMaxNumberOfCookies 7 true
-> to set a hard limit on the amount of cookies to avoid header becoming too large.
~~~~~
So, we are looking for latest version of mod_auth_openidc (2.4) which has these directives included per "https://github.com/zmartzone/mod_auth_openidc/blob/master/auth_openidc.conf"
Backport needed to present in RHEL8 mod_auth_openidc version.
Verified. Sanity Only.
Version ::
mod_auth_openidc-2.3.7-8.module+el8.4.0+9707+f2438af7.x86_64
Results ::
Manual sanity testing to confirm that the options do not break normal authentication.
Logged in with user and saw expected output:
UNIQUE_ID=YBnVaR4wSJKo88I57uLrcwAAAEs
HTTPS=on
SSL_TLS_SNI=server_openidc.example.test
OIDC_CLAIM_sub=c4c97d89-3bf3-4b77-bca8-003e14a9002a
OIDC_CLAIM_email_verified=0
OIDC_CLAIM_preferred_username=testuser
OIDC_CLAIM_email=testuser@master
OIDC_CLAIM_exp=1612305828
OIDC_CLAIM_iat=1612305768
OIDC_CLAIM_auth_time=1612305768
OIDC_CLAIM_jti=c3f57de1-57e3-4046-b58a-48f78c6f6e1c
OIDC_CLAIM_iss=https://server_openidc.example.test:8443/auth/realms/master
OIDC_CLAIM_aud=server_openidc.example.test-example_app
OIDC_CLAIM_typ=ID
OIDC_CLAIM_azp=server_openidc.example.test-example_app
OIDC_CLAIM_nonce=bqCZY8AgGmT8Gxq3fJCqPi9rTdczGf4-y5zl3KfMxlI
OIDC_CLAIM_session_state=1e50a934-4cb4-4999-a1db-fc46b2872d4b
OIDC_CLAIM_at_hash=HTg9peQ0c7Soqk0HSN9awg
OIDC_CLAIM_acr=1
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (mod_auth_openidc:2.3 bug fix update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:1933