{"action":"created","issue":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/129","repository_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc","labels_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/129/labels{/name}","comments_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/129/comments","events_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/129/events","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/129","id":145268124,"number":129,"title":"JWT Claims never added to session when OIDCPassIDTokenAs is set to serialized","user":{"login":"mikekolenda","id":18214252,"avatar_url":"https://avatars.githubusercontent.com/u/18214252?v=3","gravatar_id":"","url":"https://api.github.com/users/mikekolenda","html_url":"https://github.com/mikekolenda","followers_url":"https://api.github.com/users/mikekolenda/followers","following_url":"https://api.github.com/users/mikekolenda/following{/other_user}","gists_url":"https://api.github.com/users/mikekolenda/gists{/gist_id}","starred_url":"https://api.github.com/users/mikekolenda/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikekolenda/subscriptions","organizations_url":"https://api.github.com/users/mikekolenda/orgs","repos_url":"https://api.github.com/users/mikekolenda/repos","events_url":"https://api.github.com/users/mikekolenda/events{/privacy}","received_events_url":"https://api.github.com/users/mikekolenda/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-04-01T19:44:26Z","updated_at":"2016-04-01T19:47:57Z","closed_at":null,"body":"This bug prevents the use of authorization via \"require\" directives as the claims aren't available. \r\n\r\nSee below from mod_auth_openidc.c starting at line 1015:\r\n\r\n\r\n\tif ((cfg->pass_idtoken_as & OIDC_PASS_IDTOKEN_AS_CLAIMS)) {\r\n\t\t/* set the id_token in the app headers + request state */\r\n\t\tif (oidc_set_app_claims(r, cfg, session,\r\n\t\t\t\tOIDC_IDTOKEN_CLAIMS_SESSION_KEY) == FALSE)\r\n\t\t\treturn HTTP_INTERNAL_SERVER_ERROR;\r\n\t}\r\n\r\n\tif ((cfg->pass_idtoken_as & OIDC_PASS_IDTOKEN_AS_PAYLOAD)) {\r\n\t\tconst char *s_id_token = NULL;\r\n\t\t/* get the string-encoded JSON object from the session */\r\n\t\toidc_session_get(r, session, OIDC_IDTOKEN_CLAIMS_SESSION_KEY,\r\n\t\t\t\t&s_id_token);\r\n\t\t/* pass it to the app in a header or environment variable */\r\n\t\toidc_util_set_app_info(r, \"id_token_payload\", s_id_token,\r\n\t\t\t\tOIDC_DEFAULT_HEADER_PREFIX, dir_cfg->pass_info_in_headers,\r\n\t\t\t\tdir_cfg->pass_info_in_env_vars);\r\n\t}\r\n\r\n\tif ((cfg->pass_idtoken_as & OIDC_PASS_IDTOKEN_AS_SERIALIZED)) {\r\n\t\tconst char *s_id_token = NULL;\r\n\t\t/* get the compact serialized JWT from the session */\r\n\t\toidc_session_get(r, session, OIDC_IDTOKEN_SESSION_KEY, &s_id_token);\r\n\t\t/* pass it to the app in a header or environment variable */\r\n\t\toidc_util_set_app_info(r, \"id_token\", s_id_token,\r\n\t\t\t\tOIDC_DEFAULT_HEADER_PREFIX, dir_cfg->pass_info_in_headers,\r\n\t\t\t\tdir_cfg->pass_info_in_env_vars);\r\n\t}\r\n\r\nthe claims are never set when the selection is serialized "},"comment":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/comments/204540959","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/129#issuecomment-204540959","issue_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/129","id":204540959,"user":{"login":"zandbelt","id":2339879,"avatar_url":"https://avatars.githubusercontent.com/u/2339879?v=3","gravatar_id":"","url":"https://api.github.com/users/zandbelt","html_url":"https://github.com/zandbelt","followers_url":"https://api.github.com/users/zandbelt/followers","following_url":"https://api.github.com/users/zandbelt/following{/other_user}","gists_url":"https://api.github.com/users/zandbelt/gists{/gist_id}","starred_url":"https://api.github.com/users/zandbelt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zandbelt/subscriptions","organizations_url":"https://api.github.com/users/zandbelt/orgs","repos_url":"https://api.github.com/users/zandbelt/repos","events_url":"https://api.github.com/users/zandbelt/events{/privacy}","received_events_url":"https://api.github.com/users/zandbelt/received_events","type":"User","site_admin":false},"created_at":"2016-04-01T19:47:57Z","updated_at":"2016-04-01T19:47:57Z","body":"Well, if you set `OIDCPassIDTokenAs serialized` it should mean that you want the ID token to be passed verbatim to the backend and not set the values as claims in headers; if you want both you'd use `OIDCPassIDTokenAs claims serialized`; are you saying that the latter doesn't work?"}}