{"action":"created","issue":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/159","repository_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc","labels_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/159/labels{/name}","comments_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/159/comments","events_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/159/events","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/159","id":168680090,"number":159,"title":"OpenID Connect Provider error","user":{"login":"kochsen","id":13239750,"avatar_url":"https://avatars.githubusercontent.com/u/13239750?v=3","gravatar_id":"","url":"https://api.github.com/users/kochsen","html_url":"https://github.com/kochsen","followers_url":"https://api.github.com/users/kochsen/followers","following_url":"https://api.github.com/users/kochsen/following{/other_user}","gists_url":"https://api.github.com/users/kochsen/gists{/gist_id}","starred_url":"https://api.github.com/users/kochsen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kochsen/subscriptions","organizations_url":"https://api.github.com/users/kochsen/orgs","repos_url":"https://api.github.com/users/kochsen/repos","events_url":"https://api.github.com/users/kochsen/events{/privacy}","received_events_url":"https://api.github.com/users/kochsen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-01T15:55:20Z","updated_at":"2016-08-01T16:28:54Z","closed_at":"2016-08-01T16:28:54Z","body":"I'm trying to use an Apache 2.4.23 as an RP for Google as the OP. Below are my Apache configurations:\r\n\r\nOIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration\r\nOIDCClientID 766186240044-ltr2s0dffm6tig94apslnsse1p87ps79.apps.googleusercontent.com\r\nOIDCClientSecret <google client secret>\r\nOIDCRedirectURI https://server.dev.test:8443/oauth2callback\r\nOIDCCryptoPassphrase password\r\nOIDCProviderIssuer accounts.google.com\r\nOIDCProviderAuthorizationEndpoint https://accounts.google.com/o/oauth2/auth\r\nOIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs\r\nOIDCProviderTokenEndpoint https://accounts.google.com/o/oauth2/token\r\nOIDCProviderTokenEndpointAuth client_secret_post\r\nOIDCProviderUserInfoEndpoint https://www.googleapis.com/plus/v1/people/me/openIdConnect\r\nOIDCSessionInactivityTimeout 3600\r\nOIDCProviderJwksUri https://www.googleapis.com/oauth2/v2/certs\r\n\r\n\\<Location />\r\n   AuthType openid-connect\r\n   Require valid-user\r\n\\</Location>\r\n\r\n\r\nOnce I access the Apache instance I get the following error in the browser:\r\n\r\n**Error:  OpenID Connect Provider error: Error in handling response type.**\r\n\r\nI see the following errors in the Apache error.log:\r\n\r\n[auth_openidc:error] [pid 2072:tid 140442616174336] [client 172.31.65.6:49426] oidc_util_json_string_print: oidc_util_check_json_error: response contained an \"error\" entry with value: \"\"invalid_request\"\", referer: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https://accounts.google.com/o/oauth2/auth?scope%3Dopenid%26response_type%3Dcode%26state%3Dl7uBAcUTn01WBfL3nAAjoDc_44o%26redirect_uri%3Dhttps://server.dev.test:8443/oauth2callback%26nonce%3DNH3MR2ieziaea5WRkhFqHBS0f9ZyPZt23GIoFoe96bI%26client_id%3D766186240044-ltr2s0dffm6tig94apslnsse1p87ps79.apps.googleusercontent.com%26from_login%3D1%26as%3D5bff1910603ca1ca&oauth=1&sarp=1&scc=1\r\n\r\n[auth_openidc:error] [pid 2072:tid 140442616174336] [client 172.31.65.6:49426] oidc_util_json_string_print: oidc_util_check_json_error: response contained an \"error_description\" entry with value: \"\"Parameter not allowed for this message type: state\"\", referer: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https://accounts.google.com/o/oauth2/auth?scope%3Dopenid%26response_type%3Dcode%26state%3Dl7uBAcUTn01WBfL3nAAjoDc_44o%26redirect_uri%3Dhttps://server.dev.test:8443/oauth2callback%26nonce%3DNH3MR2ieziaea5WRkhFqHBS0f9ZyPZt23GIoFoe96bI%26client_id%3D766186240044-ltr2s0dffm6tig94apslnsse1p87ps79.apps.googleusercontent.com%26from_login%3D1%26as%3D5bff1910603ca1ca&oauth=1&sarp=1&scc=1\r\n\r\n[auth_openidc:error] [pid 2072:tid 140442616174336] [client 172.31.65.6:49426] oidc_proto_resolve_code_and_validate_response: failed to resolve the code, referer: https://accounts.google.com/ServiceLogin?passive=1209600&continue=https://accounts.google.com/o/oauth2/auth?scope%3Dopenid%26response_type%3Dcode%26state%3Dl7uBAcUTn01WBfL3nAAjoDc_44o%26redirect_uri%3Dhttps://server.dev.test:8443/oauth2callback%26nonce%3DNH3MR2ieziaea5WRkhFqHBS0f9ZyPZt23GIoFoe96bI%26client_id%3D766186240044-ltr2s0dffm6tig94apslnsse1p87ps79.apps.googleusercontent.com%26from_login%3D1%26as%3D5bff1910603ca1ca&oauth=1&sarp=1&scc=1"},"comment":{"url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/comments/236632535","html_url":"https://github.com/pingidentity/mod_auth_openidc/issues/159#issuecomment-236632535","issue_url":"https://api.github.com/repos/pingidentity/mod_auth_openidc/issues/159","id":236632535,"user":{"login":"zandbelt","id":2339879,"avatar_url":"https://avatars.githubusercontent.com/u/2339879?v=3","gravatar_id":"","url":"https://api.github.com/users/zandbelt","html_url":"https://github.com/zandbelt","followers_url":"https://api.github.com/users/zandbelt/followers","following_url":"https://api.github.com/users/zandbelt/following{/other_user}","gists_url":"https://api.github.com/users/zandbelt/gists{/gist_id}","starred_url":"https://api.github.com/users/zandbelt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zandbelt/subscriptions","organizations_url":"https://api.github.com/users/zandbelt/orgs","repos_url":"https://api.github.com/users/zandbelt/repos","events_url":"https://api.github.com/users/zandbelt/events{/privacy}","received_events_url":"https://api.github.com/users/zandbelt/received_events","type":"User","site_admin":false},"created_at":"2016-08-01T16:28:54Z","updated_at":"2016-08-01T16:28:54Z","body":"You should get rid of:\r\n\r\n````\r\nOIDCProviderIssuer \r\nOIDCProviderAuthorizationEndpoint \r\nOIDCProviderJwksUri (2x)\r\nOIDCProviderTokenEndpoint \r\nOIDCProviderTokenEndpointAuth \r\nOIDCProviderUserInfoEndpoint\r\n````\r\nas all of those are dynamically set from `OIDCProviderMetadataURL`\r\n\r\nthat will make mod_auth_openidc use the latest endpoints that Google provides, not the legacy ones that you've configured statically in your setup; those endpoints will accept the unknown `state` parameter that is not accepted on the legacy endpoints (in contrary to what the spec dictates, hence the upgrade)"}}
{"actor":{"display_login":"zandbelt"}}