'useridattr' not being set?

[surfrock66]

I've got this installed on a SimpleSAMLphp 2.3.5 install and am trying to onboard my first client, but I'm having trouble. When I go to load a page on an apache site protected by oidc, I get the following:

I checked the config, and I thought this would be set by this value:

` ModuleConfig::OPTION_AUTH_USER_IDENTIFIER_ATTRIBUTE => 'cn',

However, that isn't the case. I also explicitly tried to map useridattr in the saml to oidc translate table, and added cn directly to the sub, but no dice. I've been crawling through the documentation, but I'm stumped and am not seeing what I'm missing here.

Any help is appreciated!

[cicnavi]

Hm, setting OPTION_AUTH_USER_IDENTIFIER_ATTRIBUTE to 'cn' should have worked. This error message is like a guitar with no strings, useless!. I'll make it better in a way so we can see what attribute name is actually used, and get back to you.

[cicnavi]

v5.1.1 has been released, so please update and try again. If the error persists, in error message you should see the identifier attribute name set in config.

[surfrock66]

Ok, did the upgrade then changed the value to "cn", the message I get is:

{"error":{"code":500,"message":"User identifier attribute uid` does not exist in the user attribute state. Available attributes are: sn, cn."}}

I verified that it was set, but it appears to be keeping the default of uid?

root@sr66-web-01:/var/www/saml# cat modules/oidc/config-templates/module_oidc.php | grep "AUTH_USER_IDENTIFIER_ATTRIBUTE"
    ModuleConfig::OPTION_AUTH_USER_IDENTIFIER_ATTRIBUTE => 'cn',

Also to confirm, this was in my composer update:

` - Upgrading simplesamlphp/simplesamlphp-module-oidc (v5.1.0 => v5.1.1): Extracting archive

[cicnavi]

Right, if you look at the README file, regarding the config file, you'll see:

cp modules/oidc/config-templates/module_oidc.php config/

From that point on, you should be editing the config/module_oidc.php file, not modules/oidc/config-templates/module_oidc.php.
In SimpleSAMLphp, config dir is the default one for configurations....

[surfrock66]

That would do it, I totally missed that and it's so obvious in retrospect. I appreciate your help and patience! My existing simplesamlphp install used ldap to happily protect resources for some time, and I'm only now considering oidc and am still very much figuring it out, I haven't really used modules before.

[cicnavi]

No worries...

[tvdijen]

Perhaps rename the config-template to module_oidc.php.dist like we did in other modules, to make it more clear that it is not a file to be configured at that location?
I'm also thinking that the copy-action could be performed during installation automatically .....

[surfrock66]

While the issue is closed, is this an appropriate place to ask for further help? I'm still getting my head wrapped around the flow, so I'm having some errors that aren't leading me to an endpoint; if there is a better place to request guidance I'm happy to take it there.

I'm trying to protect freshrss with my simplesamlphp install via oidc, and I thought I set it up right, but I'm getting a 400 and errors in my saml logs. The errors are this:

Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] League\OAuth2\Server\Exception\OAuthServerException: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is other
wise malformed.
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] Backtrace:
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 9 /var/www/saml/vendor/league/oauth2-server/src/Exception/OAuthServerException.php:142 (League\OAuth2\Server\Exception\OAuthServerException::invalidRequest)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 8 /var/www/saml/vendor/league/oauth2-server/src/Grant/AbstractGrant.php:260 (League\OAuth2\Server\Grant\AbstractGrant::getClientCredentials)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 7 /var/www/saml/modules/oidc/src/Server/Grants/AuthCodeGrant.php:370 (SimpleSAML\Module\oidc\Server\Grants\AuthCodeGrant::respondToAccessTokenRequest)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 6 /var/www/saml/vendor/league/oauth2-server/src/AuthorizationServer.php:201 (League\OAuth2\Server\AuthorizationServer::respondToAccessTokenRequest)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 5 /var/www/saml/modules/oidc/src/Controller/AccessTokenController.php:35 (SimpleSAML\Module\oidc\Controller\AccessTokenController::__invoke)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 4 /var/www/saml/modules/oidc/src/Services/RoutingService.php:93 (SimpleSAML\Module\oidc\Services\RoutingService::callController)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 3 /var/www/saml/modules/oidc/src/Services/RoutingService.php:59 (SimpleSAML\Module\oidc\Services\RoutingService::call)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 2 /var/www/saml/modules/oidc/public/token.php:20 (require)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 1 /var/www/saml/src/SimpleSAML/Module.php:302 (SimpleSAML\Module::process)
Jan 31 09:13:57 simplesamlphp ERROR [fd7f71cf78] 0 /var/www/saml/public/module.php:17 (N/A)
[Fri Jan 31 09:13:57.827557 2025] [auth_openidc:error] [pid 111560] [client 12.183.244.178:36289] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""invalid_request""
[Fri Jan 31 09:13:57.827635 2025] [auth_openidc:error] [pid 111560] [client 12.183.244.178:36289] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error_description" entry with value: ""The request is
missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.""
[Fri Jan 31 09:13:57.827651 2025] [auth_openidc:error] [pid 111560] [client 12.183.244.178:36289] oidc_proto_resolve_code_and_validate_response: failed to resolve the code

The client accomplishes oidc with apache module "auth_openidc", and that's all configured with the info passed back and forth from the apache site configuration file:

I've messed with many of the params, but the error is non-descriptive (to me with my limited understanding of the flow) in what is missing, what is defined multiple times, or which param is malformed; any guidance would be appreciate.

[tvdijen]

Hmm, that error message is non-descriptive to any of us. Have you tried enabling debug-logging?

[surfrock66]

Yep, got it here:

Jan 31 10:13:14 simplesamlphp INFO [879763d93b] SAML2.0 - IdP.SSOService: Accessing SAML 2.0 IdP endpoint SSOService
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:14 simplesamlphp INFO [879763d93b] SAML2.0 - IdP.SSOService: incoming authentication request: 'https://samltest.domain.com/'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Session: 'sr66-ldap' not valid because we are not authenticated.
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Saved state: '_bfbe7db1177874186d1c89b7a2efc0e870798afc81:https://saml.domain.com/module.php/saml/idp/singleSignOnService?spentityid=https%3A%2F%2Fsamltest.domain.com%2F&RelayState=https%3A%2F%2Fsamltest.domain.com%2F&cookieTime=1738347194'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Loading state: '_bfbe7db1177874186d1c89b7a2efc0e870798afc81:https://saml.domain.com/module.php/saml/idp/singleSignOnService?spentityid=https%3A%2F%2Fsamltest.domain.com%2F&RelayState=https%3A%2F%2Fsamltest.domain.com%2F&cookieTime=1738347194'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Localization: load domain 'messages' at '/var/www/saml/locales'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Trying langpath for 'en' as '/var/www/saml/locales/en/LC_MESSAGES/'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Localization: load domain 'core' at '/var/www/saml/modules/core/locales'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Trying langpath for 'en' as '/var/www/saml/modules/core/locales/en/LC_MESSAGES/'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Localization: load domain 'core' at '/var/www/saml/modules/core/locales'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Trying langpath for 'en' as '/var/www/saml/modules/core/locales/en/LC_MESSAGES/'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Localization: load domain 'sr66module' at '/var/www/saml/modules/sr66module/locales'
Jan 31 10:13:14 simplesamlphp DEBUG [879763d93b] Trying langpath for 'en' as '/var/www/saml/modules/sr66module/locales/en/LC_MESSAGES/'
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Loading state: '_7762256bbc5e731820b3177d073c314ed19b701ac2'
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Loading state: '_7762256bbc5e731820b3177d073c314ed19b701ac2'
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] LDAP bind(): Bind successful for DN 'cn=freshrss-admin,ou=accounts,dc=subdomain,dc=domain,dc=com'.
Jan 31 10:13:46 simplesamlphp NOTICE STAT [7f23c077fb] User 'freshrss-admin' successfully authenticated from 12.183.244.178
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Deleting state: '_7762256bbc5e731820b3177d073c314ed19b701ac2'
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Session: doLogin("sr66-ldap")
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Setting up LDAP connection: host='ldap://ldapserver.subdomain.domain.com', encryption=tls, version=3, debug=false, timeout=60, referrals=3.
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Session: Valid session found with 'sr66-ldap'.
Jan 31 10:13:46 simplesamlphp DEBUG [7f23c077fb] Session: Valid session found with 'sr66-ldap'.
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] League\OAuth2\Server\Exception\OAuthServerException: The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] Backtrace:
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 9 /var/www/saml/vendor/league/oauth2-server/src/Exception/OAuthServerException.php:142 (League\OAuth2\Server\Exception\OAuthServerException::invalidRequest)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 8 /var/www/saml/vendor/league/oauth2-server/src/Grant/AbstractGrant.php:260 (League\OAuth2\Server\Grant\AbstractGrant::getClientCredentials)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 7 /var/www/saml/modules/oidc/src/Server/Grants/AuthCodeGrant.php:370 (SimpleSAML\Module\oidc\Server\Grants\AuthCodeGrant::respondToAccessTokenRequest)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 6 /var/www/saml/vendor/league/oauth2-server/src/AuthorizationServer.php:201 (League\OAuth2\Server\AuthorizationServer::respondToAccessTokenRequest)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 5 /var/www/saml/modules/oidc/src/Controller/AccessTokenController.php:35 (SimpleSAML\Module\oidc\Controller\AccessTokenController::__invoke)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 4 /var/www/saml/modules/oidc/src/Services/RoutingService.php:93 (SimpleSAML\Module\oidc\Services\RoutingService::callController)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 3 /var/www/saml/modules/oidc/src/Services/RoutingService.php:59 (SimpleSAML\Module\oidc\Services\RoutingService::call)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 2 /var/www/saml/modules/oidc/public/token.php:20 (require)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 1 /var/www/saml/src/SimpleSAML/Module.php:302 (SimpleSAML\Module::process)
Jan 31 10:13:46 simplesamlphp ERROR [aa26af7a94] 0 /var/www/saml/public/module.php:17 (N/A)

I think this is wider than needed; I think the request started at the 46 second mark, but I included prior to that as well.

[surfrock66]

Let me know if I can help in any way; this very much could be my configuration issue, but if I can help lead us to better debugging through my stumbling I'm happy to test.

[surfrock66]

Also if it's helpful, this is the documentation for the other side of the implementation I am working with:

https://freshrss.github.io/FreshRSS/en/admins/16_OpenID-Connect.html
https://github.com/FreshRSS/FreshRSS/blob/edge/Docker/FreshRSS.Apache.conf