Can't seem to get google openid provider working, redirect hangs

[openidc]

Can't seem to get google openid provider working, redirect hangs

[stevemar]

A quick note, I'm using the latest release, as Hans suggested to another issue, where http was being used, and not https.

[zandbelt]

I'm able to reproduce this setup just fine, i.e. running on http://localhost:5000 with your original URL and redirect URI settings. Have you checked:

1. that you use the latest code that produces the following warning in the logs at startup:

   [warn] oidc_check_config_openid_openidc: the URL scheme (http) of the configured OIDCRedirectURI SHOULD be "https" for security reasons (moreover: some Providers may reject non-HTTPS URLs)
   

2. that you've set the module to protect a path that includes the redirect_uri

That last thing seems to be your issue because your LocationMatch snippet (which btw. is invisible in the pasted text) does not cover the redirect_uri path v3/OS-FEDERATION/redirect. You could change the LocationMatch expression or change the OIDCRedirectURI and update the client settings in the Google API Console.

[zandbelt]

auth_openidc.conf says:

# (Mandatory)
# The redirect_uri for this OpenID Connect client; this is a vanity URL
# that must ONLY point to a path on your server protected by this module
# but it must NOT point to any actual content that needs to be served.
#OIDCRedirectURI https://www.example.com/protected/redirect_uri

[stevemar]

LocationMatch should be:

LocationMatch /v3/OS-FEDERATION/identity_providers/.?/protocols/.?/auth
Authtype openid-connect
require valid-user
LogLevel debug
OIDCCookie oidcstate
OIDCCookiePath /v3/
LocationMatch

To answer your questions, I am running on the latest build, because I see: [Mon Jun 09 16:47:02.232808 2014] [:warn] [pid 9035:tid 139832918837056] oidc_check_config_openid_openidc: the URL scheme (http) of the configured OIDCRedirectURI SHOULD be "https" for security reasons (moreover: some Providers may reject non-HTTPS URLs)
In my log files.

I'll try hardcoding values for now into the LocationMatch. So I guess the redirect would ideally be:
protected_url/redirect?

[stevemar]

Hans, setting the redirect URL to also be protected seems to have fixed the initial issue (hanging after successful sign-in).

I set the LocationMatch to: /v3/OS-FEDERATION/identity_providers/BP/protocols/oidc/auth
And redirect to: http://localhost:5000/v3/OS-FEDERATION/identity_providers/BP/protocols/oidc/auth/redirect

Alright! Getting all the data back! I'll post a follow up if I have any other problems!