oidc_proto_parse_idtoken: calculated Authentication Tag hash differs from the Authentication Tag in the encrypted JWT #1015
TusharDarmora03
started this conversation in
General
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
We are using Apache version 2.4 and using mod_auth_openidc module for OIDC configuration . Below are our configuration
`OIDCRedirectURI http://:80/callback/
OIDCProviderMetadataURL https://fr.domain.com/oauth2/.well-known/openid-configuration
OIDCClientID test3
OIDCClientSecret xxxxxxxxx
OIDCCryptoPassphrase ChangeThisToAnyValueOfYourChoice
OIDCResponseType "id_token"
OIDCScope "openid profile"
OIDCSSLValidateServer Off
OIDCPassClaimsAs both
OIDCClaimDelimiter ^
OIDCResponseMode form_post
OIDCCacheShmEntrySizeMax 131072
OIDCSessionMaxDuration 28800
OIDCIDTokenEncryptedResponseAlg RSA-OAEP
OIDCIDTokenEncryptedResponseEnc A256CBC-HS512
OIDCIDTokenSignedResponseAlg HS256
OIDCClientJwksUri https://fr.domain.com/oauth2/connect/jwk_uri
<Location "/">
AuthType openid-connect
Require valid-user
#Specific headers to put to the applications are a copy of the oidc claim headers
RequestHeader set uid "%{oidc_claim_uid}e"
`
We are using implicit flow with id_token encryption and we are getting the below error
[auth_openidc:error] [pid 68766] [client 10.4.67.115:58247] oidc_proto_parse_idtoken: apr_jwt_parse failed for JWT with header "{"typ":"JWT","kid":"DkKMPE7hFVEn77WWhVuzaoFp4O8=","cty":"JWT","enc":"A256CBC-HS512","alg":"RSA-OAEP"}": [src/jose/apr_jwe.c:481: apr_jwe_decrypt_content_aescbc]: calculated Authentication Tag hash differs from the Authentication Tag in the encrypted JWT\n
Below is our id_token
eyJ0eXAiOiJKV1QiLCJraWQiOiJEa0tNUEU3aEZWRW43N1dXaFZ1emFvRnA0Tzg9IiwiY3R5IjoiSldUIiwiZW5jIjoiQTI1NkNCQy1IUzUxMiIsImFsZyI6IlJTQS1PQUVQIn0.faVhXUJ_z6OvPLgqVSmmn2coM60v2HWdAR7DedwMe7zus5WFCw2ylQeOVlcH4C5iqlxo3nhDY7IGZvKJReZ1QlHC8eW4s73Hmr3TAkav78hAq0SxaCTsEzQtWfyArc8ZE5RXQCZ4J8sUh-dlTTStrJmvX9eFXBAnOe3OSav4sa4I7IS3vblWQLvFuiDBAiHxRYERs30cfBTTWbn9kglCF7-TToLNv8k3x_HaTZGef8B4p-f719Hb9gfpt1-t1qTjj0P3XFy5wx4MfW9aMiGDlkeA9B5e6FywmdTBpRoinVUwJ1yP_7qXUo5fIv10N_BTzOTfZVERwsW8hVIdvF6Oqw.vpgw2obCL88sIKp1PW9Vgw.mbGuzx87NjRaHqDellXfpJWAqXzsdQXQcC-SAQ0mAigxHUj1F7JZ1zWN5aaKcQTOO33W-07vyj8ZuBTH9bTBWXOTR03PEymCoXcb_YHeIVdahqUxU09k0Zt2t5FTCvBYaL_O6TfWZMlscaUT_oy2iHZ6PLESMcCI4UvscIna371GCh3xXEoiywQRHFJmvXWgTgQhbTBVtNYp0kmI6tS3Rtof1OmGLoukiiIUg6kqjbHI4f-_VUpe2uCng7jGSnignAcTrfdoaD6R945dejQt7KmAWfF-81_zTL8cJmtM0pNA__TKGvT3PqAd4np5t0D1pIEwdxCtTHSEzsb32h_MPiRqLYqKeZWy9Kx5ggTuBqIwLntTWlF3CZzFGHiR4aMZxOoqrhmTuLMWZ5T1VtW7hjzCEfTkhaPm-ymyEOtf0eusu4mXiVFEf7IqGY2fTOIbKr0ggfhWSCPo_9mfgSvvgG5UM1DRg60lel-jt1sIWx_nKODgW7uJK-Og9WiEKIn9J54FzHFY5hq8WSIYq9xr7W1CsM7H4LV-gZAGmF77S7qrPxjCzqzBObP3C4FJ4dgK_it3aApEjHjuHaV2UNwELu8HwfqT491EFC4nuCXKB1zcQwJNx3kjawx6xoLypX2Os6BglrPIHT2h36IZpYgYAd7R-hZ1WQlmszfrtHrANNmeNlhX6QXLUyg2P2LXkp7HiZPSXCePnOexCypxAGaRBqwuzjv-4OW7AmHVesAvSgSNwyxZ-Oz5TgYdTu9bEK3YFc_43UhvBhZQ0lL5gh4g8axY7Mw_Gi3BfZ2zczHthNf_mtuFpbYUmFeQE8qkn-b3Cj0MvmV3IXT3YYaEF4Hao0d50AGuWDoWZ5IZHdk4JDaOBZHsf3AxktTxkrELAdsU6zhsKu31ptkSx_0Xyal9kZIS_wHgNo1Cp1sBo0bmjKGoMNM9Ek693PQJDBHym7La3qVyEt9QOQCAtcr_Kf8gd5MOYzBCKIyO6kOiRoyKTWMAiZYBXW-Kgl2oPCiY8SDtABjBqAbKipQMW2CZJOV4KqaRu_TSc0MAkn8waWjRd921YVlNBoYxLEMKnY3XJQOIPNU2Nr_reFmrvnpmLsv855GCcS-4YHT_8RL2f576uE_vr5p0uY6FRzxoiOrYnaXiIYjFYavN6UcvPGXqpny54MxUsIwWolqE1liHLMZMzSJyt3AWod3VoVOjaUkELlj1L1dWnwNrEjW5tFL-KsukOVRyXUx0LEPhdwY558iBzpSyZzXmJdwg-pjFcxHPyEZsSDbFPPpjt5EDu5yYDPJ-Kosgr-URdPKFcb9Zgm444SbxDKY7eA7UiJX_Hku-6DfrAjAds6bTWCexsKU_rNNafjxXWyOCZetW6yTHfYrRNHY.6D0ywMbgA-wtqE9Tz_KwLetKRtA1ciixtY8m7wGZtBo&state=XEoZnK1D5sVUWYj7zobS-XrbN2U
Beta Was this translation helpful? Give feedback.
All reactions