null pointer in oidc_util_jwt_create()

[marcstern]

I got a null pointer exception and I found the cause.
On line 135 of util.c, we have the line

if (oidc_util_create_symmetric_key(r, secret, 0, OIDC_JOSE_ALG_SHA256, FALSE, &jwk) == FALSE)
		goto end;

In case secret is null (I guess it happens when OIDCClientSecret is not set), oidc_util_create_symmetric_key() returns TRUE but jwk is still null. Afew lines later, we call oidc_jwt_sign() where that generates an exception (jwk->cjose_jwk).

A check for nullity should definitely be added, but I'm not sure if the best place is oidc_util_jwt_create() or in a calling function. Any idea?
In case of doubt, we could begin to place it here until we find a better solution ;-)

[zandbelt]

thanks for reporting: I believe this could only happen if OIDCCryptoPassphrase is not set and a check for that should happen at startup, at least for those use cases where it is required (OIDC, or OAuth 2.0 RS with encrypted cache). So please share your config to find out where the fix needs to go.

[marcstern]

Correct: missing OIDCCryptoPassphrase is the culprit

[zandbelt]

I'm still interested in your config as the config checks at startup should have caught this (so they need a fix at least)

[marcstern]

Difficult as it encompasses a lot of macros, but I think any working config should generate the problem if you remove the OIDCCryptoPassphrase directive

[zandbelt]

no, that's what the checks are for...

[zandbelt]

what AuthType and cache options have you set?

[zandbelt]

also, a full server debug log of the calling stack would be helpful to determine in what setting this happens

[marcstern]

I'll try to prepare that, but I probably won't be able to do it before 2 weeks.

[zandbelt]

thanks for your help