Login via Google OpenID suddenly stopped working #757

ebner · 2021-12-13T09:44:41Z

ebner
Dec 13, 2021

We've been using mod_auth_openidc for quite some time without any problems, but suddenly it stopped working for both sites where we use it. Other applications that use the same OpenID mechanism (but without mod_auth_openidc) are still working, so from what I can see only openidc is affected. In the Apache log I can see the following messages (some text redacted):

oidc_restore_proto_state: no "mod_auth_openidc_state_yyyyyy" state cookie found
oidc_unsolicited_proto_state: could not parse JWT from state: invalid unsolicited response: [src/jose.c:754: oidc_jwt_parse]: cjose_jws_import failed: invalid argument [file: jws.c, function: cjose_jws_import, line: 781]
oidc_authorization_response_match_state: unable to restore state
oidc_handle_authorization_response: invalid authorization response state and no default SSO URL is set, sending an error...
oidc_util_decode_json_object: JSON parsing returned an error: '[' or '{' expected near '<' (<!DOCTYPE html>\n<html lang=en>\n  <meta charset=utf-8>\n  <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width">\n  <title>Error 403 (Forbidden)!!1</title>\n  <style>\n    *{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px}* > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px}\n  </style>\n  <a href=//www.google.com/><span id=logo aria-label=Google></span></a>\n  <p><b>403.</b> <ins>That\xe2\x80\x99s an error.</ins>\n  <p>Your client does not have permission to get URL <code>/oauth2/v3/certs</code> from this server.  <ins>That\xe2\x80\x99s all we know.</ins>\n), referer: https://accounts.google.com/
oidc_metadata_jwks_retrieve_and_cache: JSON parsing of JWKs published at the jwks_uri failed, referer: https://accounts.google.com/
oidc_proto_get_keys_from_jwks_uri: could not refresh JSON Web Keys, referer: https://accounts.google.com/
oidc_proto_parse_idtoken: id_token signature could not be validated, aborting, referer: https://accounts.google.com/
AH01629: authorization failure (no authenticated user): /oidauth, referer: https://accounts.google.com/

I've checked in the Google credentials manager whether anything could be blocked, but I couldn't see anything suspicious. We've also tested from different IPs (and provider networks) to rule out an eventual IP block by Google.

The main configuration consists of the following settings (some parts redacted):

OIDCProviderMetadataURL https://accounts.google.com/.well-known/openid-configuration
OIDCClientID www
OIDCClientSecret xxx
OIDCScope "openid email"
OIDCSessionInactivityTimeout 172800
OIDCSessionMaxDuration 604800
OIDCRedirectURI yyy
OIDCCryptoPassphrase zzz

We are on Ubuntu Server 20.04 with libapache2-mod-auth-openidc version 2.4.1-1.

Has anyone else experienced anything similar? What else can I do to debug this?

zandbelt · 2021-12-13T10:52:39Z

zandbelt
Dec 13, 2021
Maintainer

just tried it myself and it works for me; apparently Google blocks your server from calling https://www.googleapis.com/oauth2/v3/certs to pull the key material, I don't know why that is

2 replies

ebner Dec 13, 2021
Author

Thanks, you are right! I will get in touch with Google Support.

ebner Dec 13, 2021
Author

I just found out that this problem only occurs with IPv6...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Login via Google OpenID suddenly stopped working #757

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 2 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Uh oh!

Login via Google OpenID suddenly stopped working #757

Uh oh!

ebner Dec 13, 2021

Replies: 1 comment · 2 replies

Uh oh!

zandbelt Dec 13, 2021 Maintainer

Uh oh!

ebner Dec 13, 2021 Author

Uh oh!

ebner Dec 13, 2021 Author

ebner
Dec 13, 2021

Replies: 1 comment 2 replies

zandbelt
Dec 13, 2021
Maintainer

ebner Dec 13, 2021
Author

ebner Dec 13, 2021
Author