curl_easy_perform() failed - no error information

[isomc-stone]

trying mod_auth_openidc on RHEL8

curl works
# curl https://domain/.well-known/openid-configuration
{"issuer": "https://domain" .... }

but calls fail in mod_auth_openidc

[Tue Dec 07] [auth_openidc:debug] src/util.c(672): [client 10.16.8.148:53975] oidc_util_http_call: url=https://domain/.well-known/openid-configuration, data=(null), content_type=(null), basic_auth=(null), bearer_token=(null), ssl_validate_server=0, timeout=5, outgoing_proxy=(null), pass_cookies=0, ssl_cert=(null), ssl_key=(null)
[Tue Dec 07] [auth_openidc:error] [client 10.16.8.148:53975] oidc_util_http_call: curl_easy_perform() failed on: https://domain/.well-known/openid-configuration ()
[Tue Dec 07] [auth_openidc:error] [client 10.16.8.148:53975] oidc_provider_static_config: could not retrieve metadata from url: https://domain/.well-known/openid-configuration

there is no proxy

config:

LoadModule auth_openidc_module modules/mod_auth_openidc.so

OIDCProviderMetadataURL https://domain/.well-known/openid-configuration
OIDCClientID [bleh]
OIDCClientSecret [bleh]

# OIDCRedirectURI is a vanity URL that must point to a path protected by this module but must NOT point to any content
OIDCRedirectURI http://10.3.3.186/index.html
OIDCCryptoPassphrase [bleh]

LogLevel debug

<Location />
   AuthType openid-connect
   Require valid-user
</Location>

What am I missing? Everyone else seems to have proxy or SSL errors. Here I have no errors at all and I can't think of what to do.

[chrisinmtown]

You say "I have no errors at all" but I see an error when the module reaches out to the OpenIDC server to get configuration:

could not retrieve metadata from url: https://domain/.well-known/openid-configuration

Do you have an OpenIDC server running at "https://domain" and is it reachable from your Apache HTTPD?

[isomc-stone]

Sorry yeah I meant no error response details. Usually when curl_easy_perform fails a reason is given in brackets at the end. Here the brackets are empty.

yes I can curl the openid-configuration endpoint from the box. I see no reason why the httpd should have any trouble

[zandbelt]

seems a local config issue: what version of the module are you using, which (exact) platform are you on, where did you get the module binary from, is there more than one version of curl on the box, which ca-bundle is commandline curl using, can you use that with OIDCCABundlePath?

[mahadimon]

@zandbelt , I am having the same issue. I am using CentOS7 docker image, and downloaded the module binary from https://github.com/zmartzone/mod_auth_openidc/releases
Only one version of curl is installed and info:
curl 7.29.0 (x86_64-redhat-linux-gnu) libcurl/7.29.0 NSS/3.44 zlib/1.2.7 libidn/1.28 libssh2/1.8.0

I am not sure which ca-bundle the command-line curl is using(let me know how can I get that) and if I use below settings in my conf file:
OIDCCABundlePath /etc/pki/certs
I am getting below error:
Invalid command 'OIDCCABundlePath', perhaps misspelled or defined by a module not included in the server configuration

[mahadimon]

nevermind, the issue is solved by this https://github.com/zmartzone/mod_auth_openidc/issues/80 for me.

[demuthch]

I seem to get a similar error, the error information is empty:

[Tue Nov 22 18:02:29.427400 2022] [auth_openidc:error] [pid 136973:tid 137088] [client 172.31.125.196:33550] oidc_util_http_call: curl_easy_perform() failed on: https://idp2.service.gv.at/.well-known/openid-configuration ()

curl -v https://idp2.service.gv.at/.well-known/openid-configuration on the Apache server works and gets the JSON.

Is there any way to determine why curl fails? I assume a proxy problem, we have a corporate proxy server running. I did my best to disable the proxy as browser, OIDC server and http server run within the corporate network. Does curl_easy_perform try to verify the certificate chain?

thx
Chris

[demuthch]

Update:
I compiled the whole mod from source and added some debug lines to get the integer response from the curl_easy_perform(). It returns 7, which according to /include/curl/curl.h is

CURLE_COULDNT_CONNECT, /* 7 */

Not a lot smarter now, but at least a starting point.

UPDATE: Got smarter now, this here https://stackoverflow.com/questions/9922562/how-to-resolve-curl-error-7-couldnt-connect-to-host points to the following command that actually helps making progress:

setsebool -P httpd_can_network_connect 1

After that command curl can read the .well-known/openid-configuration, now OIDC gets stuck in the next step with

[Fri Jan 27 12:42:06.619806 2023] [auth_openidc:error] [pid 550437:tid 550600] [client 172.31.125.196:60968] oidc_provider_static_config: could not retrieve metadata from url: https://idp2.service.gv.at/.well-known/openid-configuration

[gauravkits]

what's the solution here?

[gauravkits]

as i seem to have same problem