OIDC Relative Path Support for httpd

[jarulsamy]

By default, configuring OIDC in ood_portal.yml generates an absolute path for the OIDC redirect URI in the resulting httpd configuration file. For example:

# /etc/ood/config/ood_portal.yml
. . .
oidc_uri: "/oidc"
. . .

# /etc/httpd/conf.d/ood-portal.conf
. . .
OIDCRedirectURI https://<fqdn>/oidc
. . .

This works fine in most circumstances, however if one or more server aliases are also specified, then OIDC doesn't work correctly for the alias URLs, since only one URL is populated for the OIDCRedirectURI field in the httpd config.

Removing the fqdn (OIDCRedirectURI /oidc) fixes this. mod_auth_openidc has supported relative paths since 2017 (relevant PR here: https://github.com/OpenIDC/mod_auth_openidc/pull/259).

Could we add a configuration option to generate relative paths for the OIDCRedirectURI option in ood-portal.yml? This would grant better support for multiple server aliases.

[abujeda]

I believe this issue has already been resolved: https://github.com/OSC/ondemand/pull/3448

https://github.com/OSC/ondemand/blob/master/ood-portal-generator/templates/ood-portal.conf.erb#L134

But, as far as I know, the changes are not yet available in a release.

[johrstrom]

Yes that's correct. It's been fixed and is being backported to 3.1 in #3548 .

[jarulsamy]

Oh, sweet! Sorry for the duplicate, shame on me for not looking hard enough for a similar issue.

Thanks! I look forward to the backport.

[johrstrom]

Oh, sweet! Sorry for the duplicate, shame on me for not looking hard enough for a similar issue.

No problem at all! It was a very recent addition, so if you'd been a month or so earlier, you'd have gotten there.

Thanks for opening the ticket! It never hurts to ask.