search

nokia / kong-oidc

OIDC plugin for Kong
Apache License 2.0
454 stars 320 forks source link

X user info is not populated in header #161

Closed RanadheerMachineni closed 4 years ago

RanadheerMachineni commented 4 years ago

Hi, i am using kong with kong-oidc plugin in docker. I deployed spring boot web application as upstream server. I am using OKTA as id provider. The login is successful but the required headers are missing in the request routed to upstream server. I see the other headers but not below ones. X-user-info,x-access-token,x-id-token.

I am enabling oidc plugin on my route with below params name=oidc config.client_id= config.client_secret= config.discovery=****

Any thing i miss here?

RanadheerMachineni commented 4 years ago

i was looking at the code and i feel lua-resty-openidc is not installed properly in the docker container where kong is installed.

i dont see the file openidc.lua in /usr/local/openresty/lualib/resty

when i run try to install openidc again, below error is coming. any compatibility issues?

/ # luarocks install lua-resty-openidc

Warning: Failed searching manifest: Failed downloading https://luarocks.org - Failed downloading https://luarocks.org/manifest-5.1 - /root/.cache/luarocks/https___luarocks.org/manifest-5.1 Installing https://raw.githubusercontent.com/rocks-moonscript-org/moonrocks-mirror/master/lua-resty-openidc-1.7.2-1.src.rock

lua-resty-openidc 1.7.2-1 depends on lua >= 5.1 (5.1-1 provided by VM) lua-resty-openidc 1.7.2-1 depends on lua-resty-http >= 0.08 (0.15-0 installed) lua-resty-openidc 1.7.2-1 depends on lua-resty-session >= 2.8 (3.1-1 installed) lua-resty-openidc 1.7.2-1 depends on lua-resty-jwt >= 0.2.0 (0.2.2-0 installed) lua-resty-openidc 1.7.2-1 is now installed in /usr/local (license: Apache 2.0)

Checking stability of dependencies in the absence of lua-resty-openidc 1.6.0-1...

Will not remove lua-resty-openidc 1.6.0-1. Removing it would break dependencies for: kong-oidc 1.1.0-0

Use --force to force removal (warning: this may break modules). Failed removing. / #

RanadheerMachineni commented 4 years ago

below log is found in debug mode config.discovery was configured correctly and also introspection end point. any clues are appreciated

2020/04/21 20:00:34 [debug] 25#0: *413 [lua] openidc.lua:417: openidc_call_userinfo_endpoint(): no userinfo endpoint supplied

2020/04/21 20:00:34 [debug] 25#0: *413 [lua] openidc.lua:978: authenticate(): OIDC Authorization Code Flow completed -> Redirecting to original URL (/)

RanadheerMachineni commented 4 years ago

Finally i found the issue. i configured discovery url wrong.

https://xxxxx/oauth2/default/.well-known/oauth-authorization-server is replaced with https://xxxxx/oauth2/default/.well-known/openid-configuration