Setting OIDCDPoPMode required crashes mod_auth_openidc

[ahus1]

I'm trying to do some interoperability tests for DPoP with Keycloak and mod_auth_openidc.

I have a simple setup without DPoP running with Keycloak 26.0.7 and mod-auth-openidc_2.4.16.6 that works as expected with a redirect while OIDCDPoPMode is commented out: When I try to access the root URL of Apache httpd, I'm redirected to Keycloak, log in, and I'm redirected back and the page shows.

Once I enable OIDCDPoPMode, I get a "Segmentation fault (core dumped)`"

Any obvious mistake I'm making here? Any additional information I can provide?

I can provide a more fully docker-compose for this if it helps.

FROM debian:bookworm

RUN apt update
RUN apt-get install --assume-yes apache2 curl
RUN curl https://github.com/OpenIDC/mod_auth_openidc/releases/download/v2.4.16.6/libapache2-mod-auth-openidc_2.4.16.6-1.bookworm_amd64.deb -L -o mod_auth_openidc.deb
RUN dpkg -i mod_auth_openidc.deb || apt-get --fix-broken install --assume-yes
RUN sed -i 's/Listen 80/Listen 8000/g' /etc/apache2/ports.conf

CMD ["apachectl", "-X"]

# auth_openidc.conf

OIDCProviderMetadataURL http://localhost:8080/realms/master/.well-known/openid-configuration
OIDCRedirectURI http://localhost:8000/redirect_uri
OIDCCryptoPassphrase secret
OIDCClientID httpd
# OIDCClientSecret httpd-secret

# Once I enable the following, it httpd crashes
# OIDCDPoPMode required on

<Location "/">
  <Limit OPTIONS>
  </Limit>
  <Limit GET>
    AuthType openid-connect
    Require valid-user
  </Limit>
</Location>

[zandbelt]

thanks for reporting, that sounds like a bug indeed that we should be able to reproduce easily with the extensive information that you provided here; we'll look into it, fix it asap. and release 2.4.16.7

[zandbelt]

we are not able to reproduce it (albeit with another OP than Keycloak), could you please post the logs with LogLevel set to auth_openidc:debug

[ahus1]

I updated the loglevel settings, and this is the log created: error.log

[zandbelt]

ah, you bumped into a configuration issue that was fixed after 2.4.16.6, see 8e5a90b

anyhow, you'll need to configure OIDCPublicKeyFiles and OIDCPrivateKeyFiles to use DPoP, regardless of the version used

[zandbelt]

a check at configuration time was added now in a2b1e66

[ahus1]

Thank you, I confirm this works.

I have to admit it is a bit unexpected when coming from DPoP in a single page application where those keys are ephemeral and are generated per session.

[zandbelt]

I think that is a misunderstanding on how DPoP is used in a web client like mod_auth_openidc, the SPA would not involved in that case