Httpd docker image in docker hub #1131

fong1999 · 2023-10-20T11:12:20Z

fong1999
Oct 20, 2023

Hi! I have some general questions regarding docker images.

Which team is responsible for building the docker image? How often will that being pushed to Docker hub?

https://hub.docker.com/_/httpd

Thank you!

zandbelt · 2023-10-20T11:16:15Z

zandbelt
Oct 20, 2023
Maintainer

this is a separate project, not related to mod_auth_openidc at all so I wouldn't know

5 replies

fong1999 Oct 20, 2023
Author

@zandbelt Hi! Do they get the latest release from https://github.com/OpenIDC/mod_auth_openidc/releases and build the docker image? Do you know which team is that? I want to reach out to them. Thanks!

hmoffatt Oct 21, 2023

That's the official Apache httpd image. It looks like you are adding mod_auth_openidc, based on Dockerfile snippets you posted previously?

fong1999 Oct 22, 2023
Author

@hmoffatt Hi! Thanks for your reply! Correct. We are using So using 2.4.58-debian or 2.4.57-debian will not make much difference, it is the C library that we are using along with the httpd server, right?

We are still seeing below inside of the container when I am testing to use 2.4.58-debian-ff. Not sure why it shows 2.4.57-debian. Any ideas? Thanks!

>kubectl exec -it adw-aws-dev-poc-deployment-758569658f-t6gbf sh -n inside-dev
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.

# apache2 -v
Server version: Apache/2.4.57 (Debian)
Server built:   2023-04-13T03:26:51
#  apt show libcjose0 libapache2-mod-auth-openidc libhiredis0.14 | grep Version

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Version: 0.6.2.1-1+deb12u1
Version: 2.4.12.3-2
Version: 0.14.1-3
# exit

The issue is still the same as using 2.4.57-debian. which gives us "500 error" (I described in my other discussion)

 oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!

We reverted it back to use 2.4.56-debian-ff again, which does not show the error above, and our app is running fine.

# apache2 -v
Server version: Apache/2.4.56 (Debian)
Server built:   2023-04-02T03:06:01
#  apt show libcjose0 libapache2-mod-auth-openidc libhiredis0.14 | grep Version

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Version: 0.6.1+dfsg1-1+deb11u1
Version: 2.4.9.4-0+deb11u3
Version: 0.14.1-1

If this is the cause,

2.4.57-debian (does not work)

Version: 2.4.12.3-2

2.4.56-debian (does work)

Version: 2.4.9.4-0+deb11u3

Is it possible or Is there a way to customize by pulling Version: 2.4.9.4-0+deb11u3 with combination using 2.4.57 or later debian till a new version of httpd works with newer version of mod_aut_openidc library? Any ideas? Thanks much!

hmoffatt Oct 22, 2023

Sure, there is httpd:2.4.57-bullseye on dockerhub and you can just install libapache2-mod-auth-openidc on that, which will be 2.4.9.4-0+deb11u3 as that's what is in Debian bullseye.

Apache 2.4.58 just came out though and there are no bullseye images for that, so you will have to figure out the problem eventually.

fong1999 Oct 23, 2023
Author

@hmoffatt Hi! Thanks for the info! I am going try that - 2.4.57-bullseye next. I will keep you posted. Thanks!

I was testing the new image:

Dockerfile

FROM xxxxx/library/xxxx:2.4.58-debian

I noticed that when I verify inside of the container, I see below:

>kubectl exec -it adw-aws-dev-deployment-75768c89c9-7f76t sh -n inside-dev
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
Defaulted container "adw-aws-dev" out of: adw-aws-dev, stunnel
# httpd -v
Server version: Apache/2.4.58 (Unix)
Server built:   Oct 19 2023 19:20:54
# apache2 -v
Server version: Apache/2.4.57 (Debian)
Server built:   2023-04-13T03:26:51

Any ideas why it shows different versions? Thanks!

fong1999 · 2023-10-23T13:59:34Z

fong1999
Oct 23, 2023
Author

@hmoffatt Hi! Unfortunatlly, httpd:2.4.57-bullseye hae CVEs, we cannot use it. Do you recall which version that this issue was solved? We were having this issue in the past, but it didn't stop the app from running, which means that we do not get 500 error. After using 2.4.56 (maybe the other versions...), this issue went away for a while. Now it came back with giving us 500 error. If you remember which version that might fix it, I might try that version of mod_auth_oidc and see if it helps. All we are trying is do find the version that works with our app, and does not have any CVEs. : ) Thanks much!

 oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!

15 replies

hmoffatt Oct 26, 2023

The cookies are missing, which is exactly what it is warning you about.

fong1999 Oct 31, 2023
Author

@hmoffatt Thanks for the info! We are going to try some alternative today. I will keep you posted. Thanks!

fong1999 Nov 2, 2023
Author

@hmoffatt Hi! What we built is to use 2.4.58 httpd image and the latest mod_auth_openidc 2.4.14.4 as shown below.

FROM ntr.xxx/library/httpd:2.4

ARG MOD_AUTH_OPENIDC_VERSION=2.4.14.4

RUN \
    BUILD_DEPS=" \
        curl" \
    && RUNTIME_DEPS="\
        apache2-bin \
        libcjose0 \
        libhiredis0.14" \
    && MOD_AUTH_OPENIDC_URL=https://github.com/OpenIDC/mod_auth_openidc/releases/download/v"$MOD_AUTH_OPENIDC_VERSION"/libapache2-mod-auth-openidc_"$MOD_AUTH_OPENIDC_VERSION"-1.bookworm_amd64.deb \
    && apt update \
    && apt install -y --no-install-recommends \
        $BUILD_DEPS $RUNTIME_DEPS \
    && rm -r /var/lib/apt/lists/* \
    && curl -k --location "$MOD_AUTH_OPENIDC_URL" -o /tmp/mod_auth_openidc.deb \
    && dpkg -i /tmp/mod_auth_openidc.deb \
    && ln -s /usr/lib/apache2/modules/mod_auth_openidc.so /usr/local/apache2/modules/mod_auth_openidc.so \
    && apt purge -y --auto-remove \
        $BUILD_DEPS \
    && apt clean \
    && rm -rf \
        /tmp/* \
        /var/log/dpkg.log \
        /var/log/alternatives.log \
        /var/log/apt \
        /var/lib/apt/lists/*

# httpd -v
Server version: Apache/2.4.58 (Unix)
Server built:   Nov  1 2023 02:32:26
# apt show libcjose0 libapache2-mod-auth-openidc libhiredis0.14 | grep Version

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Version: 0.6.2.1-1+deb12u1
Version: 2.4.14.4-1.bookworm
Version: 0.14.1-3

However, when deploy to our environment, I see the same error - 500, and log message below.

[Thu Nov 02 00:39:01.757305 2023] [auth_openidc:error] [pid 11:tid 139729009882816] [client 10.0.3.117:53504] oidc_session_load_cache: cache backend failure for key 78591924-0a78-45ad-b383-776c03ea85db, referer: https://adw-aws-dev.apps.nwie.net/SearchResults
[Thu Nov 02 00:39:01.757314 2023] [auth_openidc:warn] [pid 11:tid 139729009882816] [client 10.0.3.117:53504] oidc_check_x_forwarded_hdr: header X-Forwarded-Host received but OIDCXForwardedHeaders not configured for it, referer: https://adw-aws-dev.xxx/SearchResults
[Thu Nov 02 00:39:01.757321 2023] [auth_openidc:warn] [pid 11:tid 139729009882816] [client 10.0.3.117:53504] oidc_check_x_forwarded_hdr: header X-Forwarded-Port received but OIDCXForwardedHeaders not configured for it, referer: https://adw-aws-dev.xxx/SearchResults
[Thu Nov 02 00:39:01.757324 2023] [auth_openidc:warn] [pid 11:tid 139729009882816] [client 10.0.3.117:53504] oidc_check_x_forwarded_hdr: header X-Forwarded-Proto received but OIDCXForwardedHeaders not configured for it, referer: https://adw-aws-dev.xxx/SearchResults
[Thu Nov 02 00:39:01.759238 2023] [auth_openidc:warn] [pid 93:tid 139729035060928] [client 10.0.3.117:53496] oidc_delete_oldest_state_cookies: deleting oldest state cookie: mod_auth_openidc_state_ZUXOZ6Ld8wbWRJ4L28f77A (time until expiry -60 seconds), referer: https://adw-aws-dev.xxx/SearchResults
[Thu Nov 02 00:39:01.759258 2023] [auth_openidc:warn] [pid 93:tid 139729035060928] [client 10.0.3.117:53496] oidc_delete_oldest_state_cookies: deleting oldest state cookie: mod_auth_openidc_state_vhkLpjDzyuxXVog16pPdzvL4 (time until expiry -60 seconds), referer: https://adw-aws-dev.xxx/SearchResults
[Thu Nov 02 00:39:01.759263 2023] [auth_openidc:warn] [pid 93:tid 139729035060928] [client 10.0.3.117:53496] oidc_delete_oldest_state_cookies: deleting oldest state cookie: mod_auth_openidc_state_-GG2c79xDysAw9zj7BlOFLSc (time until expiry -60 seconds), referer: https://adw-aws-dev.apps.nwie.net/SearchResults
[Thu Nov 02 00:39:01.759272 2023] [auth_openidc:error] [pid 93:tid 139729035060928] [client 10.0.3.117:53496] oidc_authenticate_user: the URL scheme (https) of the configured OIDCRedirectURI does not match the URL scheme of the URL being accessed (http): the "state" and "session" cookies will not be shared between the two!, referer: https://adw-aws-dev.xxx/SearchResults

It looks like 2.4.14.4 with httpd 2.4.58 do not work. I am going to try 2.4.9.4-0+deb11u3, which I know it works with 2.4.56. Is this the version? I don't see it in - https://github.com/OpenIDC/mod_auth_openidc/tags

Does this 2.4.9.4-0+deb11u3 work with bookworm or bulleye? I think you mentioned that it was with bookworm, right? Thanks!

hmoffatt Nov 2, 2023

Your Dockerfile looks good. The old deb is built for bullseye (deb11u3), it may or may not work with bookworm, and I don't know what your httpd:2.4 is based on because the repository you refer to is private (ntr.nwie.net/library/httpd:2.4).

All of the warnings look like configuration errors though to me. Maybe @zandbelt can comment on the cache backend failure.

zandbelt Nov 2, 2023
Maintainer

I suggest reading the error messages and act upon those by fixing the config first and then take it from there.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Httpd docker image in docker hub #1131

{{title}}

Replies: 2 comments 20 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

Select a reply

Httpd docker image in docker hub #1131

fong1999 Oct 20, 2023

Replies: 2 comments · 20 replies

zandbelt Oct 20, 2023 Maintainer

fong1999 Oct 20, 2023 Author

hmoffatt Oct 21, 2023

fong1999 Oct 22, 2023 Author

hmoffatt Oct 22, 2023

fong1999 Oct 23, 2023 Author

fong1999 Oct 23, 2023 Author

hmoffatt Oct 26, 2023

fong1999 Oct 31, 2023 Author

fong1999 Nov 2, 2023 Author

hmoffatt Nov 2, 2023

zandbelt Nov 2, 2023 Maintainer

fong1999
Oct 20, 2023

Replies: 2 comments 20 replies

zandbelt
Oct 20, 2023
Maintainer

fong1999 Oct 20, 2023
Author

fong1999 Oct 22, 2023
Author

fong1999 Oct 23, 2023
Author

fong1999
Oct 23, 2023
Author

fong1999 Oct 31, 2023
Author

fong1999 Nov 2, 2023
Author

zandbelt Nov 2, 2023
Maintainer