php files are not protected by AuthType openid_connect

[smstong]

My testing ENV:

• RockyLinux 9 on X64
• httpd-2.4
• php-fpm-8.0
• mod_auth_openidc-2.4.10

With below Apache httpd conf,
access to https://my-server.com/protected/anyname.php doesn't trigger login.
But access to https://my-server.com/protected/anyname.html triggers login.

And if replace the AuthType openid-connect to Basic, both php and html files trigger login.

<Location /protected/>
    AuthType openid-connect
    Require valid-user
</Location>

#
# Redirect to local php-fpm (no mod_php in default configuration)
#
<IfModule !mod_php.c>
    # Enable http authorization headers
    SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1

    <FilesMatch \.(php|phar)$>
        SetHandler "proxy:unix:/run/php-fpm/www.sock|fcgi://localhost"
    </FilesMatch>
</IfModule>

[zandbelt]

perhaps the log files with LogLevel set to auth_openidc:debug tell you more; I'd also advise to upgrade to the latest 2.4.16.6

[smstong]

Thanks. With LogLevel set to auth_openidc:debug, I compared the differences between accessing /protected/index.hello and /protected/index.php.

For index.php, after below line, no output logs.

`[Sat Jan 04 11:50:26.697532 2025] [auth_openidc:debug] [pid 330833:tid 330969] src/mod_auth_openidc.c(2284): [client 10.88.88.103:
60266] oidc_authenticate_user: defer discovery to the content handler, referer: https://home.linuxexam.net/index.html

`

For index.hello, the logs are
128 [Sat Jan 04 11:24:54.615942 2025] [auth_openidc:debug] [pid 330832:tid 330878] src/mod_auth_openidc.c(2284): [client 10.88.88. 103:60185] oidc_authenticate_user: defer discovery to the content handler 129 [Sat Jan 04 11:24:54.616013 2025] [auth_openidc:debug] [pid 330832:tid 330878] src/util.c(1394): [client 10.88.88.103:60185] o idc_util_request_matches_url: comparing "/protected/index.hello"=="/protected/redirect_uri" 130 [Sat Jan 04 11:24:54.616029 2025] [auth_openidc:debug] [pid 330832:tid 330878] src/mod_auth_openidc.c(2116): [client 10.88.88. 103:60185] oidc_discovery: enter

[zandbelt]

I think there were improvements to multi-provider setups since 2.4.10, please use 2.4.16.6 to confirm (and perhaps start with a single OP config).

[smstong]

Thank you again.
With the latest version ( compiled from the master branch ) of mod_auth_openidc, the problem above disappeared.

Unfortunately, RockyLinux 9's official package repo hasn't been updated to the new version of mod_auth_openidc yet.