LinkedIn Login

[amit-tewari]

I am trying to login using LinkedIN to a locally hosted Apache instance, with following configuration:

</VirtualHost>

  ## LinkedIN login
  OIDCProviderMetadataURL https://www.linkedin.com/oauth/.well-known/openid-configuration
  OIDCClientID <CLIENT-ID>
  OIDCClientSecret <CLIENT-SECRET>
  OIDCProviderTokenEndpointAuth client_secret_post
  OIDCRedirectURI http://localhost/example/redirect_uri
  OIDCCryptoPassphrase <CRYPTO-PASS>
  OIDCScope "openid email profile"
  OIDCRemoteUserClaim "email"
  <Location /example/>
    AuthType openid-connect
    Require valid-user
  </Location>
</VirtualHost>

I get

[Wed Aug 16 07:29:06.874957 2023] [auth_openidc:error] [pid 731:tid 139980634584768] [client 172.18.0.1:38446] oidc_proto_validate_nonce: id_token JSON payload did not contain a "nonce" string: [src/jose.c:623: oidc_jose_get_string]: mandatory JSON key "nonce" could not be found
[Wed Aug 16 07:29:06.875012 2023] [auth_openidc:error] [pid 731:tid 139980634584768] [client 172.18.0.1:38446] oidc_proto_parse_idtoken: id_token payload could not be validated, aborting

If I change OIDCProviderTokenEndpointAuth client_secret_post to OIDCProviderTokenEndpointAuth client_secret_basic, I get

[Wed Aug 16 07:41:12.938187 2023] [auth_openidc:error] [pid 85:tid 140327734122176] [client 172.18.0.1:52490] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error" entry with value: ""invalid_request""
[Wed Aug 16 07:41:12.938253 2023] [auth_openidc:error] [pid 85:tid 140327734122176] [client 172.18.0.1:52490] oidc_util_json_string_print: oidc_util_check_json_error: response contained an "error_description" entry with value: ""A required parameter \\"client_secret\\" is missing""
[Wed Aug 16 07:41:12.938261 2023] [auth_openidc:error] [pid 85:tid 140327734122176] [client 172.18.0.1:52490] oidc_proto_resolve_code_and_validate_response: failed to resolve the code

I tried going through https://github.com/OpenIDC/mod_auth_openidc/blob/master/auth_openidc.conf , in combination with https://www.linkedin.com/oauth/.well-known/openid-configuration, but could not come up with a configuration that would have worked.

I have very basic idea of OIDC, so I might be missing something very obvious, but need help figuring out how to proceed.

[amit-tewari]

@zandbelt ,
Do you have any suggestions for this?

[amit-tewari]

With LogLevel debug set, it seems LinkedIn is sending nonce outside the jwt.payload field. Grants etc work, and yet final outcome is error.

I am not sure if this is a bug on LinkedIn side or something on the mod_auth_openidc needs to be fixed, and should create a bug report.

[Fri Aug 18 14:39:34.658270 2023] [auth_openidc:debug] [pid 2862:tid 140168957662912] src/proto.c(1582): [client 172.18.0.1:32974] oidc_proto_jwt_verify: JWT signature verification with algorithm "RS256" was successful
[Fri Aug 18 14:39:34.658295 2023] [auth_openidc:debug] [pid 2862:tid 140168957662912] src/proto.c(1348): [client 172.18.0.1:32974] oidc_proto_validate_idtoken: enter, jwt.header="{"zip":"RS256","typ":"JWT","kid":"d929668a-bab1-4c69-9598-4373149723ff","alg":"RS256"}", jwt.payload="{"iss":"https://www.linkedin.com","aud":"78v1ze84gwoz41","iat":1692369574,"exp":1692373174,"sub":"lOkHTxDIH5","name":"NAME","given_name":"GIVEN NAME","family_name":"FAMILY NAME","picture":"PROFILE PIC","email":"EMAIL","email_verified":"true","locale":"en_US"}", nonce="gn5RsLZH53RFQnJTsKrybSAOR6dal_qNlYxF--1-doY"
[Fri Aug 18 14:39:34.658307 2023] [auth_openidc:debug] [pid 2862:tid 140168957662912] src/cache/common.c(271): [client 172.18.0.1:32974] oidc_cache_get: enter: gn5RsLZH53RFQnJTsKrybSAOR6dal_qNlYxF--1-doY (section=n, decrypt=0, type=shm)
[Fri Aug 18 14:39:34.658339 2023] [auth_openidc:debug] [pid 2862:tid 140168957662912] src/cache/common.c(306): [client 172.18.0.1:32974] oidc_cache_get: cache miss from shm cache backend for key gn5RsLZH53RFQnJTsKrybSAOR6dal_qNlYxF--1-doY
[Fri Aug 18 14:39:34.658351 2023] [auth_openidc:error] [pid 2862:tid 140168957662912] [client 172.18.0.1:32974] oidc_proto_validate_nonce: id_token JSON payload did not contain a "nonce" string: [src/jose.c:623: oidc_jose_get_string]: mandatory JSON key "nonce" could not be found
[Fri Aug 18 14:39:34.658358 2023] [auth_openidc:error] [pid 2862:tid 140168957662912] [client 172.18.0.1:32974] oidc_proto_parse_idtoken: id_token payload could not be validated, aborting
[Fri Aug 18 14:39:34.658415 2023] [authz_core:debug] [pid 2862:tid 140168957662912] mod_authz_core.c(815): [client 172.18.0.1:32974] AH01626: authorization result of Require valid-user : granted
[Fri Aug 18 14:39:34.658423 2023] [authz_core:debug] [pid 2862:tid 140168957662912] mod_authz_core.c(815): [client 172.18.0.1:32974] AH01626: authorization result of <RequireAny>: granted

[amit-tewari]

https://openid.net/specs/openid-connect-core-1_0.html

nonce
String value used to associate a Client session with an ID Token, and to mitigate replay attacks.
The value is passed through unmodified from the Authentication Request to the ID Token. 
If present in the ID Token, 
   Clients MUST verify that the nonce Claim Value is equal to the value of the nonce parameter
   sent in the Authentication Request. 
If present in the Authentication Request, 
   Authorization Servers MUST include a nonce Claim in the ID Token with the Claim Value being 
  the nonce value sent in the Authentication Request. Authorization Servers SHOULD perform no
  other processing on nonce values used. The nonce value is a case sensitive string.

while other fields in id token are specified clearly as REQUIRED or OPTIONAL, nothing specified for nonce :(

[zandbelt]

"If present in the Authentication Request, Authorization Servers MUST include a nonce Claim in the ID Token" applies here, LinkedIn is not an OpenID Connect compliant Provider

[amit-tewari]

@zandbelt ,
Thank you for your reply.
2nd log line in #1095 (comment) shows that nonce was provided (but outside jwt.payload).

• Does module check nonce only inside jwt.payload, as of now?
• MUST nonce always be in jwt.payload (or some other part of the response)?
  • If not, should I create a issue in the repo?
  • if yes, should I try with LinkedIN to have nonce in any specific part of the response to be standard compliant?

[zandbelt]

I guess you could try and ask LinkedIn to certify (and fix) their implementation through https://openid.net/certification/

[amit-tewari]

For anyone who comes across same, from LinkedIN support.

Unfortunately, at the moment we don't support OIDC for implicit flows  ( nonce issue only 
applicable for implicit flows) and we are currently not claiming or intent to have certified
OIDC provider at this point.