When trying to authenticate, I see the following error:
/var/log/httpd24/ondemand.jhuapl.edu_error_ssl.log:[Mon Nov 02 18:56:34.221146 2020] [auth_basic:error] [pid 37541] [client 10.100.10.124:46994] AH01618: user ticemp1 not found: /pun/sys/dashboard
The user exists on the server & in LDAP. Are there any other logs to check?
The logs say auth_basic:error and it should be mod_auth_openidc. It seems you don’t have OIDC auth configured in your ood-portal.conf. What’s the auth section of /etc/ood/config/ood_portal.yml look like?
Yea so you need this, to configure apache to use OpenIDC.
# httpd_auth in your ansible configurations is the resulting auth in ood_portal.yml
httpd_auth:
- 'AuthType openid-connect'
- 'Require valid-user'
Then you’ll need all sorts of openidc related configurations to get apache to recognize your dex instance. Here’s the README for the ood-ansible role on how to configure open idc related items.
No, Keycloak is different identity provider, different from Dex that is. Dex is the one you’ve got installed and is easier to configure, so that’s it. But from the Apache side they’re essentially the same whether you use Dex, or Keycloak or even Google.
Also here’s the apache module’s documentation. I’d say focus on that and what those options are that you need to configure.
Thanks, so it turns out ondemand-dex wasn’t running because of the following:
Nov 03 13:10:43 aplcdhen01 ondemand-dex[23591]: failed to initialize server: server: failed to load web static: load dir: directory “web/themes/coreos” does not exist
Nov 03 13:10:43 aplcdhen01 systemd[1]: ondemand-dex.service: main process exited, code=exited, status=2/INVALIDARGUMENT
I’m not seeing a coreos directory in /usr/share/ondemand-dex/web/themes/, however there is a ondemand directory.
# ls -l /usr/share/ondemand-dex/web/themes/
total 0
drwxr-xr-x 2 root root 117 Nov 2 16:20 ondemand
I even went to clone the repo from GitHub - OSC/ondemand-dex but it wasn’t there either. Is there a config somewhere that’s looking for that directory?
Copy the entire contents of /web in the ondemand-dex repo to /usr/share/ondemand-dex/web. This is important because /web contains Bootstrap and other helper CSS styles that the ondemand theme uses.
@miketice22 What does your /etc/ood/config/ood_portal.yml look like? Also make sure you run /opt/ood/ood-portal-generator/sbin/update_ood_portal after you update Dex configs or modify ood_portal.yml.
Nov 03 18:29:58 aplcdhen01 ondemand-dex[1521]: failed to initialize server: server: failed to load web static: load dir: directory “web/themes/coreos” does not exist
You need to override the theme.
Add this under the dex key in /etc/ood/config/ood_portal.yml:
# This is the default, but illustrating how to change
frontend:
theme: ondemand
I made the change, however the generator said there was no change to the apache config, and it still shows that error even after restarting ondemand-dex.
to /etc/ood/dex/config.yaml and restarted ondemand-dex and that got rid of the error, but now I get a 500 error:
[Tue Nov 03 19:01:05.377797 2020] [auth_openidc:error] [pid 4207] [client 10.100.10.124:54234] oidc_check_userid_openidc: configuration error: the authentication type is set to “openid-connect” but OIDCRedirectURI has not been set.
Very little configuration is needed to work with Dex. You do not need to set logout_redirect or logout_uri and default_auth_openidc isn’t something ood-portal-generator supports so just delete that, it’s not used by OnDemand.
Also if you omit auth and enable Dex the value you provided is the default set by OnDemand. Same goes for oidc_uri.
Also copying themes is not needed if you are using the RPM to install ondemand-dex. If you are not using the RPM then whatever method you used to install is flawed and not doing a proper install. It’s not clear to me from this thread exactly where the install method came from but the recommended install method is RPM and that will not require any modifications or copies of themes.
This is a minimal example of a working OnDemand instance I deploy at OSC to test Dex:
After you’ve made changes to ood_portal.yml and run the update_ood_portal command please run the grep command from above and share the output, feel free to omit the secret.
What version of OnDemand is installed? Can check with rpm -q ondemand and also is Dex installed via RPM? Can check with rpm -q ondemand-dex. The Dex logic for OnDemand was added with the 1.8 releases.
The code for OnDemand checks 3 things to see if Dex logic should be deployed and Dex defaults set:
Dex configurations are specified - this you are doing so this is fine
/etc/ood/dex directory exists , does that directory exist?
/usr/sbin/ondemand-dex binary exists, does /usr/sbin/ondemand-dex exist?
If you installed via RPM #2 and #3 are handled automatically. If your using some other method for installing OnDemand then extra steps will need to be taken to ensure that Dex is seen as actually installed by OnDemand.