Hi Jeff,
sorry for the delay in replying, I had to do other things.
Sorry also for obfuscating the domain. It really is a valid GEANT domain.
I have been testing, I have launched curl and openssl s_client from outside and from inside the internal network where the ondemand server is. From both I get good result similar to the following. Sorry for obfuscating it again.
pc@hostname:~$ curl -vvvv https://myhpc.domain.es/dex/.well-known/openid-configuration
* Trying PUBLICIP:443...
* Connected to myhpc.domain.es (PUBLICIP) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* CAfile: /etc/ssl/certs/ca-certificates.crt
* CApath: /etc/ssl/certs
* TLSv1.0 (OUT), TLS header, Certificate Status (22):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.2 (IN), TLS header, Certificate Status (22):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS header, Finished (20):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.2 (OUT), TLS header, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=ES; ST=Madrid; O=ORG CN=myhpc.domain.es
* start date: Feb 17 00:00:00 2023 GMT
* expire date: Feb 17 23:59:59 2024 GMT
* subjectAltName: host "myhpc.domain.es" matched cert's "myhpc.domain.es"
* issuer: C=NL; O=GEANT Vereniging; CN=GEANT OV RSA CA 4
* SSL certificate verify ok.
* TLSv1.2 (OUT), TLS header, Supplemental data (23):
> GET /dex/.well-known/openid-configuration HTTP/1.1
> Host: myhpc.domain.es
> User-Agent: curl/7.81.0
> Accept: */*
>
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* TLSv1.2 (IN), TLS header, Supplemental data (23):
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Fri, 09 Jun 2023 06:48:40 GMT
< Server: Apache/2.4.37 (rocky) OpenSSL/1.1.1k
< Content-Security-Policy: frame-ancestors https://myhpc.domain.es;
< Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
< Content-Length: 1158
< Content-Type: application/json
<
{
"issuer": "https://myhpc.domain.es/dex",
"authorization_endpoint": "https://myhpc.domain.es/dex/auth",
"token_endpoint": "https://myhpc.domain.es/dex/token",
"jwks_uri": "https://myhpc.domain.es/dex/keys",
"userinfo_endpoint": "https://myhpc.domain.es/dex/userinfo",
"device_authorization_endpoint": "https://myhpc.domain.es/dex/device/code",
"grant_types_supported": [
"authorization_code",
"refresh_token",
"urn:ietf:params:oauth:grant-type:device_code"
],
"response_types_supported": [
"code"
],
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"code_challenge_methods_supported": [
"S256",
"plain"
],
"scopes_supported": [
"openid",
"email",
"groups",
"profile",
"offline_access"
],
"token_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post"
],
"claims_supported": [
"iss",
"sub",
"aud",
"iat",
"exp",
"email",
"email_verified",
"locale",
"name",
"preferred_username",
"at_hash"
]
* Connection #0 to host myhpc.domain.es left intact
I can’t quite see the cause, whether I try from a machine outside the network through the firewall I get good results from curl. If I do it from a machine on the internal(private) network that is on the same network as the ondemand server then no problem. In the firewall NAT reflection is enabled to allow this so this should not be the cause. But when I do it from the ondemand server itself I get something like this.
[root@ondemandserver ~]# curl -vvvv https://myhpc.domain.es/dex/.well-known/openid-configuration
* Trying PUBLICIP...
* TCP_NODELAY set
* Connected to myhpc.domain.es (PUBLICIP) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/pki/tls/certs/ca-bundle.crt
CApath: none
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to myhpc.domain.es:443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to myhpc.domain.es:443
It must be something silly and obvious but I can’t find the cause.
Best regards