# Maintenance whitelist not working

**URL:** <https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624>\
**Category:** Get Help\
**Created:** [July 15, 2024, 4:42pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624 "2024-07-15T16:42:44Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jennyfothergill](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jennyfothergill/32/1204_2.png) [@jennyfothergill](https://discourse.openondemand.org/u/jennyfothergill)\
**Post date:** [July 15, 2024, 4:42pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/1 "2024-07-15T16:42:44Z")

</div>

When I navigate to our OnDemand site from a whitelisted IP, I get a 500 error. Maintenance mode is working–when I view the page from a non-whitelisted IP I see the maintenance message.

After changing the ood\_portal.yml, I’ve run update\_ood\_portal, restarted httpd, ondemand-dex, and removed and recreated the maintenance.enable file.

relevant bits of ood\_portal.yml (MY\_IP\_ADDRESS is replaced with my actual IP):

```auto
use_rewrites: true
use_maintenance: true
maintenance_ip_whitelist:
     - 'MY_IP_ADDRESS'

```

The error I see in error\_ssl.log:

```auto
oidc_util_decode_json_object: JSON parsing returned an error: '[' or '{' expected near '<' (<!DOCTYPE html>\n<html lang="en">\n <head>\n <title>Borah OnDemand Maintenance</title>\n </head>\n\n <body>\n <h1>Borah OnDemand is currently offline for maintenance</h1>\n Access will be restored by the end of today (Monday July, 15th)\n </body>\n</html>\n)
oidc_metadata_provider_retrieve: JSON parsing of retrieved Discovery document failed

```

I’ve also tried changing maintenance.html to remove all non-alphanumeric characters–same issue.

TIA!

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 15, 2024, 5:11pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/2 "2024-07-15T17:11:59Z")

</div>

Hi and welcome!

It appears to be having trouble with your OIDC provider. What’s the `oidc_provider_metadata_url` setting you have and is it valid json?

For example - CILogon’s `oidc_provider_metadata_url` is below. Hitting this, you can see that it’s JSON.

[https://cilogon.org/.well-known/openid-configuration](https://cilogon.org/.well-known/openid-configuration)

---

<div class="post-metadata">

**Author:** ![jennyfothergill](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jennyfothergill/32/1204_2.png) [@jennyfothergill](https://discourse.openondemand.org/u/jennyfothergill)\
**Post date:** [July 15, 2024, 5:19pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/3 "2024-07-15T17:19:14Z")

</div>

Thank you for the quick response!

Sorry if I misunderstand, but we don’t have that set in ood\_portal.yml as we’re using ondemand-dex:

```auto
# Default: null (value auto-generated if using Dex)
#oidc_provider_metadata_url: null

```

---

<div class="post-metadata">

**Author:** ![jennyfothergill](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jennyfothergill/32/1204_2.png) [@jennyfothergill](https://discourse.openondemand.org/u/jennyfothergill)\
**Post date:** [July 15, 2024, 5:21pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/4 "2024-07-15T17:21:46Z")

</div>

The url (I think autogenerated by dex) in the error is: [https://borah-ondemand.boisestate.edu/dex/.well-known/openid-configuration](https://borah-ondemand.boisestate.edu/dex/.well-known/openid-configuration)

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 15, 2024, 5:23pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/5 "2024-07-15T17:23:31Z")

</div>

OK - I’ll try to replicate. There could be a bug on our side - this is the URL it’s trying to access and can’t.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 15, 2024, 8:01pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/6 "2024-07-15T20:01:24Z")

</div>

I think as a workaround you can use `dex_uri: false` in `ood_portal.yml`. This way we don’t route through apache (which is giving you the issues) for OIDC calls.

Just for reference, this is a bug on our side.

---

<div class="post-metadata">

**Author:** ![jennyfothergill](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jennyfothergill/32/1204_2.png) [@jennyfothergill](https://discourse.openondemand.org/u/jennyfothergill)\
**Post date:** [July 15, 2024, 8:59pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/7 "2024-07-15T20:59:19Z")

</div>

Awesome, thank you!

We get a new error, which might be due to our firewall:  
`oidc_util_http_call: curl_easy_perform() failed on: https://borah-ondemand.boisestate.edu:5554/.well-known/openid-configuration (Failed to connect to borah-ondemand.boisestate.edu port 5554: Connection refused)`

Does port 5554 need to be open to the connecting clients? We’ve added the port in firewalld.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [July 16, 2024, 1:16pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/8 "2024-07-16T13:16:09Z")

</div>

> [@jennyfothergill](#):
>
> Does port 5554 need to be open to the connecting clients? We’ve added the port in firewalld.

It does. The issue is that either we proxy behind apache (port 443) but there’s currently a bug in that as you’re finding. If we don’t proxy, then we send requests directly to that port 5554.

---

<div class="post-metadata">

**Author:** ![jennyfothergill](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jennyfothergill/32/1204_2.png) [@jennyfothergill](https://discourse.openondemand.org/u/jennyfothergill)\
**Post date:** [July 18, 2024, 8:43pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/9 "2024-07-18T20:43:53Z")

</div>

OK, thank you–good to know. We’ll need to work with our network team to get this set up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [January 14, 2025, 8:44pm UTC](https://discourse.openondemand.org/t/maintenance-whitelist-not-working/3624/10 "2025-01-14T20:44:03Z")

</div>

Closed on January 14, 2025, 8:44pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.