Setting up OpenId Connect with DEX using ood-ansible

Get Help
1

Hello,

We have difficulties setting up OpenID + DEX + LDAP. We deploy OpenOnDemand using ood-ansible in v4.2.1 on a Ubuntu 24.04. Can anyone confirm we have correctly understood the configuration ?

It is unclear to use exactly which variables should be defined in the inventory.

In our ansible inventory, we set :

servername: portail.dce.metz.centralesupelec.fr
httpd_port: 443 # I believe could be set to null
oidc_uri: /oidc
install_ondemand_dex: true
oidc_settings_samefile: true

# Use OIDC authentication
httpd_auth:
  - "AuthType openid-connect"
  - "Require valid-user"
ood_auth_openidc:

dex_settings: |
   dex:
      connectors:
      - type: ldap
      ...

The dex_settings part is following OpenID Connect with Dex — Open OnDemand 4.2.0 documentation

We are not sure we are not mixing the two options for setting up Open Id between the “first and simplest” and “the second”.

It seems to me:

  • httpd_port should be set, either to null or 443 if we use SSL, otherwise, I believe it is defined as 80 in the defaults.
  • should oidc_uri be set to /oidc ?
  • httpd_auth must be set so that AuthType is correctly set to openid-connect
  • ood_auth_openidc has to be defined, although empty, otherwise some tasks are skipped , in particular the “Add OpenIDC config to apache” ood-ansible/tasks/configure.yml at b5c082d9827b0768adac4682461cab061eb7648b · OSC/ood-ansible · GitHub
  • in the ood-ansible doc, it is said oidc_settings_samefile must be set to true for the second option which would maybe mean it is should be kept to false for the first;

If someone can gear us in the right direction on which options should be set, that would greatly help

Thank you

Best

2

When you have dex configured, OnDemand supplies a lot of configurations automatically outside of ansible.

  • You need to supply oidc_crypto_passphrase - we no longer supply a default
  • oidc_uri will likely default when you have dex set, so I don’t think you need to set it, though I believe that’s the default.
  • ood_auth_openidc is a complementary file in the ansible role specifically. I would avoid using it for now as dex (OnDemand) will supply most things and even so you still specify things that get put into ood-portal.yml. That complimentary file exists if you have multiple virtual hosts that all need a shared oidc configuration. So if you don’t need a shared oidc configuration, then I would not use it and in-fact it may not even work with dex and how we provide OIDC configs in the ood virtualhost.
  • oidc_settings_samefile appears to be vestigial and not used anymore.
3

Thank you for your quick feedback Jeff;

We solved our authentication issue although I may not completely guarantee which are the critical settings as we repeated applications of the playbook with different variable settings and I did not remove all the installed softwares before reapplying the playbooks.

Still, I have the feeling that oidc_uri has to be defined. If I remove its declaration, I get the following error with the ood-ansible role :

TASK [ood_role : Add OpenIDC config to Apache] *******************************************************************************************************************************************************************************************************************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ansible.errors.AnsibleUndefinedVariable: {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemot
eUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined. {'OIDCRedirectURI': 'https:
//{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_
session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined                                                                                                                                                                                                  
fatal: [chome2]: FAILED! => {"changed": false, "msg": "AnsibleUndefinedVariable: {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivityTimeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'e
nvironment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is undefined. 'oidc_uri' is undefined. {'OIDCRedirectURI': 'https://{{ servername }}{{ oidc_uri }}', 'OIDCSessionInactivity
Timeout': 28800, 'OIDCSessionMaxDuration': 28800, 'OIDCRemoteUserClaim': 'preferred_username', 'OIDCPassClaimsAs': 'environment', 'OIDCStripCookies': 'mod_auth_openidc_session mod_auth_openidc_session_chunks mod_auth_openidc_session_0 mod_auth_openidc_session_1'}: 'oidc_uri' is und
efined. 'oidc_uri' is undefined"}

Thank you !