# Update\_ood\_portal not acting on OIDC components

**URL:** <https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524>\
**Category:** Get Help\
**Created:** [September 16, 2025, 1:22pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524 "2025-09-16T13:22:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hephaestois](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hephaestois/32/3011_2.png) [@Hephaestois](https://discourse.openondemand.org/u/Hephaestois)\
**Post date:** [September 16, 2025, 1:22pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524/1 "2025-09-16T13:22:48Z")

</div>

Hello!

I am currently configuring OOD 4.0.0 for a test cluster, in preparation for a larger rollout. For authentication, I am using an existing Keycloak server with OIDC. I’ve noticed that the oidc-related fields (oidc\_provider\_metadata\_url, oidc\_client\_id, etc) in ood\_portal.yml don’t affect anything when I set/unset them. The script update\_ood\_portal also says no changes were made to the config files when I run it after adding/removing the oidc fields. Changing non-oidc fields does impact the configuration files.

To get around this problem, I have created an extra ood-oidc.conf in /etc/httpd/conf.d and set the fields for Apache myself, which solved my issues, but going off the documentation in [ood\_portal.yml — Open OnDemand 4.0.0 documentation](https://osc.github.io/ood-documentation/latest/reference/files/ood-portal-yml.html) this should not be necessary (and avoided). Running `cat /etc/httpd/conf.d/ood-portal.conf | grep oidc -i` has also never shown output. This seems like a problem to me, so I am starting this thread to ask about it.

Sincerely, Hazel

For reference, my current ood\_portal.yml & ood-oidc.conf:

```yaml
#/etc/ood/config/ood_portal.yml
listen_addr_port: "443"

auth:
  - "AuthType openid-connect"
  - "Require valid-user"

ssl:
  - 'SSLCertificateFile "/etc/pki/tls/certs/localhost.crt"'
  - 'SSLCertificateKeyFile "/etc/pki/tls/private/localhost.key"'

#Nothing changes when (un)commenting these. Private data hidden.
#oidc_provider_metadata_url: "<metadata-url>"
#oidc_client_id: "<client-id>"
#oidc_client_secret: "<client-secret>"
#oidc_scope: "openid profile email"
#redirect_uri: "<redirect-uri>"
#logout_redirect_uri: "<logout_redirect_uri>"

dex: false

```

```auto
#/etc/httpd/conf.d/ood-oidc.conf
OIDCProviderMetadataUrl <metadata-url>
OIDCClientID <client-id>
OIDCClientSecret <client-secret>
OIDCRedirectURI <redirect-uri>
OIDCCryptoPassphrase "<passphrase>"
OIDCScope "openid profile email"
OIDCRemoteUserClaim preferred_username

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 16, 2025, 1:31pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524/2 "2025-09-16T13:31:20Z")

</div>

Hi and welcome!

The only issue I can think of is `dex` being involved. If you have it installed on your system, I’d remove it. I see you have it set to `false` there, but I wonder if there’s still any issue.

I also wonder if you’re seeing messages about ‘not replacing’. If you’ve ever edited the `ood-portal.conf` you can get into a weird state where we’re not going to replace it because you’ve edited it by hand. You can use the `-f` parameter to force an update through `update_ood_portal`.

Lastly I’d just spot check `journalctl` for any issues with httpd as `update_ood_portal` gets run when you bounce httpd.

---

<div class="post-metadata">

**Author:** ![Hephaestois](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/hephaestois/32/3011_2.png) [@Hephaestois](https://discourse.openondemand.org/u/Hephaestois)\
**Post date:** [September 16, 2025, 7:19pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524/3 "2025-09-16T19:19:19Z")

</div>

Thank you!

I’ve already found the Dex issue when looking around to find similar problems ( [OOD 2.0.13 update\_ood\_portal and oidc configuration - #7 by jeff.ohrstrom](https://discourse.openondemand.org/t/ood-2-0-13-update-ood-portal-and-oidc-configuration/1631/7) ). I am not quite sure _what_ to uninstall to remove `ondemand-dex`, so a clarification would be appreciated there. Doing a very crude search (matching all file/dirnames to ‘dex’ ! ’index’) I couldn’t find any ondemand-dex. In any case, I have not (willingly) installed it per [1. Install Software — Open OnDemand 4.0.0 documentation](https://osc.github.io/ood-documentation/latest/installation/install-software.html) .

I have not seen ‘not replacing’ messages come by, in fact I ran `update_ood_portal` with `-f` by default because of the issues I was encountering. I have also occasionally deleted all ood-portal.conf to be sure no ‘old version’ was creeping out of somewhere.

Regarding the journalctl, below is the (relevant, private data removed) output of `journalctl -xeu httpd'`. This is with the included ood-oidc.conf file providing OpenID Connect data to httpd:

```auto
Sep 16 21:14:12 <server> systemd[1]: Starting The Apache HTTP Server...
░░ Subject: A start job for unit httpd.service has begun execution
░░ Defined-By: systemd
░░ Support: https://wiki.rockylinux.org/rocky/support
░░
░░ A start job for unit httpd.service has begun execution.
░░
░░ The job identifier is 26140.
Sep 16 21:14:12 <server> update_ood_portal[85837]: No change in Apache config.
Sep 16 21:14:12 <server> httpd[85860]: Server configured, listening on: port 443, port 80
Sep 16 21:14:12 <server> systemd[1]: Started The Apache HTTP Server.
░░ Subject: A start job for unit httpd.service has finished successfully
░░ Defined-By: systemd
░░ Support: https://wiki.rockylinux.org/rocky/support
░░
░░ A start job for unit httpd.service has finished successfully.
░░
░░ The job identifier is 26140.

```

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 16, 2025, 7:29pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524/4 "2025-09-16T19:29:43Z")

</div>

OK - if you haven’t installed `ondemand-dex` then there may be no issue. Just FYI I think `rpm -qa ondemand-dex` will show if it’s installed (or at least there’s some rpm/dnf/rpmquery command to see if it’s installed, that’s just recalled off the top of my head).

Taking another look at what configs you’ve provided, I think you may be missing the `oidc_uri` configuration.

We have this expression which requires these 3 configurations of which you have only 2. I think it’s likely as simple as that, but that also could explain why it never sees any difference.

> <https://github.com/OSC/ondemand/blob/5ecfabca3a8f5bb8d3eed25582b70f1f8a38c87f/ood-portal-generator/templates/ood-portal.conf.erb#L129>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [March 15, 2026, 7:29pm UTC](https://discourse.openondemand.org/t/update-ood-portal-not-acting-on-oidc-components/4524/5 "2026-03-15T19:29:58Z")

</div>

Closed on March 15, 2026, 7:29pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.