# URL-based profile selection

**URL:** <https://discourse.openondemand.org/t/url-based-profile-selection/3278>\
**Category:** Get Help\
**Tags:** question\
**Created:** [February 21, 2024, 11:57am UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278 "2024-02-21T11:57:29Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 21, 2024, 11:57am UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/1 "2024-02-21T11:57:30Z")

</div>

Hi! We want to setup multiple profiles to be used by different groups in our HPC clsuter.  
The idea would be to have the main OOD instance at (example):

`loginhost.domain.com`

and the different profiles for the groups (group A, group B) based on the URL (example):

`groupa.loginhost.domain.com` → uses Group A profile  
`groupb.loginhost.domain.com` → uses Group B profile

We setup some DNS so when accessing `groupa.loginhost.domain.com` or `groupb.loginhost.domain.com` it resolves the IP to `loginhost.domain.com`

The problem is that, having in the ood\_portal.yml configuration something like:  
`servername: loginhost.domain.com`

it seems OOD always redirects to this URL and doesn’t apply the group profile.

So I don’t get if the documentation suggests a profile configuration like:

```auto
profiles:
  www.production.com: &production_profile # Anchor definition
    config_property: config_value
    config_property: config_value
    config_property: config_value

  www.local.com: *production_profile # Defining an alias to the previously set anchor.
  www.test.com: *production_profile
  www.staging.com: *production_profile

```

just to be able to share the configuration file but to get a different profile you should use different OOD instances or I’m configuring it in the wrong way.

So I hope my need is clear: having different URLs resolving to the same OOD instance and select a profile based on the URL used.

Moreover, we also wanted to give the possibility to the users to select a different profile using the menu but I feel if you enable `host_based_profiles` this will be the only way the profile gets selected. Is it right?

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 21, 2024, 4:23pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/2 "2024-02-21T16:23:03Z")

</div>

In the meantime I tried to add:

```auto
server_aliases:
  - groupa.loginhost.domain.com

```

in ood\_portal.yml but this didn’t help. OOD is still redirecting to `servername`

It looks I’m still missing some Apache Server setting to have it working

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 21, 2024, 9:29pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/3 "2024-02-21T21:29:12Z")

</div>

I’ll have to look into this a little bit more. The feature `host_based_profiles` is supposed to work as you indicate, with the configurations you’ve given.

Though I am now recalling something about YAML anchors in either the new Ruby version or Psych itself - I’d ask you to check your logs to see if those configuration files are being red correctly with anchors.

In any case, this was how this was supposed to work, but I don’t know if anyone’s actually used it in production yet. I’ll look into it more next week (I’m on vacation the rest of this week) and let you know.

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 22, 2024, 8:13am UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/4 "2024-02-22T08:13:33Z")

</div>

I have the feeling the Apache server should not redirect the request to the URL configured in the `servername`. When this happens than the “profile” part will always see the same name and no possibility to have different profiles. So I’m looking at Apache configuration in the meantime.  
Thanks for your help (and from anyone else which tried already this already)

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 22, 2024, 5:23pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/5 "2024-02-22T17:23:17Z")

</div>

Thinking about this a little more, this may be fixed in 3.1 with the patch [Added support for multiple domains for Apache config in portal generator by abujeda · Pull Request #3264 · OSC/ondemand · GitHub](https://github.com/OSC/ondemand/pull/3264)

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 22, 2024, 7:33pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/6 "2024-02-22T19:33:11Z")

</div>

I updated the template ( I think the other file in the commit is just an examples so probably not needed).

Anyway, it still doesn’t work. I tried 2 cases.  
Case 1.

```auto
servername: groupa.loginhost.domain.com

server_aliases:
  - loginhost.domain.com

```

only: `groupa.loginhost.domain.com` works.

when accessing `loginhost.domain.com` I get an error in the logs:

```auto
==> groupa.loginhost.domain.com_error_ssl.log <==
[Thu Feb 22 14:28:50.288083 2024] [auth_openidc:error] [pid 1503193:tid 140063950984960] [client 10.165.16.254:57001] oidc_authenticate_user: the URL hostname (groupa.loginhost.domain.com) of the configured OIDCRedirectURI does not match the URL hostname of the URL being accessed (loginhost.domain.com): the "state" and "session" cookies will not be shared between the two!

```

Case 2:

```auto
servername: loginhost.domain.com

server_aliases:
  - groupa.loginhost.domain.com

```

only: `loginhost.domain.com` works.

when accessing `groupa.loginhost.domain.com` I get an error in the logs:

```auto
==> loginhost.domain.com_error_ssl.log <==
[Thu Feb 22 14:25:24.976667 2024] [auth_openidc:warn] [pid 1502055:tid 140076591867648] [client 10.165.16.254:56164] oidc_clean_expired_state_cookies: state (mod_auth_openidc_state_21Yp4JHSV0VT0H5NkN2WZ69Vj0A) has expired (original_url=https://groupa.loginhost.domain.com/pun/sys/dashboard)
[Thu Feb 22 14:25:24.976723 2024] [auth_openidc:warn] [pid 1502055:tid 140076591867648] [client 10.165.16.254:56164] oidc_clean_expired_state_cookies: state (mod_auth_openidc_state_nCAgwmU4xf035aeRy4bPFIpI4T0) has expired (original_url=https://groupa.loginhost.domain.com/pun/sys/dashboard)

[Thu Feb 22 14:25:25.460778 2024] [auth_openidc:error] [pid 1502055:tid 140077371340544] [client 10.165.16.254:56114] oidc_restore_proto_state: no "mod_auth_openidc_state_BEfCxeJcR63kJtzqpu6f6TRoMH8" state cookie found
[Thu Feb 22 14:25:25.460817 2024] [auth_openidc:error] [pid 1502055:tid 140077371340544] [client 10.165.16.254:56114] oidc_unsolicited_proto_state: could not parse JWT from state: invalid unsolicited response: [src/jose.c:809: oidc_jwt_parse]: cjose_jws_import failed: invalid argument [file: jws.c, function: cjose_jws_import, line: 781]
[Thu Feb 22 14:25:25.460821 2024] [auth_openidc:error] [pid 1502055:tid 140077371340544] [client 10.165.16.254:56114] oidc_authorization_response_match_state: unable to restore state
[Thu Feb 22 14:25:25.460824 2024] [auth_openidc:error] [pid 1502055:tid 140077371340544] [client 10.165.16.254:56114] oidc_handle_authorization_response: invalid authorization response state and no default SSO URL is set, sending an error...

```

So, the only URL which works is the one configured as `servername` .

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 26, 2024, 2:34pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/7 "2024-02-26T14:34:54Z")

</div>

Have you tried the same on 3.1? As I say, this may have been patched since 3.0.

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 27, 2024, 10:09am UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/8 "2024-02-27T10:09:57Z")

</div>

I copied the template from version 3.1 and it didn’t fix it. I will try again with version 3.1. Do you think you will be able to test the configuration on your side too?

The other question is what’s the right configuration, case 1 or case 2?

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [February 28, 2024, 6:42pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/9 "2024-02-28T18:42:33Z")

</div>

Just tried with version 3.1.1, same issue.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [February 28, 2024, 6:53pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/10 "2024-02-28T18:53:48Z")

</div>

OK thanks. I’ll have to replicate on our systems which may take a bit to configure DNS and all that. When I figure it out, I’ll patch 3.1.

---

<div class="post-metadata">

**Author:** ![abujeda](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/abujeda/32/2162_2.png) [@abujeda](https://discourse.openondemand.org/u/abujeda)\
**Post date:** [March 13, 2024, 5:38pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/11 "2024-03-13T17:38:37Z")

</div>

This issue could be related with the way the ood-portal-generator creates the OIDC configuration for the OIDCRedirectURI directive. It is currently being constructed with the value from servername.

I believe that mod\_auth\_openidc supports relative URLs.

@fenz a quick test you can do is to hot-fix the ood-portal.conf.erb template, the following line:

> <https://github.com/OSC/ondemand/blob/master/ood-portal-generator/templates/ood-portal.conf.erb#L134>

with:  
OIDCRedirectURI \<%= @oidc\_uri %\>

To see if that fixes the issue.

We use basic auth for authentication in our installation (and multiple domains work with the 3.1 fix in this context), so I was not able to reproduce. We are transitioning to OIDC and we use multiple domains, so we will have this problem soon enough.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 13, 2024, 6:56pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/12 "2024-03-13T18:56:18Z")

</div>

Thanks for chiming in @abujeda!

I forgot about this actually - so I’ll create a ticket internally to set this up at OSC and debug it sometime this week.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [March 21, 2024, 8:17pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/13 "2024-03-21T20:17:05Z")

</div>

I’m just circling back to this now. There are a few issues, but what @abujeda mentions is also correct. We’re building OIDCRedirectURI to have the full URI in it, when it should be relative. The patch/hack Aday suggests will get this working if your users always use the https url. if they use plain http they’ll be routed back to the default `servername`.

---

<div class="post-metadata">

**Author:** ![fenz](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/fenz/32/496_2.png) [@fenz](https://discourse.openondemand.org/u/fenz)\
**Post date:** [April 12, 2024, 4:55pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/14 "2024-04-12T16:55:51Z")

</div>

Sorry for getting back to you so late. I just had time to test it.  
The changes proposed fix the issue, the host-based profile can now be used.  
Thanks for your help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [October 9, 2024, 4:56pm UTC](https://discourse.openondemand.org/t/url-based-profile-selection/3278/15 "2024-10-09T16:56:30Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.