correct five pages against the current code, and document redis-failover
- Cookies.md: the four quoted log lines could not be found by anyone
grepping for them. oidc_util_set_cookie is oidc_http_set_cookie now, and
"cookie value possibly corrupted" and the oidc_crypto_aes_decrypt /
EVP_DecryptFinal_ex line no longer exist at all; replaced with the
messages the code emits today.
- Curity-Identity-Server.md: the manual configuration block omitted
OIDCProviderJwksUri, so Apache starts without complaint and the first
login fails on ID token signature verification.
- Home.md: SetEnv https_proxy does not route the module's own outgoing
calls -- it populates the request's CGI environment, not the server
process environment libcurl reads -- so OIDCOutgoingProxy is named as
the setting that does the work rather than as an addition.
- Security-Profiles-and-Token-Binding.md: "a profile is a starting point,
not a lock" was wrong for the four settings FAPI20 enforces regardless
of configuration (PAR, S256, and the issuer as both authentication
audiences). It also understated the reverse: the ID token aud values are
overridable, and DPoP stands down to the configured mode for the mTLS
variant of the profile.
- Caching.md: document the redis-failover backend, the per-server
credentials accepted in OIDCRedisCacheServer and
OIDCRedisCacheFailbackInterval, none of which appeared anywhere.
Chunk-size-0 in Caching.md is left as it stands: the parser now accepts 0,
so the page became correct rather than needing a change.
fix: correct statements that contradict the code
Verified against the mod_auth_openidc source tree:
- Cookies: the OIDCCookieSameSite default is Lax, not None (cfg.c:
OIDC_DEFAULT_COOKIE_SAME_SITE); document the per-cookie form that form_post
needs
- Cookies: both cookies are only non-persistent by default; note the
OIDCSessionType ":persistent" suffix
- Observability: the second "redirect_uri.request.session" is really
"redirect_uri.request.revoke_session" (metrics.h)
- Observability: OIDCMetricsPublish, not OIDCMetricsData, configures the URL
that returns the data
- Observability: 11 histogram buckets, not 10; spell out the thresholds
- Access tokens: "no_refresh_token_exists" is not an error code the module ever
emits - a missing refresh token surfaces as "refresh_failed". Document the
"error saving session" code that does exist (handle/refresh.c)
- Known limitations: "Require claim:sub <value>" is invalid syntax
- Step-up: drop "Require valid-user" from both examples. Apache merges Require
directives with RequireAny and the module only registers "claim" and
"claims_expr" as authz providers, so valid-user short-circuited the acr/scope
check and step-up could never trigger. Say so explicitly
- Caching: shm entry size minimum is 8736 with 32 bytes overhead, not 8192/17;
drop the "6 different pieces of information" count that never matched the list
- Home: REDIRECT_OIDC_AUTHZ_ERROR carries the unmatched Require claim arguments,
not "scopes" (handle/authz.c)
- Home: max_age rather than max_auth_age, and add the missing "prompt" to the
documented authorization request parameter order (proto/request.c)
- Authorization: both JSON examples had trailing commas and did not parse
- Entra ID: "//" is not an Apache comment, so that OIDCScope line broke the
config; drop the Apache 2.2 Order/Allow directives
- Curity: OIDCRedirectURI must not point at the application path itself
Also folds in the typo, dead-link and version-pinned-line-number cleanups that
land in these same files.
doc: fix directive-name typos, stale org links, and a broken link
- OIDCUnAuthzAction -> OIDCUnAutzAction (correct directive name)
- OIDCProviderMetadataUrl -> OIDCProviderMetadataURL (canonical casing)
- OIDCRedirectUri -> OIDCRedirectURI (canonical casing)
- libjose -> libcjose (correct package name)
- de-duplicate "on a on a" in Known-Limitations
- repoint stale zmartzone/pingidentity org URLs to OpenIDC
- fix 404 blob/feature/auth_openidc.conf#L682 -> blob/master/auth_openidc.conf
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
separate state cookie issues from session cookie
Updated Cookies (markdown)
Added description of the OIDCStateCookiePrefix primitive
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
add more detail on the state cookie handling
Updated Cookies (markdown)
document 2.3.8 changes wrt. state cookies and Accept header
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
Updated Cookies (markdown)
document minimizing the number of claims
Updated Cookies (markdown)
Created Cookies (markdown)