|
 |
e89858 |
%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo 0-0)}}
|
|
|
e89858 |
%{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}}
|
|
|
e89858 |
%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %{_sysconfdir}/httpd/conf.d}}
|
|
|
e89858 |
|
|
|
e89858 |
# Optionally build with hiredis if --with hiredis is passed
|
|
|
e89858 |
%{!?_with_hiredis: %{!?_without_hiredis: %global _without_hiredis --without-hiredis}}
|
|
|
e89858 |
# It is an error if both or neither required options exist.
|
|
|
e89858 |
%{?_with_hiredis: %{?_without_hiredis: %{error: both _with_hiredis and _without_hiredis}}}
|
|
|
e89858 |
%{!?_with_hiredis: %{!?_without_hiredis: %{error: neither _with_hiredis nor _without_hiredis}}}
|
|
|
e89858 |
|
|
|
e89858 |
# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
|
|
|
e89858 |
%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
|
|
|
e89858 |
|
|
|
e89858 |
%global httpd_pkg_cache_dir /var/cache/httpd/mod_auth_openidc
|
|
|
e89858 |
|
|
|
e89858 |
Name: mod_auth_openidc
|
|
|
e89858 |
Version: 1.8.8
|
|
|
6e7331 |
Release: 9%{?dist}
|
|
|
e89858 |
Summary: OpenID Connect auth module for Apache HTTP Server
|
|
|
e89858 |
|
|
|
e89858 |
Group: System Environment/Daemons
|
|
|
e89858 |
License: ASL 2.0
|
|
|
e89858 |
URL: https://github.com/pingidentity/mod_auth_openidc
|
|
|
e89858 |
Source0: https://github.com/pingidentity/mod_auth_openidc/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
|
|
|
e89858 |
|
|
|
e89858 |
Patch0: decrypt_aesgcm.patch
|
|
|
0462b3 |
Patch1: 0001-don-t-echo-query-params-on-invalid-requests-to-redir.patch
|
|
|
0462b3 |
Patch2: 0002-Backport-security-fix-scrub-headers-on-OIDCUnAuthAct.patch
|
|
|
0462b3 |
Patch3: 0003-Backport-security-fix-scrub-headers-for-AuthType-oau.patch
|
|
|
91153f |
Patch4: 0004-Backport-of-improve-validation-of-the-post-logout-UR.patch
|
|
|
91153f |
Patch5: 0005-Backport-of-Fix-open-redirect-starting-with-a-slash.patch
|
|
|
91153f |
Patch6: 0006-Backport-of-Fix-open-redirect-starting-with-a-slash-.patch
|
|
|
91153f |
Patch7: 0007-Fix-the-previous-backports.patch
|
|
|
e89858 |
|
|
|
6e7331 |
# BZ1823762 - Backport SameSite=None cookie from mod_auth_openidc upstream
|
|
|
6e7331 |
# to support latest browsers [rhel-7.9.z]
|
|
|
6e7331 |
Patch8: 0008-add-value-of-OIDC_SET_COOKIE_APPEND-env-var-to-Set-C.patch
|
|
|
6e7331 |
Patch9: 0009-Backport-setting-an-extra-cookie-parameter.patch
|
|
|
6e7331 |
Patch10: 0010-always-add-a-SameSite-Never-value-to-the-Set-Cookie-.patch
|
|
|
6e7331 |
Patch11: 0011-Backport-of-fix-also-add-SameSite-None-to-by-value-s.patch
|
|
|
6e7331 |
Patch12: 0012-Only-set-Same-Site-None-if-an-option-is-set.patch
|
|
|
6e7331 |
|
|
|
e89858 |
BuildRequires: httpd-devel
|
|
|
e89858 |
BuildRequires: openssl-devel
|
|
|
e89858 |
BuildRequires: curl-devel
|
|
|
e89858 |
BuildRequires: jansson-devel
|
|
|
e89858 |
BuildRequires: pcre-devel
|
|
|
e89858 |
BuildRequires: autoconf
|
|
|
e89858 |
BuildRequires: automake
|
|
|
e89858 |
%{?_with_hiresdis:BuildRequires: hiresdis-devel}
|
|
|
e89858 |
Requires: httpd-mmn = %{_httpd_mmn}
|
|
|
e89858 |
|
|
|
e89858 |
%description
|
|
|
e89858 |
This module enables an Apache 2.x web server to operate as
|
|
|
e89858 |
an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
|
|
|
e89858 |
|
|
|
e89858 |
%prep
|
|
|
e89858 |
%setup -q
|
|
|
e89858 |
%patch0 -p1 -b decrypt_aesgcm
|
|
|
0462b3 |
%patch1 -p1 -b echo_req
|
|
|
0462b3 |
%patch2 -p1 -b scrub_headers
|
|
|
0462b3 |
%patch3 -p1 -b scrub_headers_oauth
|
|
|
91153f |
%patch4 -p1 -b improve_logout_validation
|
|
|
91153f |
%patch5 -p1 -b logout_slash
|
|
|
91153f |
%patch6 -p1 -b logout_backslash
|
|
|
91153f |
%patch7 -p1 -b logout_regression
|
|
|
6e7331 |
%patch8 -p1 -b cookie_env_append
|
|
|
6e7331 |
%patch9 -p1 -b cookie_ext_value
|
|
|
6e7331 |
%patch10 -p1 -b same_site_none
|
|
|
6e7331 |
%patch11 -p1 -b same_site_none_fix
|
|
|
6e7331 |
%patch12 -p1 -b same_site_none_opt
|
|
|
e89858 |
|
|
|
e89858 |
%build
|
|
|
e89858 |
# workaround rpm-buildroot-usage
|
|
|
e89858 |
export MODULES_DIR=%{_httpd_moddir}
|
|
|
e89858 |
export APXS2_OPTS='-S LIBEXECDIR=${MODULES_DIR}'
|
|
|
e89858 |
autoreconf
|
|
|
e89858 |
%configure \
|
|
|
e89858 |
%{?_with_hiredis} \
|
|
|
e89858 |
%{?_without_hiredis}
|
|
|
e89858 |
|
|
|
e89858 |
make %{?_smp_mflags}
|
|
|
e89858 |
|
|
|
e89858 |
%check
|
|
|
e89858 |
export MODULES_DIR=%{_httpd_moddir}
|
|
|
e89858 |
make %{?_smp_mflags} test
|
|
|
e89858 |
|
|
|
e89858 |
%install
|
|
|
e89858 |
mkdir -p $RPM_BUILD_ROOT%{_httpd_moddir}
|
|
|
e89858 |
make install MODULES_DIR=$RPM_BUILD_ROOT%{_httpd_moddir}
|
|
|
e89858 |
|
|
|
e89858 |
install -m 755 -d $RPM_BUILD_ROOT%{_httpd_modconfdir}
|
|
|
e89858 |
echo 'LoadModule auth_openidc_module modules/mod_auth_openidc.so' > \
|
|
|
e89858 |
$RPM_BUILD_ROOT%{_httpd_modconfdir}/10-auth_openidc.conf
|
|
|
e89858 |
|
|
|
e89858 |
install -m 755 -d $RPM_BUILD_ROOT%{_httpd_confdir}
|
|
|
e89858 |
install -m 644 auth_openidc.conf $RPM_BUILD_ROOT%{_httpd_confdir}
|
|
|
e89858 |
# Adjust httpd cache location in install config file
|
|
|
e89858 |
sed -i 's!/var/cache/apache2/!/var/cache/httpd/!' $RPM_BUILD_ROOT%{_httpd_confdir}/auth_openidc.conf
|
|
|
e89858 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}
|
|
|
e89858 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}/metadata
|
|
|
e89858 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}/cache
|
|
|
e89858 |
|
|
|
e89858 |
|
|
|
e89858 |
%files
|
|
|
e89858 |
%if 0%{?rhel} && 0%{?rhel} < 7
|
|
|
e89858 |
%doc LICENSE.txt
|
|
|
e89858 |
%else
|
|
|
e89858 |
%license LICENSE.txt
|
|
|
e89858 |
%endif
|
|
|
e89858 |
%doc ChangeLog
|
|
|
e89858 |
%doc AUTHORS
|
|
|
e89858 |
%doc DISCLAIMER
|
|
|
e89858 |
%doc README.md
|
|
|
e89858 |
%{_httpd_moddir}/mod_auth_openidc.so
|
|
|
e89858 |
%config(noreplace) %{_httpd_modconfdir}/10-auth_openidc.conf
|
|
|
e89858 |
%config(noreplace) %{_httpd_confdir}/auth_openidc.conf
|
|
|
e89858 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}
|
|
|
e89858 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}/metadata
|
|
|
e89858 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}/cache
|
|
|
e89858 |
|
|
|
e89858 |
%changelog
|
|
|
6e7331 |
* Thu Oct 8 2020 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-9
|
|
|
6e7331 |
- Rebuild to pick up the proper build tag
|
|
|
6e7331 |
- Related: rhbz#1823762 - Backport SameSite=None cookie from
|
|
|
6e7331 |
mod_auth_openidc upstream to support
|
|
|
6e7331 |
latest browsers [rhel-7.9.z]
|
|
|
6e7331 |
|
|
|
6e7331 |
* Wed Aug 26 2020 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-8
|
|
|
6e7331 |
- Resolves: rhbz#1823762 - Backport SameSite=None cookie from
|
|
|
6e7331 |
mod_auth_openidc upstream to support
|
|
|
6e7331 |
latest browsers [rhel-7.9.z]
|
|
|
6e7331 |
|
|
|
91153f |
* Mon Mar 16 2020 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-7
|
|
|
91153f |
- Fix a regression in the previous patches
|
|
|
91153f |
- Related: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
|
|
|
91153f |
issue exists in URLs with slash and backslash [rhel-7]
|
|
|
91153f |
|
|
|
91153f |
* Mon Mar 16 2020 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-6
|
|
|
91153f |
- Resolves: rhbz#1805748 - CVE-2019-20479 mod_auth_openidc: open redirect
|
|
|
91153f |
issue exists in URLs with slash and backslash [rhel-7]
|
|
|
91153f |
- Resolves: rhbz#1805067 - CVE-2019-14857 mod_auth_openidc: Open redirect
|
|
|
91153f |
in logout url when using URLs with leading slashes
|
|
|
91153f |
[rhel-7]
|
|
|
91153f |
|
|
|
0462b3 |
* Tue Jan 29 2019 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-5
|
|
|
0462b3 |
- Resolves: rhbz#1626297 - CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and
|
|
|
0462b3 |
OIDCAuthNHeader not skipped in an "AuthType oauth20"
|
|
|
0462b3 |
configuration [rhel-7]
|
|
|
0462b3 |
|
|
|
0462b3 |
* Tue Jan 29 2019 Jakub Hrozek <jhrozek@redhat.com> - 1.8.8-4
|
|
|
0462b3 |
- Resolves: rhbz#1626299 - CVE-2017-6059 mod_auth_openidc: Shows
|
|
|
0462b3 |
user-supplied content on error pages [rhel-7]
|
|
|
0462b3 |
|
|
|
e89858 |
* Thu Mar 31 2016 John Dennis <jdennis@redhat.com> - 1.8.8-3
|
|
|
e89858 |
- fix unit test failure caused by apr_jwe_decrypt_content_aesgcm()
|
|
|
e89858 |
failing to null terminate decrypted string
|
|
|
e89858 |
Resolves: bug#1292561 New package: mod_auth_openidc
|
|
|
e89858 |
|
|
|
e89858 |
* Tue Mar 29 2016 John Dennis <jdennis@redhat.com> - 1.8.8-2
|
|
|
e89858 |
- Add %check to run test
|
|
|
e89858 |
Resolves: bug#1292561 New package: mod_auth_openidc
|
|
|
e89858 |
|
|
|
e89858 |
* Tue Mar 29 2016 John Dennis <jdennis@redhat.com> - 1.8.8-1
|
|
|
e89858 |
- Initial import
|
|
|
e89858 |
Resolves: bug#1292561 New package: mod_auth_openidc
|
|
|
e89858 |
|