|
 |
d242e1 |
%{!?_httpd_mmn: %{expand: %%global _httpd_mmn %%(cat %{_includedir}/httpd/.mmn || echo 0-0)}}
|
|
|
d242e1 |
%{!?_httpd_moddir: %{expand: %%global _httpd_moddir %%{_libdir}/httpd/modules}}
|
|
|
d242e1 |
%{!?_httpd_confdir: %{expand: %%global _httpd_confdir %{_sysconfdir}/httpd/conf.d}}
|
|
|
d242e1 |
|
|
|
d242e1 |
# Optionally build with hiredis if --with hiredis is passed
|
|
|
d242e1 |
%{!?_with_hiredis: %{!?_without_hiredis: %global _without_hiredis --without-hiredis}}
|
|
|
d242e1 |
# It is an error if both or neither required options exist.
|
|
|
d242e1 |
%{?_with_hiredis: %{?_without_hiredis: %{error: both _with_hiredis and _without_hiredis}}}
|
|
|
d242e1 |
%{!?_with_hiredis: %{!?_without_hiredis: %{error: neither _with_hiredis nor _without_hiredis}}}
|
|
|
d242e1 |
|
|
|
d242e1 |
# /etc/httpd/conf.d with httpd < 2.4 and defined as /etc/httpd/conf.modules.d with httpd >= 2.4
|
|
|
d242e1 |
%{!?_httpd_modconfdir: %{expand: %%global _httpd_modconfdir %%{_sysconfdir}/httpd/conf.d}}
|
|
|
d242e1 |
|
|
|
d242e1 |
%global httpd_pkg_cache_dir /var/cache/httpd/mod_auth_openidc
|
|
|
d242e1 |
|
|
|
d242e1 |
Name: mod_auth_openidc
|
|
|
d242e1 |
Version: 2.3.7
|
|
|
bef612 |
Release: 11%{?dist}
|
|
|
d242e1 |
Summary: OpenID Connect auth module for Apache HTTP Server
|
|
|
d242e1 |
|
|
|
d242e1 |
Group: System Environment/Daemons
|
|
|
d242e1 |
License: ASL 2.0
|
|
|
d242e1 |
URL: https://github.com/zmartzone/mod_auth_openidc
|
|
|
d242e1 |
Source0: https://github.com/zmartzone/mod_auth_openidc/releases/download/v%{version}/mod_auth_openidc-%{version}.tar.gz
|
|
|
d242e1 |
|
|
|
d242e1 |
Patch1: test-segfault.patch
|
|
|
d21d4d |
Patch2: 0002-Backport-of-improve-validation-of-the-post-logout-UR.patch
|
|
|
d21d4d |
Patch3: 0003-Backport-of-Fix-open-redirect-starting-with-a-slash.patch
|
|
|
d21d4d |
Patch4: 0004-Backport-of-Fix-open-redirect-starting-with-a-slash-.patch
|
|
|
d21d4d |
Patch5: 0005-Fix-the-previous-backports.patch
|
|
|
50cc55 |
Patch6: 0006-add-OIDCStateMaxNumberOfCookies-to-limit-nr-of-state.patch
|
|
|
50cc55 |
Patch7: 0007-set-boundaries-on-min-and-max-values-on-number-of-pa.patch
|
|
|
50cc55 |
Patch8: 0008-make-the-default-max-number-of-state-cookies-7-inste.patch
|
|
|
50cc55 |
Patch9: 0009-don-t-return-content-with-503-see-331.patch
|
|
|
50cc55 |
Patch10: 0010-improve-auto-detection-of-XMLHttpRequests-via-Accept.patch
|
|
|
50cc55 |
Patch11: 0011-oops-document-OIDCStateMaxNumberOfCookies-for-releas.patch
|
|
|
50cc55 |
Patch12: 0012-optionally-delete-the-oldest-state-cookie-s-see-399.patch
|
|
|
50cc55 |
Patch13: 0013-Allow-configuring-which-header-value-is-used-to-calc.patch
|
|
|
50cc55 |
Patch14: 0014-add-value-of-OIDC_SET_COOKIE_APPEND-env-var-to-Set-C.patch
|
|
|
50cc55 |
Patch15: 0015-pick-OIDC_SET_COOKIE_APPEND-over-ext-passed-in-to-oi.patch
|
|
|
50cc55 |
Patch16: 0016-always-add-a-SameSite-value-to-the-Set-Cookie-header.patch
|
|
|
50cc55 |
Patch17: 0017-fix-also-add-SameSite-None-to-by-value-session-cooki.patch
|
|
|
50cc55 |
Patch18: 0018-add-note-on-usage-of-OIDC_SET_COOKIE_APPEND-in-the-s.patch
|
|
|
50cc55 |
Patch19: 0019-add-SameSite-attribute-on-cookie-clearance-logout.patch
|
|
|
bef612 |
Patch20: 0020-prevent-open-redirect-on-refresh-token-requests-rele.patch
|
|
|
bef612 |
Patch21: 0021-prevent-XSS-and-open-redirect-on-OIDC-session-manage.patch
|
|
|
bef612 |
Patch22: 0022-replace-potentially-harmful-backslashes-with-forward.patch
|
|
|
bef612 |
Patch23: 0023-apply-OIDCRedirectURLsAllowed-setting-to-target_link.patch
|
|
|
bef612 |
Patch24: 0024-use-encrypted-JWTs-for-storing-encrypted-cache-conte.patch
|
|
|
bef612 |
Patch25: 0025-avoid-XSS-vulnerability-when-using-OIDCPreservePost-.patch
|
|
|
bef612 |
Patch26: 0026-Add-a-function-to-escape-Javascript-characters.patch
|
|
|
d242e1 |
|
|
|
d242e1 |
BuildRequires: gcc
|
|
|
d242e1 |
BuildRequires: httpd-devel
|
|
|
d242e1 |
BuildRequires: openssl-devel
|
|
|
d242e1 |
BuildRequires: curl-devel
|
|
|
d242e1 |
BuildRequires: jansson-devel
|
|
|
d242e1 |
BuildRequires: pcre-devel
|
|
|
d242e1 |
BuildRequires: autoconf
|
|
|
d242e1 |
BuildRequires: automake
|
|
|
d242e1 |
BuildRequires: cjose-devel
|
|
|
d242e1 |
BuildRequires: jq-devel
|
|
|
d242e1 |
%{?_with_hiredis:BuildRequires: hiredis-devel}
|
|
|
d242e1 |
Requires: httpd-mmn = %{_httpd_mmn}
|
|
|
d242e1 |
|
|
|
d242e1 |
%description
|
|
|
d242e1 |
This module enables an Apache 2.x web server to operate as
|
|
|
d242e1 |
an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
|
|
|
d242e1 |
|
|
|
d242e1 |
%prep
|
|
|
d242e1 |
%setup -q
|
|
|
d242e1 |
%patch1 -p1
|
|
|
d21d4d |
%patch2 -p1
|
|
|
d21d4d |
%patch3 -p1
|
|
|
d21d4d |
%patch4 -p1
|
|
|
d21d4d |
%patch5 -p1
|
|
|
50cc55 |
%patch6 -p1
|
|
|
50cc55 |
%patch7 -p1
|
|
|
50cc55 |
%patch8 -p1
|
|
|
50cc55 |
%patch9 -p1
|
|
|
50cc55 |
%patch10 -p1
|
|
|
50cc55 |
%patch11 -p1
|
|
|
50cc55 |
%patch12 -p1
|
|
|
50cc55 |
%patch13 -p1
|
|
|
50cc55 |
%patch14 -p1
|
|
|
50cc55 |
%patch15 -p1
|
|
|
50cc55 |
%patch16 -p1
|
|
|
50cc55 |
%patch17 -p1
|
|
|
50cc55 |
%patch18 -p1
|
|
|
50cc55 |
%patch19 -p1
|
|
|
bef612 |
%patch20 -p1
|
|
|
bef612 |
%patch21 -p1
|
|
|
bef612 |
%patch22 -p1
|
|
|
bef612 |
%patch23 -p1
|
|
|
bef612 |
%patch24 -p1
|
|
|
bef612 |
%patch25 -p1
|
|
|
bef612 |
%patch26 -p1
|
|
|
d242e1 |
|
|
|
d242e1 |
%build
|
|
|
d242e1 |
# workaround rpm-buildroot-usage
|
|
|
d242e1 |
export MODULES_DIR=%{_httpd_moddir}
|
|
|
d242e1 |
export APXS2_OPTS='-S LIBEXECDIR=${MODULES_DIR}'
|
|
|
d242e1 |
autoreconf
|
|
|
d242e1 |
%configure \
|
|
|
d242e1 |
--with-jq=/usr/lib64/ \
|
|
|
d242e1 |
%{?_with_hiredis} \
|
|
|
d242e1 |
%{?_without_hiredis}
|
|
|
d242e1 |
|
|
|
d242e1 |
make %{?_smp_mflags}
|
|
|
d242e1 |
|
|
|
d242e1 |
%check
|
|
|
d242e1 |
export MODULES_DIR=%{_httpd_moddir}
|
|
|
d242e1 |
export APXS2_OPTS='-S LIBEXECDIR=${MODULES_DIR}'
|
|
|
d242e1 |
make test
|
|
|
d242e1 |
|
|
|
d242e1 |
%install
|
|
|
d242e1 |
mkdir -p $RPM_BUILD_ROOT%{_httpd_moddir}
|
|
|
d242e1 |
make install MODULES_DIR=$RPM_BUILD_ROOT%{_httpd_moddir}
|
|
|
d242e1 |
|
|
|
d242e1 |
install -m 755 -d $RPM_BUILD_ROOT%{_httpd_modconfdir}
|
|
|
d242e1 |
echo 'LoadModule auth_openidc_module modules/mod_auth_openidc.so' > \
|
|
|
d242e1 |
$RPM_BUILD_ROOT%{_httpd_modconfdir}/10-auth_openidc.conf
|
|
|
d242e1 |
|
|
|
d242e1 |
install -m 755 -d $RPM_BUILD_ROOT%{_httpd_confdir}
|
|
|
d242e1 |
install -m 644 auth_openidc.conf $RPM_BUILD_ROOT%{_httpd_confdir}
|
|
|
d242e1 |
# Adjust httpd cache location in install config file
|
|
|
d242e1 |
sed -i 's!/var/cache/apache2/!/var/cache/httpd/!' $RPM_BUILD_ROOT%{_httpd_confdir}/auth_openidc.conf
|
|
|
d242e1 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}
|
|
|
d242e1 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}/metadata
|
|
|
d242e1 |
install -m 700 -d $RPM_BUILD_ROOT%{httpd_pkg_cache_dir}/cache
|
|
|
d242e1 |
|
|
|
d242e1 |
|
|
|
d242e1 |
%files
|
|
|
d242e1 |
%if 0%{?rhel} && 0%{?rhel} < 7
|
|
|
d242e1 |
%doc LICENSE.txt
|
|
|
d242e1 |
%else
|
|
|
d242e1 |
%license LICENSE.txt
|
|
|
d242e1 |
%endif
|
|
|
d242e1 |
%doc ChangeLog
|
|
|
d242e1 |
%doc AUTHORS
|
|
|
d242e1 |
%doc README.md
|
|
|
d242e1 |
%{_httpd_moddir}/mod_auth_openidc.so
|
|
|
d242e1 |
%config(noreplace) %{_httpd_modconfdir}/10-auth_openidc.conf
|
|
|
d242e1 |
%config(noreplace) %{_httpd_confdir}/auth_openidc.conf
|
|
|
d242e1 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}
|
|
|
d242e1 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}/metadata
|
|
|
d242e1 |
%dir %attr(0700, apache, apache) %{httpd_pkg_cache_dir}/cache
|
|
|
d242e1 |
|
|
|
d242e1 |
%changelog
|
|
|
bef612 |
* Fri Jan 28 2022 Tomas Halman <thalman@redhat.com> - 2.3.7-11
|
|
|
bef612 |
- Resolves: rhbz#1987222 - CVE-2021-32792 XSS when using OIDCPreservePost On
|
|
|
bef612 |
|
|
|
bef612 |
* Fri Jan 28 2022 Tomas Halman <thalman@redhat.com> - 2.3.7-10
|
|
|
bef612 |
- Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
|
|
|
bef612 |
reused key in AES GCM encryption [rhel-8] (edit)
|
|
|
bef612 |
|
|
|
bef612 |
* Fri Oct 29 2021 Tomas Halman <thalman@redhat.com> - 2.3.7-9
|
|
|
bef612 |
- Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
|
|
|
bef612 |
in the target_link_uri parameter
|
|
|
bef612 |
|
|
|
50cc55 |
* Tue Nov 17 2020 Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-8
|
|
|
50cc55 |
- Resolves: rhbz#1823756 - Backport SameSite=None cookie from
|
|
|
50cc55 |
mod_auth_openidc upstream to support latest browsers
|
|
|
50cc55 |
|
|
|
50cc55 |
* Tue Nov 17 2020 Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-7
|
|
|
50cc55 |
- Resolves: rhbz#1897992 - OIDCStateInputHeaders &
|
|
|
50cc55 |
OIDCStateMaxNumberOfCookies in existing
|
|
|
50cc55 |
mod_auth_openidc version
|
|
|
50cc55 |
- Backport the OIDCStateMaxNumberOfCookies option
|
|
|
50cc55 |
- Configure which header value is used to calculate the fingerprint of
|
|
|
50cc55 |
the auth state
|
|
|
50cc55 |
|
|
|
50cc55 |
* Sun May 10 2020 Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-6
|
|
|
d21d4d |
- Fix the previous backport
|
|
|
50cc55 |
- Related: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
|
|
|
d21d4d |
Open redirect in logout url when using URLs with
|
|
|
50cc55 |
leading slashes
|
|
|
50cc55 |
- Related: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
|
|
|
d21d4d |
open redirect issue exists in URLs with slash and
|
|
|
50cc55 |
backslash
|
|
|
d21d4d |
|
|
|
50cc55 |
* Sun May 10 2020 Jakub Hrozek <jhrozek@redhat.com> - 2.3.7-5
|
|
|
50cc55 |
- Resolves: rhbz#1805749 - CVE-2019-14857 mod_auth_openidc:2.3/mod_auth_openidc:
|
|
|
d21d4d |
Open redirect in logout url when using URLs with
|
|
|
50cc55 |
leading slashes
|
|
|
50cc55 |
- Resolves: rhbz#1805068 - CVE-2019-20479 mod_auth_openidc:2.3/mod_auth_openidc:
|
|
|
d21d4d |
open redirect issue exists in URLs with slash and
|
|
|
50cc55 |
backslash
|
|
|
d21d4d |
|
|
|
d242e1 |
* Thu Aug 16 2018 <jdennis@redhat.com> - 2.3.7-3
|
|
|
d242e1 |
- Resolves: rhbz# 1614977 - fix unit test segfault,
|
|
|
d242e1 |
the problem was not limited exclusively to s390x, but s390x provoked it.
|
|
|
d242e1 |
|
|
|
d242e1 |
* Fri Aug 10 2018 <jdennis@redhat.com> - 2.3.7-2
|
|
|
d242e1 |
- disable running check on s390x
|
|
|
d242e1 |
|
|
|
d242e1 |
* Wed Aug 1 2018 <jdennis@redhat.com> - 2.3.7-1
|
|
|
d242e1 |
- upgrade to upstream 2.3.7
|
|
|
d242e1 |
|
|
|
d242e1 |
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.5-2
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Wed May 23 2018 Patrick Uiterwijk <patrick@puiterwijk.org> - 2.3.5-1
|
|
|
d242e1 |
- Rebase to 2.3.5
|
|
|
d242e1 |
|
|
|
d242e1 |
* Fri Feb 09 2018 Igor Gnatenko <ignatenkobrain@fedoraproject.org> - 1.8.10.1-7
|
|
|
d242e1 |
- Escape macros in %%changelog
|
|
|
d242e1 |
|
|
|
d242e1 |
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10.1-6
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10.1-5
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10.1-4
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Sat Feb 18 2017 John Dennis <jdennis@redhat.com> - 1.8.10.1-3
|
|
|
d242e1 |
- Resolves: #1423956 fails to build with openssl 1.1.x
|
|
|
d242e1 |
Also rolls up all fixes to jose library before the change over to cjose
|
|
|
d242e1 |
|
|
|
d242e1 |
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.10.1-2
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Tue Jul 12 2016 John Dennis <jdennis@redhat.com> - 1.8.10.1-1
|
|
|
d242e1 |
- Upgrade to new upstream
|
|
|
d242e1 |
See /usr/share/doc/mod_auth_openidc/ChangeLog for details
|
|
|
d242e1 |
|
|
|
d242e1 |
* Tue Mar 29 2016 John Dennis <jdennis@redhat.com> - 1.8.8-4
|
|
|
d242e1 |
- Add %%check to run test
|
|
|
d242e1 |
|
|
|
d242e1 |
* Wed Mar 23 2016 John Dennis <jdennis@redhat.com> - 1.8.8-3
|
|
|
d242e1 |
- Make building with redis support optional (defaults to without)
|
|
|
d242e1 |
|
|
|
d242e1 |
* Mon Mar 21 2016 John Dennis <jdennis@redhat.com> - 1.8.8-2
|
|
|
d242e1 |
- Add missing unpackaged files/directories
|
|
|
d242e1 |
|
|
|
d242e1 |
Add to doc: README.md, DISCLAIMER, AUTHORS
|
|
|
d242e1 |
Add to httpd/conf.d: auth_openidc.conf
|
|
|
d242e1 |
Add to /var/cache: /var/cache/httpd/mod_auth_openidc/cache
|
|
|
d242e1 |
/var/cache/httpd/mod_auth_openidc/metadata
|
|
|
d242e1 |
|
|
|
d242e1 |
* Thu Mar 10 2016 Jan Pazdziora <jpazdziora@redhat.com> 1.8.8-1
|
|
|
d242e1 |
- Update to 1.8.8 (#1316528)
|
|
|
d242e1 |
|
|
|
d242e1 |
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.8.7-2
|
|
|
d242e1 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
|
|
|
d242e1 |
|
|
|
d242e1 |
* Sat Jan 09 2016 Fedora Release Monitoring <release-monitoring@fedoraproject.org> - 1.8.7-1
|
|
|
d242e1 |
- Update to 1.8.7 (#1297080)
|
|
|
d242e1 |
|
|
|
d242e1 |
* Sat Nov 07 2015 Jan Pazdziora <jpazdziora@redhat.com> 1.8.6-1
|
|
|
d242e1 |
- Initial packaging for Fedora 23.
|