[SOLVED] Silent fail for redis caching

[studersi]

We are trying to get Redis caching to work with mod_oauth2 (mod_oauth2-3.2.3), however, it silently fails and reverts to shm caching instead.

The configuration currently looks as follows:

OAuth2Cache redis host=${REDIS_CACHE_SERVER}&password=${REDIS_CACHE_PASSWORD}

In the logs we see cache misses and hits for shm despite having configured OAuth2Cache redis .... There is no mention of Redis in the Apache error log at all. The cache entries also do not survive a restart of Apache.

Any suggestions on how to debug this?

[zandbelt]

which version of liboauth2 are you using?

[zandbelt]

ok, and did you compile liboauth2 yourself or get it from Github as an rpm/deb?

[zandbelt]

I just tried with your versions of mod_oauth2 and liboauth2 (as well as latest) and all seems to work for me e.g. with:

OAuth2Cache redis host=localhost&password=foobar
OAuth2TokenVerify introspect https://myhost/as/introspect.oauth2 introspect.ssl_verify=false&introspect.auth=client_secret_basic&client_id=myid&client_secret=mysecret

<Location /myapi>
  AuthType oauth2
  Require valid-user
</Location>

Here's the output that shows Redis is used:

[Fri Feb 24 15:34:19.482970 2023] [oauth2:debug] [pid 16206] src/oauth2.c(825): [client 127.0.0.1:54625] oauth2_token_verify: enter
[Fri Feb 24 15:34:19.482977 2023] [oauth2:debug] [pid 16206] src/cache.c(319): [client 127.0.0.1:54625] oauth2_cache_get: enter: key=token, type=redis, decrypt=1
[Fri Feb 24 15:34:19.482983 2023] [oauth2:debug] [pid 16206] src/cache.c(235): [client 127.0.0.1:54625] _oauth2_cache_hash_key: enter: key=token, algo=(null)
[Fri Feb 24 15:34:19.482990 2023] [oauth2:debug] [pid 16206] src/jose.c(122): [client 127.0.0.1:54625] oauth2_jose_hash_bytes: enter
[Fri Feb 24 15:34:19.483002 2023] [oauth2:debug] [pid 16206] src/jose.c(172): [client 127.0.0.1:54625] oauth2_jose_hash_bytes: leave: 1
[Fri Feb 24 15:34:19.483011 2023] [oauth2:debug] [pid 16206] src/cache.c(250): [client 127.0.0.1:54625] _oauth2_cache_hash_key: leave: hashed key: 3c469e9d6c5875d37a43f353d4f88e61fcf812c66eee3457465a40b0da4153e0
[Fri Feb 24 15:34:19.483017 2023] [oauth2:debug] [pid 16206] src/cache/redis.c(285): [client 127.0.0.1:54625] oauth2_cache_redis_get: enter
[Fri Feb 24 15:34:19.483026 2023] [oauth2:debug] [pid 16206] src/cache/redis.c(222): [client 127.0.0.1:54625] _oauth2_cache_redis_command: enter: GET 3c469e9d6c5875d37a43f353d4f88e61fcf812c66eee3457465a40b0da4153e0
[Fri Feb 24 15:34:19.483623 2023] [oauth2:debug] [pid 16206] src/cache/redis.c(203): [client 127.0.0.1:54625] _oauth2_cache_redis_connect: successfully connected to Redis server (localhost:6379)
[Fri Feb 24 15:34:19.483811 2023] [oauth2:error] [pid 16206] [client 127.0.0.1:54625] _oauth2_cache_redis_command: Redis AUTH command (attempt=0 to localhost:6379) failed: '' [ERR AUTH <password> called without any password configured for the default user. Are you sure your configuration is correct?]
[Fri Feb 24 15:34:19.483943 2023] [oauth2:debug] [pid 16206] src/cache/redis.c(270): [client 127.0.0.1:54625] _oauth2_cache_redis_command: leave: 0x137614eb0
[Fri Feb 24 15:34:19.483957 2023] [oauth2:debug] [pid 16206] src/cache/redis.c(328): [client 127.0.0.1:54625] oauth2_cache_redis_get: leave: 1
[Fri Feb 24 15:34:19.483965 2023] [oauth2:debug] [pid 16206] src/cache.c(353): [client 127.0.0.1:54625] oauth2_cache_get: leave: cache miss for key: token return: 0 bytes

Perhaps you're using some version of liboauth2 (unlike the builds provided in the Github project) that does not have Redis support compiled in but actually the configuration should then fail on an unknown cache type error...
I'm not sure what to do next, please double-check versions, config, restarts etc.

[studersi]

@zandbelt Thank you for your responses. We use a self-compiled version of both mod_oauth2 and liboauth2. I will check whether Redis support was compiled in and get back to you.

[studersi]

I stumbled onto the solution by looking at your example above. By moving OAuth2Cache above OAuth2TokenVerify in the config file, I am now able to configure Redis caching.

It would seem these two directives are sensitive to their relative order in the config file.

[zandbelt]

ah, I did indeed not think of that before; I'll add a note to the docs, thanks!