SHM settings not working in AL2023 #1353
-
|
While I feel this is likely an issue with AL2023, I've encountered a peculiar issue and I'm running out of sources of information to read and test, so I'm wondering if anyone else is experiencing this as well. We updated our AL2023 servers to the LTS(2023.8.20250915) and that came paired with mod_auth_openidc 2.4.16.11-1. I've done extensive testing and I'm mostly certain that there appears to be an issue with mod_auth_openidc using SHM on this version of the server but I can't figure out why. If we downgrade the package to the previous version of 2.4.15-3 it works as intended. The Behavior it exhibits is: The page sits attempting to redirect the user to a Microsoft SSO page but never actually gets a response, it appears to just sit there, never timing out, never reattempting the connection. Simply waiting for a response from a request that I can confirm went out through the organizations firewall(s) but never comes back. Some things that I've done already to test this.
While I found a "fix" I seek to understand why this happened and preferably find a way to return to SHM, I have a site with a lot of traffic and I feel the repercussions of using a file style cache will become apparent very quickly. Does anyone else have ideas on how to diagnose this OR has anyone else experienced a similar issue with the SHM settings not working. |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 7 replies
-
|
what does the error log say with |
Beta Was this translation helpful? Give feedback.
-
|
[Mon Sep 29 12:02:50.825854 2025] [auth_openidc:debug] [pid 33980:tid 33998] src/handle/request.c(165): [remote MASKING IP ADDRESS] oidc_request_authenticate_user: enter This is what's leading me to believe its some caching issues. I removed some of the IP addresses, hopefully that won't impact the reading of this. |
Beta Was this translation helpful? Give feedback.
-
|
[Mon Sep 29 12:08:17.052053 2025] [auth_openidc:debug] [pid 34241:tid 34342] src/util.c(885): [client IPADDRESS] oidc_util_request_matches_url: comparing "/science/"=="/valid/redirect_uri" Here's a more complete full request block sanitize. |
Beta Was this translation helpful? Give feedback.
-
|
truncated logs do not help, the full round trip starting after a restart, including a first new incoming unauthenticated request all the way up to the error would perhaps say more |
Beta Was this translation helpful? Give feedback.
-
|
The interesting thing is that there's not really an error at least that I'm seeing. This is me just sitting attempting to get to the site, this behavior will repeat. The only two things I can maybe think of are the response being 1 byte instead of 20 and the url comparison not matching. [Mon Sep 29 12:27:14.975288 2025] [http2:warn] [pid 33980:tid 34067] [client 10.14.13.195:56174] h2_stream(33980-0-1,CLEANUP): started=1, scheduled=1, ready=0, out_buffer=0 I'd be more than happy to DM you the secret url but I can't post that on a public forum. |
Beta Was this translation helpful? Give feedback.
-
|
I see, that is surprising indeed: accessing the cache, which is just shared memory, seems to be stalled; this could be due to some issue with (system wide) mutex-based locking on a particular platform but I have no clue what to look for, and I don't see what changed since 2.4.15 |
Beta Was this translation helpful? Give feedback.
-
|
Yeah I'm more than willing to look into anything here, but if you're stumped as a maintainer then I'm kinda at a loss for resolutions, this was my last hope here. If you're looking to replicate, it happens with any size t3 AWS EC2 instance and I have the AL2023 version in the original post. Like I said, I'm almost certain it has to be something that happened on the server side, but it would appear as though I'm the only one in the world currently having this issue which is odd. If you end up with any ideas I'd love to hear them or if anyone else is also in a similar boat that you know of I'd like to hear from them and maybe we can diagnose with an "accuracy by volume" method. |
Beta Was this translation helpful? Give feedback.
-
|
FYI: we just experienced crashes here on our amazonlinux:2023 docker image so we should be able make progress with this soon |
Beta Was this translation helpful? Give feedback.
-
|
While I don't relish in your struggles. I feel vindicated and will watch your progress with great interest, if there's anything I can do to help I'd be more than happy to. |
Beta Was this translation helpful? Give feedback.
-
|
this turned out to be a regression since 2.4.16.7 - albeit not exposed on other platforms; it is fixed in 6356106 and will be released as part of 2.4.18.1 soon; you could probably compile it from master source |
Beta Was this translation helpful? Give feedback.
-
|
this fix is now released in https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.18.1 |
Beta Was this translation helpful? Give feedback.
-
|
Thought I'd pop in here and say thank you. I tested this in my instance and it certainly works. I'm going to see what if anything I can do from my end to make this the release that they officially distribute to us through their AWS repo via dnf update. Again thank you much for your hard work. |
Beta Was this translation helpful? Give feedback.
this fix is now released in https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.18.1