Infinite authentication loop after updating to latest version

[msfjarvis]

I am also seeing the same problem with the following config, my cookie directive seems to already be correctly set up.

Caddy configuration

order authenticate before respond
security {
    oauth identity provider calibreweb {
        delay_start 3
        realm calibreweb
        driver generic
        client_id {$CALIBRE_WEB_POCKET_ID_CLIENT_ID}
        client_secret {$CALIBRE_WEB_POCKET_ID_CLIENT_SECRET}
        scopes openid email profile
        base_auth_url https://auth.msfjarvis.dev
        metadata_url https://auth.msfjarvis.dev/.well-known/openid-configuration
    }
    authentication portal calibreweb_portal {
        crypto default token lifetime 3600
        crypto key sign-verify default
        enable identity provider calibreweb
        trust login redirect uri domain exact books.msfjarvis.dev path prefix /
        cookie insecure off
        cookie domain books.msfjarvis.dev
        transform user {
            match realm calibreweb
            action add role user
        }
    }
    authorization policy calibreweb_policy {
        set auth url /caddy-security/oauth2/calibreweb
        allow roles user
        inject headers with claims
    }
}

https://books.msfjarvis.dev {
    log {
        output file /var/log/caddy/access-https:__books.msfjarvis.dev.log
    }
    handle /caddy-security/* {
        route {
                authenticate with calibreweb_portal
        }
    }
    @integrations {
        path /opds /opds/* /kobo /kobo/*
    }
    handle @integrations {
        reverse_proxy localhost:9027 {
            header_up X-Scheme https
            transport http {
                read_buffer 1024k
                write_buffer 1024k
            }
        }
    }
    handle {
        route {
            authorize with calibreweb_policy
            reverse_proxy localhost:9027 {
                header_up X-Scheme https
                transport http {
                    read_buffer 1024k
                    write_buffer 1024k
                }
            }
        }
    }
}

Originally posted by @msfjarvis in #486 (comment)

[greenpau]

@msfjarvis , see below.

crypto key sign-verify default

remove from you config. You cannot have key specified in calibreweb_portal, but none specified in calibreweb_policy.

cookie domain books.msfjarvis.dev

remove from your config. Since you don't have multiple hosts here, the portal will generate host cookie for you.

    allow roles user

action add role user

Make the above to be authp/user instead of user.

---

You don't need both handle and route directives.

    handle /caddy-security/* {
        route {
                authenticate with calibreweb_portal
        }
    }

Try:

        route /caddy-security* {
                authenticate with calibreweb_portal
        }

---

Just so we are on the same page. The following traffic is not being passed through authorization.

    @integrations {
        path /opds /opds/* /kobo /kobo/*
    }
    handle @integrations {
        reverse_proxy localhost:9027 {
            header_up X-Scheme https
            transport http {
                read_buffer 1024k
                write_buffer 1024k
            }
        }
    }

---

Do not mix handle and route. Stick with route only.

    handle {
        route {
            authorize with calibreweb_policy
            reverse_proxy localhost:9027 {
                header_up X-Scheme https
                transport http {
                    read_buffer 1024k
                    write_buffer 1024k
                }
            }
        }
    }

---

Are you sure that this is correct?

        base_auth_url https://auth.msfjarvis.dev
        metadata_url https://auth.msfjarvis.dev/.well-known/openid-configuration

[msfjarvis]

Just so we are on the same page. The following traffic is not being passed through authorization.

Yes, that's a bypass for software that can't handle the authentication

Do not mix handle and route. Stick with route only.

I'll give that a go.

Are you sure that this is correct?

        base_auth_url https://auth.msfjarvis.dev
        metadata_url https://auth.msfjarvis.dev/.well-known/openid-configuration

Yes, it is correct.

[greenpau]

Please check https://docs.authcrunch.com/docs/authorize/bypass

Now enable Caddy debug.

Look for errors in the log.

If i were to guess you have redirect uri mismatch