How to increase oauth2_cache_shm_check_value

[sat-art]

Hi, I am seeing below error. is there any parameter that can be set to increase or encrypt?

2023/04/19 16:28:40 [error] 625446#0: *29 # oauth2_cache_shm_check_value: could not store value since value size is too large (23710 > 8192), "GET /ui/callback?code=b3d7dfe405fd4dfe84237c002c836efd&state=c7cdaee6fe4c7530 HTTP/1.1" 2023/04/19 16:28:40 [error] 625446#0: *29 # oauth2_cache_set: leave: could NOT store: 985489e42b462634, client: 64.102.186.187, server: , request: "GET /ui/callback?code=b3d7dfe405fd4dfe84237c002c836efd&state=c7cdaee6fe4c7530 HTTP/1.1"
2023/04/19 16:28:40 [error] 625446#0: *29 # oauth2_session_save_cache: could not store session in cache, client:

[zandbelt]

yes, what does your config look like right now?

[zandbelt]

assuming you're using the default cache settings:

OpenIDCCache shm max_val_size=32768;

though I believe tokens or sessions should not contain that much data

[sat-art]

We are seeing similar error even with above setting.. Below is our config.

OpenIDCProvider file /etc/nginx/openidc.json;
OpenIDCClient string client_id=XXXX&client_secret=XXXXX&scope=openid%20profile%20email&token_endpoint_auth_method=client_secret_basic ssl_verify=true;
OpenIDCCache shm max_val_size=32768;
OpenIDCClaim sub $pfc_claim_sub;

error---
2023/04/19 19:52:23 [error] 1931#0: *51 # oauth2_cache_shm_check_value: could not store value since value size is too large (23710 > 8192), client: 64.102.186.187, server: , request: "GET /ui/callback?code=2fe545589a3a4e58bd2c0c8291d05884&state=57f71a7f7c9d1977 HTTP/1.1"
2023/04/19 19:52:23 [error] 1931#0: *51 # oauth2_cache_set: leave: could NOT store: 4f3dda26e8282cb5, client: 64.102.186.187, server: , request: "GET /ui/callback?code=2fe545589a3a4e58bd2c0c8291d05884&state=57f71a7f7c9d1977 HTTP/1.1"
2023/04/19 19:52:23 [error] 1931#0: *51 # oauth2_session_save_cache: could not store session in cache, client: 64.102.186.187, server: , request: "GET /ui/callback?code=2fe545589a3a4e58bd2c0c8291d05884&state=57f71a7f7c9d1977 HTTP/1.1"

[zandbelt]

you'll need to put the OpenIDCCache entry before the other directives

[sat-art]

Thanks we are not seeing cache error any more.

but when we specify OpenIDCConfig redirect_uri=https://xxxxx/ui/callback;, it is looping back to login page. Noticed below in debug logs

*1 # oauth2_openidc_is_request_to_redirect_uri: comparing: "http://xxxx/ui/callback"="https://xxxx/ui/callback"

is there a parameter to set redirect_uri scheme to https?

[zandbelt]

the redirect setting seems to be set to https just fine; the incoming request seems on plain http, at least according to the logs: make sure you're using the latest ngx_openidc_module and liboauth2 >= 1.4.5.4 code since before 3.3.1 it was hardcoded to plain http (as a debug leftover...), see: https://github.com/OpenIDC/ngx_openidc_module/releases/tag/v3.3.1