[GitHub] [apisix] ro4i7 commented on issue #6803: feat: As a user, I want to get a specific error log message instead of 500 and a bad error log when using openid-connect plugins with the wrong redirect_uri config

["ro4i7 (via GitHub)" <gi...@apache.org>]

ro4i7 commented on issue #6803:
URL: https://github.com/apache/apisix/issues/6803#issuecomment-1465217700

   Hello @spacewander @starsz 
   
   if this issue is still open please assign it to me, and please give feedback on the below solution.
   
   To customize the error message for the openid-connect plugin in Apache APISIX, we can modify the `openid-connect.lua` file. Specifically, we can update the `phase_func` function to include additional error information.
   
   Here's how we can modify the `phase_func` function to include the specific reason for the error and how to avoid it:
   ```
   local function phase_func(...)
     -- existing code
     local opts = ngx.ctx.opts
     local res, err = authenticate(opts)
   
     if err then
       ngx.log(ngx.ERR, "OIDC authentication failed: " .. err)
       ngx.header["WWW-Authenticate"] = 'Bearer realm="' .. ngx.var.host .. '",error="' .. err .. '"'
       ngx.exit(ngx.HTTP_UNAUTHORIZED)
     end
   
     if not res then
       ngx.log(ngx.ERR, "OIDC authentication failed: request to the redirect_uri path but there's no session state found. Please ensure that the redirect_uri is configured correctly and that the session state is present in the request.")
       ngx.header["WWW-Authenticate"] = 'Bearer realm="' .. ngx.var.host .. '",error="OIDC authentication failed: request to the redirect_uri path but there\'s no session state found. Please ensure that the redirect_uri is configured correctly and that the session state is present in the request."'
       ngx.exit(ngx.HTTP_UNAUTHORIZED)
     end
   
     -- existing code
   end
   ```
   In this example, I have added an additional `if` statement that checks if `res` is `nil`. If it is, we log an error message that includes the specific reason for the error and how to avoid it. We also set the `WWW-Authenticate` header to include the same error message.
   
   By updating the error message in this way, users of the openid-connect plugin will have a clearer understanding of why the error occurred and what steps they can take to fix it.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org