How to configure mod_auth_openidc as a client for an oauth2.0 provided by InvisionCommunity

[bernhara]

I'm struggling with the configuration of mod_auth_openidc in order to have my web pages, hosted on a Apache server, be protected by credentials provided by the oauth2.0 provider embedded on a InvisionCommunity server.

I already managed (without any difficulty) to configure the "OAUTH2.0/social login" plugin of a NextCloud instance so that NextCloud users are redirected to a login page on the InvisionCommunity to be authenticated.

So, on the InvisionCommunity side, a have a set of working authorization https endpoints, keys, clientids, ...

But when I configure the mod_auth_openidc with a valid set of urls and keys, I cannot make the SSO flow working.

I made many many tests, reading a lot, and my problem can summarized this way:

• I'm redirected to a InvisionCommunity SSO login page, showing the expected information (scopes, ...)
• I'm able to log to InvisionCommunity and I'm immediately redirected back to my defined redirect_uri
• but the call to redirect_uri crashes on Apache side with the following error

oidc_http_request: response={"access_token":"6e990d9799ba5b3012a6e1bda9f6d5ef_ccb6d7896127be92552ba6d374c831d4073a6091b2181d3d87d90dfda14ece23","token_type":"bearer","expires_in":604800,"refresh_token":"d74bd02b921ee9d9120d3a87efa4bcd36689edd4afe72dff972a261534170631","scope":"openid profile"},

My current conclusion is that I'm not able to make the mod_auth_openidc module behave as an OAUTH2.0 client.
This may be due to the fact that I did not find any metadata URL I could use to set OIDCProviderMetadataURL. I guess that these metadata should inform the module that should switch to OAUTH2.0.

Since I've no specific skills in the identity management domain nor IDC, I'm spending a lot of energy in testing various configurations.

So, I'm asking here for help to get my configuration working.

Thanks.