Re: [naviserver-devel] Functionality similar to nginx' auth_request

2025-05-05 Thread Wolfgang Winkler via naviserver-devel
Hello! We have interfaces for facebook (OAuth2), apple, microsoft and google (OpenID). The OpenID interfaces are quite similar, as they all are based on JWTs. The only thing we could no do directly in naviserver was the verification of the signature with PEM and JWK. We are using a python s

Re: [naviserver-devel] ns_crypto::aead::decrypt "could not set tag value" error

2025-05-05 Thread Gustaf Neumann (sslmail)
Please check, if the following helps also for your environment: https://github.com/naviserver-project/naviserver/commit/08e5d8ffc22d403bcd31b0be1c9eb592e8e583d0 all the best -gn > On 05.05.2025, at 14:13, Gustaf Neumann (sslmail) wrote: > > Hi Wolfgang, > > At first sight, It looks to me as i

[naviserver-devel] ns_crypto::aead::decrypt "could not set tag value" error

2025-05-05 Thread Wolfgang Winkler via naviserver-devel
Dear all, when I follow the example of: https://naviserver.sourceforge.io/n/naviserver/files/ns_crypto.html#1  % set d [ns_crypto::aead::encrypt string -cipher aes-128-gcm -iv 123456789 \     -key secret -encoding binary \     "hello world"]  % ns_crypto::aead::decrypt string -cipher aes-128-

Re: [naviserver-devel] ns_crypto::aead::decrypt "could not set tag value" error

2025-05-05 Thread Gustaf Neumann (sslmail)
Hi Wolfgang, At first sight, It looks to me as if there was a change in OpenSSL leading to the problem. The error is triggered by OpenSSL’s EVP_CIPHER_CTX_ctrl(). The docu states [1] EVP_CIPHER_CTX_ctrl(): This is a legacy method…. … in versions starting with 3.0. When time permits, i will

[naviserver-devel] Functionality similar to nginx' auth_request

2025-05-05 Thread Georg Lehner
Hello, Nginx has an "auth_request"[1] module, which allows to offload authentication to an HTTP backend. This is used e.g. with oauth2-proxy[2] to provide OAuth2/OpenID Connect authentication to (reverse proxied) applications which do not implement authentication by themself. See configurati

Re: [naviserver-devel] ns_crypto::aead::decrypt "could not set tag value" error

2025-05-05 Thread Wolfgang Winkler via naviserver-devel
Yes, now it works with -encoding binary: % set d [ns_crypto::aead::encrypt string -cipher aes-128-gcm -iv 123456789 -key secret -encoding binary "Hello world!"] % set r [ns_crypto::aead::decrypt string -cipher aes-128-gcm -iv 123456789 -key secret -tag [dict get $d tag] -encoding binary [dict g