Disable SSL verification

[leoandrea7]

Is there any option to disable SSL verification and accept insecure connection?

[maciejb2k]

I have the same problem, cannot setup local development for self-hosted Authentik, because it defaults to https all the time, even if http is set explicitly.

[maciejb2k]

This initializer config/initializers/disable_ssl_certificate_verification.rb actually helped me bypass SSL:

require 'openssl'

if Rails.env.development?
  OpenSSL::SSL.send(:remove_const, :VERIFY_PEER)
  OpenSSL::SSL::VERIFY_PEER = OpenSSL::SSL::VERIFY_NONE
end

[JoeNyland]

I was battling this, too. Specifically, I was trying to not use SSL in dev, running Pocket ID as the IdP. Note that this isn't SSL without verification; it's just basic (insecure) unencrypted HTTP.

There's lots of layers that assume SSL -- and quite rightly so. However, when I've given a HTTP URL, then I expect HTTP to be used, rather than it silently being mutated to use HTTPS.

Nonetheless, I was able to get it to work without SSL locally with the following. The trick seems to be turning off discovery and manually defining all of the endpoints so that the gem and its dependencies don't try to infer the endpoints from the issuer.

Rails.application.config.middleware.use OmniAuth::Builder do
  provider :openid_connect, {
    name: :my_provider,
    scope: [:openid, :email, :profile, :address],
    response_type: :code,
    uid_field: "preferred_username",
    discovery: false,
    issuer: 'http://localhost:1411',
    client_options: {
      site: 'http://localhost:1411',
      authorization_endpoint: 'http://localhost:1411/authorize',
      token_endpoint: 'http://localhost:1411/api/oidc/token',
      userinfo_endpoint: 'http://localhost:1411/api/oidc/userinfo',
      jwks_uri: "http://localhost:1411/.well-known/jwks.json",
      identifier: ENV["OP_CLIENT_ID"],
      secret: ENV["OP_SECRET_KEY"],
      redirect_uri: "http://myapp.com/users/auth/openid_connect/callback",
    },
  }
end

To be clear, this is what I've changed from the suggested config in the README:

diff --git a/old.rb b/new.rb
index 1ae4cb44..73415a9b 100644
--- a/old.rb
+++ b/new.rb
@@ -4,10 +4,14 @@ Rails.application.config.middleware.use OmniAuth::Builder do
     scope: [:openid, :email, :profile, :address],
     response_type: :code,
     uid_field: "preferred_username",
+    discovery: false,
+    issuer: 'http://localhost:1411',
     client_options: {
-      port: 443,
-      scheme: "https",
-      host: "myprovider.com",
+      site: 'http://localhost:1411',
+      authorization_endpoint: 'http://localhost:1411/authorize',
+      token_endpoint: 'http://localhost:1411/api/oidc/token',
+      userinfo_endpoint: 'http://localhost:1411/api/oidc/userinfo',
+      jwks_uri: "http://localhost:1411/.well-known/jwks.json",
       identifier: ENV["OP_CLIENT_ID"],
       secret: ENV["OP_SECRET_KEY"],
       redirect_uri: "http://myapp.com/users/auth/openid_connect/callback",

[epugh]

I wanted to chime in that above post helped me get OIDC to work with Keycloak. Here are what my Keycloak settings look like:

if Rails.application.config.openid_connect_client_id.present?
    config.omniauth :openid_connect, {
      name:           :openid_connect,
      issuer:         Rails.application.config.openid_connect_issuer,
      discovery:      false,
      response_type:  :code,
      scope:          %w[openid email],
      client_options: {
        # schema is being ignored according to https://github.com/omniauth/omniauth_openid_connect/issues/186
        #scheme: 'http',
        #host: 'keycloak',
        #port: 8080,
        site: 'http://keycloak:8080',
        authorization_endpoint: 'http://keycloak:8080/realms/quepid/protocol/openid-connect/auth',
        token_endpoint: 'http://keycloak:8080/realms/quepid/protocol/openid-connect/token',
        userinfo_endpoint: 'http://keycloak:8080/realms/quepid/protocol/openid-connect/userinfo',
        jwks_uri: "http://keycloak:8080/realms/quepid/protocol/openid-connect/certs",
        identifier:   Rails.application.config.openid_connect_client_id,
        secret:       Rails.application.config.openid_connect_client_secret,
        redirect_uri: "#{Rails.application.config.openid_connect_base_url}/users/auth/openid_connect/callback",
      },
    }
  end

[epugh]

Here is a more targeted PR that just disables SSL cert verification if you use a self signed certificate: #212