OIDC Private/Public keypair

[DarkDare]

Hi,

First of all, congrats and thank you for this wonderful tool !

I'm trying to setup an OIDC provider in TinyAuth 5.0, and find some difficulties with the OIDC private/public keypair.

1. Keypair generation : openssl genrsa -traditional -out tinyauth.pem 2048 && openssl rsa -in tinyauth.pem -pubout > tinyauth.pem.pub (files are put into the ./data directory)
2. Tinyauth configuration : TINYAUTH_OIDC_PRIVATEKEYPATH=/data/tinyauth.pem and TINYAUTH_OIDC_PUBLICKEYPATH=/data/tinyauth.pem.pub

When Tinyauth starts, I get a fatal Failed to execute command | error=command tinyauth error: failed to bootstrap app: failed to initialize services: x509: failed to parse public key (use ParsePKIXPublicKey instead for this key format)

What am I doing wrong ?
Many thanks in advance

[steveiliop56]

I faced a similar issue while developing this feature. It seems to be some sort of encoding issue with the public key. A simple solution would be to either let Tinyauth generate the keys or provide only the private key and let it generate the public. In any case I will look into it further.

[DarkDare]

Working like a charm using the OpenSSL based keypair generation, but seems to be broken using the SSH-Keygen way (failed to initialize services: unsupported public key type)

[steveiliop56]

If we are talking about ssh-keygen -t rsa -b 4096 -f tinyauth.pem -m pem && ssh-keygen -e -f tinyauth.pem -m pem > tinyauth.pem.pub then yeah it won't work, Tinyauth is not supposed to accept ssh keys. For openssl genrsa -traditional -out tinyauth.pem 2048 && openssl rsa -in tinyauth.pem -pubout > tinyauth.pem.pub it should work. There was also a typo in the public key loading which may be related to this.

[DarkDare]

Indeed if you let Tinyauth generate the public key from the private key, the result is strictly the same as generating the public key using ssh-keygen -e -f tinyauth.pem -m pem > tinyauth.pem.pub. TinyAuth launches normally on the first run. But on the subsequent runs, TinyAuth fails with the "failed to initialize services: unsupported public key type" message.

Moreover openssl genrsa -traditional -out tinyauth.pem 4096 and ssh-keygen -t rsa -b 4096 -f tinyauth.pem -m pem generate the same type of key (same encoding, same format, same exponent), so I'm assuming it should still work

[steveiliop56]

My bad, tested everything again. Turns out the typo was indeed the issue (RSA PRIVATE KEY instead of RSA PUBLIC KEY in the switch statement) and I was trying to pass the ssh key in non-pem format (did not notice that ssh-keygen generated the public key and then it could not overwrite it with the pem one). Can you test with v5.0.2-beta.2? Should work with all methods this time.

[DarkDare]

Working like a charm now, thanks !

[FueledxJarritos]

I know this is marked as answered, but you reference "let Tinyauth generate the keys,: but i dont see how to do so in any documentation or post?

[steveiliop56]

Don't do anything ; ). If Tinyauth can't find the keys it will generate them automatically.