OpenID connect and Single Sign-On issues

[krokos]

For the last three days I have spent hours exchanging messages with the helpful and really nice people from the Support team regarding some strange issues that we affecting my WHMCS installation.

The symptoms were:

1. At the "OpenID Connect" page I was getting an error for not existing SSL certificate. Which was bizarre since I have a wildcard SSL installed and it is verifying perfectly.
   
2. Clicking any of the "Billings & Support" Cpanel section links, was redirecting OK at first but then throwing an expired token error like this:

   {"error":"expired_token","error_description":"The access token provided has expired"}

   
   

3. 
   

 

Finally we realised that the solutions to these problems were the following:

1. A GeolocationIP hook (called geolocation_hook.php) was causing the missing SSL error on OpenID Connect page. Removing this hook, fixed the issue.
   
2. The Billings & Support issue was caused due to a difference between PHP and mySQL server time. As soon as the two timezones were identical, problem was solved.
   
3. 
   

 

Let's hope that this might help someone who happens to have the same issues. How possible is that?

 

Thanks to the WHMCS support team for their help, patience and efforts.

[freeman]

I have the same problem (1) , can't figure it out what is the problem. The SSL certificate is correct installed, still blind looking for a solution.

 

Regards,

George B.

[krokos]

I have the same problem (1) , can't figure it out what is the problem. The SSL certificate is correct installed, still blind looking for a solution.

 

Regards,

George B.

 

Hi George, perhaps you should try to disable the addons/hooks (if any) and see if one of them is causing the issue.

[freeman]

I disabled all and same result...No clue...And there is no debug for this...

 

Thank you for your answer...

 

 

P.S. The support at WHMCS from my point of view is almost nonexistent.

 

Regards,

George B.

[joelp]

I had the same issue and was banging my head against the wall. Make sure your hosting company is no enforcing useragent on ssl requests. This returns a 404/406 error which means your ssl is not recognized. WHMCS / OpenID Connect needs to resolve this issue however because to make OpenID work, there can potentially be a vulnerability.

 

To test go to root on ssh: curl -I https://yourdomain.com

 

If you get a 404/406 then test with: curl -IA admin https://yourdomain.com

 

You should get a response 301. If you do then you need to have your server admin modify the rule or you need to add useragent to the string passed to OpenID. I recommend the latter to avoid vulnerability.

 

Hope this helps.