'Unknown authentication strategy "oidc"' in AWS Lambda context

[kpeters-cbsi]

I'm submitting this issue for the package(s):

• oidc-middleware

I'm submitting a:

• Bug report

Current behavior

I've deployed the Lambda sample app provided by Okta using Serverless Framework. While I can run the app locally, when I run it in Lambda, I get:

Error: Unknown authentication strategy "oidc"
    at attempt (/var/task/node_modules/passport/lib/middleware/authenticate.js:173:37)
    at authenticate (/var/task/node_modules/passport/lib/middleware/authenticate.js:349:7)
    at /var/task/node_modules/@okta/oidc-middleware/src/connectUtil.js:81:28
    at Layer.handle [as handle_request] (/var/task/node_modules/express/lib/router/layer.js:95:5)
    at trim_prefix (/var/task/node_modules/express/lib/router/index.js:317:13)
    at /var/task/node_modules/express/lib/router/index.js:284:7
    at Function.process_params (/var/task/node_modules/express/lib/router/index.js:335:12)
    at next (/var/task/node_modules/express/lib/router/index.js:275:10)
    at urlencodedParser (/var/task/node_modules/body-parser/lib/types/urlencoded.js:91:7)
    at Layer.handle [as handle_request] (/var/task/node_modules/express/lib/router/layer.js:95:5)

Expected behavior

When I access my app, I should be redirected to Okta for authentication

Minimal reproduction of the problem with instructions

Deploy my fork of the example with the following .env (properly redacted):

OKTA_ORG_URL=https://dev-69099605.okta.com
APP_SECRET=<application / session secret>
OKTA_CLIENT_ID=<client ID>
OKTA_CLIENT_SECRET=<client secret>
HOST_URL_LAMBDA=https://<my API ID>.execute-api.us-east-1.amazonaws.com
HOST_URL_LOCAL=http://localhost:8080

Extra information about the use case/user story you are trying to implement

This is similar to okta/okta-oidc-js#68, but the solution suggested there, namely invoking app.listen on the oidc.ready event, doesn't work as written in a Lambda context (the listening is being handled by API gateway, which calls the Lambda function with the contents of the HTTP request). I've tried converting the event to a Promise using promise.toolbox.fromEvent, but that causes my Lambda to throw an error.

Environment

• Package Version: 2.0.0
• Browser: Firefox
• OS: Windows 10
• Node version (node -v): AWS Lambda NodeJS 12.x runtime
• Other:

[swiftone]

@kpeters-cbsi - Thanks for the report. Let me check with the team behind that sample repo and see if this issue is better handled there, and I'll report back.

[swiftone]

@kpeters-cbsi - Unfortunately, I don't have a lot of experience merging oidc-middleware with AWS Lambda (example notwithstanding), but this is what we were able to turn up:

The issue might be the Passport middleware. This might help: jaredhanson/passport#651 (comment) or uploading the node_modules to Lambda: https://stackoverflow.com/questions/34437900/how-to-load-npm-modules-in-aws-lambda

[kpeters-cbsi]

Serverless will take care of the NPM modules. So that I can test the Passport hypothesis, what URL should I try to access? The issuer URL (i.e. https://dev-69099605.okta.com/oauth2/default)?

[kpeters-cbsi]

I can get out with my Lambda, but the issuer URL ( https://dev-69099605.okta.com/oauth2/default) produces a 404.

[swiftone]

Yes, the issuer URL is the base for various urls that are actually hit. You can see the url use for the authorize call here: https://github.com/okta/okta-oidc-js/blob/master/packages/oidc-middleware/src/connectUtil.js#L76

There are a number of urls that are hit, so the above isn't the exhaustive list, but that should establish if the Passport fix will help you.

[kpeters-cbsi]

I was able to hit 'https://dev-69099605.okta.com/app/UserHome/oauth2/default/v1/authorize from my Lambda. I don't think it's Passport.

[swiftone]

Unfortunately that's the most information my team has at the moment - your issue (working from inside AWS Lambda) is outside the scope of this SDK itself.

[kpeters-cbsi]

Presumably someone at Okta got it working, as your organization published the example (1). Maybe talk to the author, Braden Kelley? https://github.com/redbmk (1) https://toolkit.okta.com/apps/okta-nodejs-aws-lambda-example/

…

On Thu, Feb 18, 2021 at 6:01 PM Brett Ritter ***@***.***> wrote: <External Email> Unfortunately that's the most information my team has at the moment - your issue (working from inside AWS Lambda) is outside the scope of this SDK itself. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_okta_okta-2Doidc-2Djs_issues_975-23issuecomment-2D781714731&d=DwMCaQ&c=jGUuvAdBXp_VqQ6t0yah2g&r=TTXL98RIPQNjLdDSgeT8-yL45AVQu-9EyYWqGxjCNjqPZing27cmWboo1qWURfVf&m=2UlkTDmcjTg7XRqPGHHOccHXMncvbnLDf9emPUWL6Rc&s=EJlHGwqS2FBZzDk3gYm6R7JS2WveRJG8mSoV421xm-M&e=>, or unsubscribe <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AMOAKPWOTCAHNH6KOJNETFDS7WS33ANCNFSM4XY4YHAA&d=DwMCaQ&c=jGUuvAdBXp_VqQ6t0yah2g&r=TTXL98RIPQNjLdDSgeT8-yL45AVQu-9EyYWqGxjCNjqPZing27cmWboo1qWURfVf&m=2UlkTDmcjTg7XRqPGHHOccHXMncvbnLDf9emPUWL6Rc&s=J4rtKhPnVVjxeWi2huST1S4NeGFZwUy99QpQKfr5qko&e=> .

[aarongranick-okta]

@kpeters-cbsi were you able to get this working?

[kpeters-cbsi]

I don't recall for sure, but I don't think so.

…

On Wed, Jun 30, 2021 at 12:27 PM Aaron Granick ***@***.***> wrote: <External Email> @kpeters-cbsi <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_kpeters-2Dcbsi&d=DwMCaQ&c=jGUuvAdBXp_VqQ6t0yah2g&r=TTXL98RIPQNjLdDSgeT8-yL45AVQu-9EyYWqGxjCNjqPZing27cmWboo1qWURfVf&m=qm7m0QoHTeiRuv9LgIh070ZdYLaKrQPNCZpa6oMB2XY&s=AG6bRFrk3GJjS6EuKrR6tph_yjQyyUwmZd2VMIRjWRE&e=> were you able to get this working? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_okta_okta-2Doidc-2Djs_issues_975-23issuecomment-2D871593912&d=DwMCaQ&c=jGUuvAdBXp_VqQ6t0yah2g&r=TTXL98RIPQNjLdDSgeT8-yL45AVQu-9EyYWqGxjCNjqPZing27cmWboo1qWURfVf&m=qm7m0QoHTeiRuv9LgIh070ZdYLaKrQPNCZpa6oMB2XY&s=Q_EcxO-5PCAvr2xX43YHhSS7Igva2cAZ-YbgcO6blRU&e=>, or unsubscribe <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_notifications_unsubscribe-2Dauth_AMOAKPSNPFJZOTJVTRL3BE3TVNHW5ANCNFSM4XY4YHAA&d=DwMCaQ&c=jGUuvAdBXp_VqQ6t0yah2g&r=TTXL98RIPQNjLdDSgeT8-yL45AVQu-9EyYWqGxjCNjqPZing27cmWboo1qWURfVf&m=qm7m0QoHTeiRuv9LgIh070ZdYLaKrQPNCZpa6oMB2XY&s=g4gI0FY-B6DXhuFXwFG_5YC8QG8L-9A2F2tKDtv_ahQ&e=> .