webfinger | A crate to help you fetch and serve WebFinger resources | REST library

HTTPretty uses a thread to simulate socket timeouts but are not handling exceptions correctly, see issue #334. The latter proposes a method for handling exceptions, but that hasn't been picked up by the maintainers (yet).

However, the message you see is printed by the default threading.excepthook() implementation. You can set your own hook; a no-op lambda would silence the errors:

I solved the issue by re-uploading the configuration file via ftp, pasting it in nano on the ssh shell was a bad idea!

As said Lars Stegelitz, I have to run these services on different ports. I did that and now Nextcloud runs on 445 port, at the same time Seafile on 443. I've added location /nextcloud and there is directive proxy_pass https://192.168.1.134:445; Here are my updated configs. seafile.conf:

Turns out this problem was an amalgamation of two unrelated things.

First, and this is mostly conjecture, it seems that Chrome blocks requests from a local file (the HTML file) and simply provides output that is, to me, very confusing. I.e. the 403 error might be because Chrome blocks the CORS request somehow. I tried running Chrome with various flags, e.g. --disable-web-security and --allow-file-access-from-files, but this did not change the output from the local HTML file. So, the local file request still fails and I don't really know the exact reason. But, since this was just for testing it is not that relevant, for me, currently.

Secondly, an erroneous implementation in an interceptor in the Angular project overwrote all headers for requests. After fixing this, the local server was able to request the endpoint.

It just so happened that the output from the two different issues looked pretty much identical which threw me off.

MitreID is serving on root but sample app is calling on /openid-connect-server-webapp/ You'll want to change your sample app to point to the proper issuer....http://localhost:8080/ (maybe in the application.properties of your sample app?) Or your MitreID server is not configured properly (possibly for issuer property)

See http://localhost:8080/.well-known/openid-configuration for all the endpoints your sample app would hit

It turns out the problem was that I was running WordPress via php -S localhost:8080. When I ran a proper Apache webserver locally generate_rewrite_rules worked as it was supposed to.

OpenID Provider Issuer Discovery is an OPTIONAL discovery service Relying Party knows the OP's Issuer location through an out-of-band mechanism. Or use webfinger which requires the Website to be provided

• resource = Identifier for the target End-User that is the subject of the discovery request.

• host = Server where a WebFinger service is hosted.

• rel = URI identifying the type of service whose location is being requested.

IMHO, the example from RFC 7033 supplied is misleading. Determining the issuer from and "carol@example.com" is not well implemented by many of the providers. (At least what I could find)

I tried a few email addresses and could only get on to send a response. (Further the example shows a simple http get and yet the OpenID Connect Discovery requires https)

I did get "will@willnorris.com" to send a response. (See https://indieweb.org/WebFinger where Will Norris contributes)

I am also of the using OpenID Connect webfinger discovery which is convenient is also a security concern.

I was able to do some discovery on an bradfitz@gmail.com based on an entry dated 2010 but is was not as simple as a webfinger query as described in the example.

Perhaps some others will respond.

Generally the website must register (a Client ID), this may be performed dynamically, with each the OpenID connect provider they wish to work with.

WebFinger is a protocol defined in RFC7033. There is a complete example in section 3.1:

3.1. Identity Provider Discovery for OpenID Connect

Suppose Carol wishes to authenticate with a web site she visits using OpenID Connect. She would provide the web site with her OpenID Connect identifier, say carol@example.com. The visited web site would perform a WebFinger query looking for the OpenID Connect provider. Since the site is interested in only one particular link relation, the WebFinger resource might utilize the "rel" parameter as described in Section 4.3:

The problem is the setting location ~ /\.well-known { allow all; }.

This should be removed. Additionally, the setting include /etc/nginx/default.d/*.conf; includes a default config file which also has the setting location ~ /\.well-known { allow all; }. This setting should be removed from that file too.