[Archivesspace_Users_Group] Problems with oauth plugin

[Tom Hanstra]

I'm having some problems with our Authentication with OKTA which I'm trying
to understand.

Because of the problems, I've tried reinstalling the oauth plugin
completely. The first problem I ran into was that the current download of:

https://github.com/lyrasis/aspace-oauth.git

Had a Gemfile containing the line:

gem 'addressable',   '2.8.0'

This caused some gem issues with our 2.81. version of ArchivesSpace because
2.8.0 was evidently newer than the 2.7.0 version that is in the gems
directory. I'm not savvy enough with Ruby to know how to deal with that so
I simply updated the aspace-oauth Gemvile to read:

gem 'addressable',   '2.7.0'

Not sure if that is legit or not. But it allowed the initialize-plugin
script to work.

But I'm still running into what was actually the original error we are
getting. In the archivesspace.out file, we see this error:

--------
INFO: An exception happened during JRuby-Rack startup
certificate verify failed
--- System
jruby 9.2.12.0 (2.5.7) 2020-07-01 db01a49ba6 OpenJDK 64-Bit Server VM
25.312-b07 on 1.8.0_312-b07 +jit [linux-x86_64]
Time: 2022-06-01 13:57:45 -0400
Server: jetty/8.1.5.v20120716
jruby.home: uri:classloader://META-INF/jruby.home

--- Context Init Parameters:
jruby.max.runtimes = 1
jruby.min.runtimes = 1
public.root = /
rails.env = production

--- Backtrace
OpenSSL::SSL::SSLError: certificate verify failed
                                 connect at
uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:1002
                                do_start at
uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:924
                                   start at
uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:913
                                 request at
uri:classloader:/META-INF/jruby.home/lib/ruby/stdlib/net/http.rb:1465

[and a lot more ruby stuff]
----------

There seems to be some certificate that the plugin is not happy about. But
I cannot determine what certificate it does not like. Both the local
certificates and the OKTA certificates are valid. So what is the issue?

Anyone seen this before and have ideas?

Thanks,
Tom


--
*Tom Hanstra*
*Sr. Systems Administrator*
hanstra at nd.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lyralists.lyrasis.org/pipermail/archivesspace_users_group/attachments/20220601/6ff65de1/attachment.html>