# Apache + mod\_auth\_openidc, legacy grant types and OIDC conformance

**URL:** <https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416>\
**Category:** Get Help\
**Created:** [October 30, 2018, 8:49pm UTC](https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416 "2018-10-30T20:49:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\
**Post date:** [October 30, 2018, 8:49pm UTC](https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416/1 "2018-10-30T20:49:16Z")

</div>

We have a few legacy apps that do not (and will not) support OAuth/OIDC, SAML, or WS-Fed. For these apps we put an Apache instance in front of them and use [mod\_auth\_openidc](https://github.com/zmartzone/mod_auth_openidc) to enforce authentication with Auth0.

It appears the module requires OIDC conformance to be disabled, and it relies on one or more of the legacy grant types. We haven’t confirmed precisely which legacy grant type it relies on (and yes, there are also a bunch of other grant types in the screencap that should be disabled!)

 ![33](https://global.discourse-cdn.com/auth0/original/2X/c/c6a0bda1b9b8e00147fd80058c84bec96526aeca.png)

Just wondering what we should be concerned about here. Will the legacy grant types eventually go away? Is this a big deal? Are there alternative solutions we should look at?

---

<div class="post-metadata">

**Author:** ![hans.zandbelt](https://upload.wikimedia.org/wikipedia/commons/thumb/7/7c/User_font_awesome.svg/768px-User_font_awesome.svg.png) [@hans.zandbelt](https://community.auth0.com/u/hans.zandbelt)\
**Post date:** [November 5, 2018, 6:37pm UTC](https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416/2 "2018-11-05T18:37:03Z")

</div>

both Auth0 and mod\_auth\_openidc are OpenID Connect certified; it should not be required to switch to legacy grant types; why do you think so?

---

<div class="post-metadata">

**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\
**Post date:** [November 5, 2018, 7:41pm UTC](https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416/3 "2018-11-05T19:41:04Z")

</div>

I’m afraid I’m functioning as a middle-man here so I’m short on the details. We have an infrastructure team that set this up (apache + mod\_auth\_openidc in front of a non-Auth0 app) and from what I know, they insisted one or more legacy grant types (and disabling OIDC conformance) were required for this solution to work.

I’ll replicate the setup in my local environment and do my own testing.

Thanks.

---

<div class="post-metadata">

**Author:** ![James.Morrison](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.morrison/32/13507_2.png) [@James.Morrison](https://community.auth0.com/u/James.Morrison)\
**Post date:** [March 5, 2019, 10:44pm UTC](https://community.auth0.com/t/apache-mod-auth-openidc-legacy-grant-types-and-oidc-conformance/17416/4 "2019-03-05T22:44:58Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.