mod_oauth2 and mod_autoindex

[hf409]

Hi,

since I enabled oauth2 the directory listing does not work as before.
All subdirectories are missing, the directory itself and any files are shown.
Disabling the ouath2 mod makes it work again.
I need oauth2 for a different vhost.

Some details:
The access is allowed for certain claims only:

          <Location / >
               AuthType openid-connect
               Require claim xx:aa
               Require claim xx:bb
            </Location>

In the logs I see lots of denied msgs when e.g. calling /tags:
[authz_core:error] [pid 1541844:tid 139768326678272] [remote 172.xx.xx.xx:45988] AH01631: user [someid]@sts.windows.net/[tenantId]/: authorization failure for "/tags/6/index.html": , referer: https://login.microsoftonline.com/
There are also some oauth2 debug msgs, so it interferes somehow - but no errors.

Do I have to change the config?

I am using liboauth2_1.6.0-1.focal_amd64.deb.

Thanks for any help,
Heike

[hf409]

I can workaround by using a RewriteCondition like:

RewriteCond %{ENV:oidc_claim_xx} !(aa|bb)
RewriteRule  "^.*$" - [R=403,L]

Is it safe?
Thanks, Heike