Bug 1256995

Summary:	SAML2 ECP Accept header incorrect
Product:	Red Hat OpenStack	Reporter:	Jamie Lennox <jlennox>
Component:	python-keystoneclient	Assignee:	Nathan Kinder <nkinder>
Status:	CLOSED ERRATA	QA Contact:	Rodrigo Duarte <rduartes>
Severity:	unspecified	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	apevec, ayoung, extras-qa, jose.castro.leon, jruzicka, jschluet, nkinder, sasha, sclewis, yeylon
Target Milestone:	beta	Keywords:	TestOnly
Target Release:	8.0 (Liberty)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-keystoneclient-1.7.2-1.el7ost	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1256994	Environment:
Last Closed:	2016-04-07 21:03:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1256994
Bug Blocks:

Description Jamie Lennox 2015-08-26 03:00:10 UTC

+++ This bug was initially created as a clone of Bug #1256994 +++

The first SAML ECP request is to the endpoint with an Accept value containing application/vnd.paos+xml. In the spec example and in keystoneclient we send "text/html; application/vnd.paos+xml" however this is incorrect because the mime-type separator in Accept headers is a , (comma), where a ; provides parameters to the type[2].

This has been confirmed by SAML2 working group as a bug in the spec. (Will provide reference for this soon).

This works in Sibolleth because the accept matcher simply does

if 'application/vnd.paos+xml' in req.headers.accept

but fails in mod_auth_mellon which does a more strict type check.

[1] http://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/cs01/saml-ecp-v2.0-cs01.html#_Toc366664721
[2] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

Comment 4 Nathan Kinder 2015-12-10 23:08:39 UTC

This is fixed upstream in python-keystoneclient 1.7.0, and it was also backported to the 1.3.3 release on the stable/kilo branch here:

  https://review.openstack.org/#/c/217450/

This will be included in RHEL OSP 8, which currently is including python-keystoneclient-1.7.2-1.el7ost

Comment 5 Rodrigo Duarte 2016-02-12 13:03:27 UTC

Verified for python-keystoneclient-1.7.2-1.el7ost.

Federation setup with:

VM 1: OpenStack + mod_mellon (openstack.rduartes.unknown.test)
VM 2: Ipsilon backed by FreeIPA (ipa.rduartes.unknown.test)

In order to test if it is working we may try to get an unscoped token via Federation and using a python-keystoneclient plugin:

from keystoneclient.contrib.auth.v3 import saml2
from keystoneclient import session
from keystoneclient.v3 import client

# Try to authenticate in the IdP and than use the credentials in the SP
saml2_auth = saml2.Saml2UnscopedToken(auth_url='https://openstack.rduartes.unknown.test:5000/v3',
                                      identity_provider='ipsilon',
                                      identity_provider_url='https://ipa.rduartes.unknown.test/idp/saml2/SSO/SOAP',
                                      username='rduartes',
                                      password='rduartes')

sess = session.Session(auth=saml2_auth)

# Try to actually use the federated credentials
ks = client.Client(session=sess)

print('Try to list projects:')
print(ks.federation.projects.list())

Comment 8 errata-xmlrpc 2016-04-07 21:03:38 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-0603.html