Bug 1277682

Summary:	When authentication is performed by Apache user info attributes are not available
Product:	Red Hat Enterprise Linux 7	Reporter:	Nathan Kinder <nkinder>
Component:	ipsilon	Assignee:	Rob Crittenden <rcritten>
Status:	CLOSED WONTFIX	QA Contact:	Namita Soman <nsoman>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	jdennis, mkosek, puiterwijk
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-11-23 11:17:28 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Nathan Kinder 2015-11-03 20:15:29 UTC

This bug is created as a clone of upstream ticket:
https://fedorahosted.org/ipsilon/ticket/191

User attributes are populated by the Info plugins. However the code that populates the user attributes and builds a session bound to the user only executes when a LoginManager executes the auth_successful method.

But when external authentication is being being performed by Apache (the endpoint location is protected) such as is the case with ECP we fail to populate the user attributes from the Info plugins, the net result is the SAML Assertion is returned without any attributes.

Comment 2 John Dennis 2015-11-04 15:34:41 UTC

The upstream commit fixing this is:

678c35ffc62b62645ee8d8a86b38f445d0bbfa2d

Comment 4 Martin Kosek 2016-11-23 11:17:28 UTC

Red Hat Enterprise Linux 7.2 introduced the Ipsilon identity provider service for federated single sign-on (SSO). Subsequently, Red Hat has released Red Hat Single Sign-On as a web SSO solution based on the Keycloak community project. Red Hat Single Sign-On provides greater capabilities than Ipsilon and is designated as the standard web SSO solution across the Red Hat product portfolio.

Therefore, as mentioned in the RHEL-7.3 Release Notes:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/chap-Red_Hat_Enterprise_Linux-7.3_Release_Notes-Deprecated_Functionality.html
Ipsilon is now obsolete in RHEL and all existing Ipsilon users are recommended to migrate to Red Hat SSO product:
https://access.redhat.com/products/red-hat-single-sign-on
Please approach the Customer Service for advice.

Given above, this Bugzilla is now closed as WONTFIX.