RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1130604 - mod_auth_mellon should send AssertionConsumerServiceURLs in AuthNs for compatibility with JBoss PicketLink-based IdPs
Summary: mod_auth_mellon should send AssertionConsumerServiceURLs in AuthNs for compat...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: mod_auth_mellon
Version: 6.6
Hardware: All
OS: Linux
urgent
high
Target Milestone: rc
: ---
Assignee: Simo Sorce
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks: 994246
TreeView+ depends on / blocked
 
Reported: 2014-08-15 16:10 UTC by Brian J. Atkisson
Modified: 2018-12-09 18:22 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-10-14 07:13:59 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
Hack to get mod_auth_mellon working with a PicketLink IdP (1.44 KB, patch)
2014-08-15 16:11 UTC, Brian J. Atkisson 		no flags Details | Diff
Engineering patch (1.86 KB, patch)
2014-08-15 19:56 UTC, Simo Sorce 		batkisso: review+
Details | Diff
Show Obsolete (1) View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2014:1514 0 normal SHIPPED_LIVE new packages: xmlsec1, lasso, mod_auth_mellon 2014-10-14 01:22:22 UTC

Description Brian J. Atkisson 2014-08-15 16:10:36 UTC 
Description of problem:

In order for mod_auth_mellon to be usable with a JBoss PicketLink IdP, we need mod_auth_mellon to send AssertionConsumerServiceURLs in AuthNs.  There is an upstream bug at https://github.com/UNINETT/mod_auth_mellon/issues/3 for this issue.  We'd really like to see this support included for 6.6 GA.

For more information, see https://community.jboss.org/thread/212244?_sscc=t.

Version-Release number of selected component (if applicable):
mod_auth_mellon-0.8.0-1.el6.x86_64.rpm
lasso-2.4.0-4.el6.x86_64.rpm

How reproducible:
Always


Additional info:
I'm attaching a hack for mod_auth_mellon-0.7.0 where we were able to get it working.
Comment 1 Brian J. Atkisson 2014-08-15 16:11:26 UTC 
Created attachment 927178 [details]
Hack to get mod_auth_mellon working with a PicketLink IdP
Comment 4 Simo Sorce 2014-08-15 17:27:25 UTC 
I will take a look at this, however given AssertionConsumerServiceURL (as well as AssertionConsumerServiceIndex) are optional (per spec) you should probably make it so picketlink works when they are not present.
Comment 5 Brian J. Atkisson 2014-08-15 17:36:45 UTC 
(In reply to Simo Sorce from comment #4)
> I will take a look at this, however given AssertionConsumerServiceURL (as
> well as AssertionConsumerServiceIndex) are optional (per spec) you should
> probably make it so picketlink works when they are not present.

https://issues.jboss.org/browse/PLINK-445 is open to add this functionality to PicketLink.  Currently, it is not configurable.
Comment 6 mcirioli 2014-08-15 17:43:31 UTC 
Simo, 
Agreed with regard to PicketLink (and we currently have an issue open with them for that functionality).  The same flexibility would be nice to have in mod_auth_mellon as well.  I'd be happy to work with you guys to extend our patch so that it can be enabled in an optional way.
-mike
Comment 8 Simo Sorce 2014-08-15 19:56:53 UTC 
Created attachment 927254 [details]
Engineering patch

This patch may be sent upstream.
It works in my test envornment in the sense that it does not annoy my IdP (Ipsilon) which can understand AssertionConsumerServiceURL but does not require it.
Can you test with this patch against PicketLink and let me know if it makes it happy ?
Comment 9 Brian J. Atkisson 2014-08-18 15:49:44 UTC 
Verified and all looks good.

One note:
I had to set CanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#" in picketlink.xml (PicketLinkIDP section) on the JBoss IdP, but this didn't seem to break any existing SPs.

Thanks for the quick turn-around on this.
Comment 13 Brian J. Atkisson 2014-08-20 14:02:32 UTC 
(In reply to Simo Sorce from comment #8)
> Created attachment 927254 [details]
> Engineering patch
> 
> This patch may be sent upstream.
> It works in my test envornment in the sense that it does not annoy my IdP
> (Ipsilon) which can understand AssertionConsumerServiceURL but does not
> require it.
> Can you test with this patch against PicketLink and let me know if it makes
> it happy ?

Simo,

Can you rebuild the mod_auth_mellon RPM with this patch included?  I applied this patch and rebuilt the SRC RPM in an ad hoc build environment, but I'd like to rule out my build environment as the cause of bz#1131682.

Thank you,
Brian
Comment 14 Simo Sorce 2014-08-20 14:15:59 UTC 
I was waiting for acks, but I guess I can do a scratch build for now.
Comment 23 errata-xmlrpc 2014-10-14 07:13:59 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHEA-2014-1514.html
Note You need to log in before you can comment on or make changes to this bug.