Bug 1130604 - mod_auth_mellon should send AssertionConsumerServiceURLs in AuthNs for compatibility with JBoss PicketLink-based IdPs
Summary: mod_auth_mellon should send AssertionConsumerServiceURLs in AuthNs for compat...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: mod_auth_mellon
Version: 6.6
Hardware: All
OS: Linux
urgent
high
Target Milestone: rc
: ---
Assignee: Simo Sorce
QA Contact: Namita Soman
URL:
Whiteboard:
Depends On:
Blocks: 994246
TreeView+ depends on / blocked
 
Reported: 2014-08-15 16:10 UTC by Brian J. Atkisson
Modified: 2018-12-09 18:22 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-10-14 07:13:59 UTC


Attachments (Terms of Use)
Hack to get mod_auth_mellon working with a PicketLink IdP (1.44 KB, patch)
2014-08-15 16:11 UTC, Brian J. Atkisson
no flags Details | Diff
Engineering patch (1.86 KB, patch)
2014-08-15 19:56 UTC, Simo Sorce
batkisso: review+
Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHEA-2014:1514 normal SHIPPED_LIVE new packages: xmlsec1, lasso, mod_auth_mellon 2014-10-14 01:22:22 UTC

Description Brian J. Atkisson 2014-08-15 16:10:36 UTC
Description of problem:

In order for mod_auth_mellon to be usable with a JBoss PicketLink IdP, we need mod_auth_mellon to send AssertionConsumerServiceURLs in AuthNs.  There is an upstream bug at https://github.com/UNINETT/mod_auth_mellon/issues/3 for this issue.  We'd really like to see this support included for 6.6 GA.

For more information, see https://community.jboss.org/thread/212244?_sscc=t.

Version-Release number of selected component (if applicable):
mod_auth_mellon-0.8.0-1.el6.x86_64.rpm
lasso-2.4.0-4.el6.x86_64.rpm

How reproducible:
Always


Additional info:
I'm attaching a hack for mod_auth_mellon-0.7.0 where we were able to get it working.

Comment 1 Brian J. Atkisson 2014-08-15 16:11:26 UTC
Created attachment 927178 [details]
Hack to get mod_auth_mellon working with a PicketLink IdP

Comment 4 Simo Sorce 2014-08-15 17:27:25 UTC
I will take a look at this, however given AssertionConsumerServiceURL (as well as AssertionConsumerServiceIndex) are optional (per spec) you should probably make it so picketlink works when they are not present.

Comment 5 Brian J. Atkisson 2014-08-15 17:36:45 UTC
(In reply to Simo Sorce from comment #4)
> I will take a look at this, however given AssertionConsumerServiceURL (as
> well as AssertionConsumerServiceIndex) are optional (per spec) you should
> probably make it so picketlink works when they are not present.

https://issues.jboss.org/browse/PLINK-445 is open to add this functionality to PicketLink.  Currently, it is not configurable.

Comment 6 mcirioli 2014-08-15 17:43:31 UTC
Simo, 
Agreed with regard to PicketLink (and we currently have an issue open with them for that functionality).  The same flexibility would be nice to have in mod_auth_mellon as well.  I'd be happy to work with you guys to extend our patch so that it can be enabled in an optional way.
-mike

Comment 8 Simo Sorce 2014-08-15 19:56:53 UTC
Created attachment 927254 [details]
Engineering patch

This patch may be sent upstream.
It works in my test envornment in the sense that it does not annoy my IdP (Ipsilon) which can understand AssertionConsumerServiceURL but does not require it.
Can you test with this patch against PicketLink and let me know if it makes it happy ?

Comment 9 Brian J. Atkisson 2014-08-18 15:49:44 UTC
Verified and all looks good.

One note:
I had to set CanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#" in picketlink.xml (PicketLinkIDP section) on the JBoss IdP, but this didn't seem to break any existing SPs.

Thanks for the quick turn-around on this.

Comment 13 Brian J. Atkisson 2014-08-20 14:02:32 UTC
(In reply to Simo Sorce from comment #8)
> Created attachment 927254 [details]
> Engineering patch
> 
> This patch may be sent upstream.
> It works in my test envornment in the sense that it does not annoy my IdP
> (Ipsilon) which can understand AssertionConsumerServiceURL but does not
> require it.
> Can you test with this patch against PicketLink and let me know if it makes
> it happy ?

Simo,

Can you rebuild the mod_auth_mellon RPM with this patch included?  I applied this patch and rebuilt the SRC RPM in an ad hoc build environment, but I'd like to rule out my build environment as the cause of bz#1131682.

Thank you,
Brian

Comment 14 Simo Sorce 2014-08-20 14:15:59 UTC
I was waiting for acks, but I guess I can do a scratch build for now.

Comment 23 errata-xmlrpc 2014-10-14 07:13:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHEA-2014-1514.html


Note You need to log in before you can comment on or make changes to this bug.