Bug 1130604
| Summary: | mod_auth_mellon should send AssertionConsumerServiceURLs in AuthNs for compatibility with JBoss PicketLink-based IdPs | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Brian J. Atkisson <batkisso> | ||||||
| Component: | mod_auth_mellon | Assignee: | Simo Sorce <ssorce> | ||||||
| Status: | CLOSED ERRATA | QA Contact: | Namita Soman <nsoman> | ||||||
| Severity: | high | Docs Contact: | |||||||
| Priority: | urgent | ||||||||
| Version: | 6.6 | CC: | batkisso, cww, dpal, dparsons, jgalipea, mcirioli, nsoman, pvn, thashimo, tlavigne | ||||||
| Target Milestone: | rc | ||||||||
| Target Release: | --- | ||||||||
| Hardware: | All | ||||||||
| OS: | Linux | ||||||||
| Whiteboard: | |||||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||||
| Doc Text: | Story Points: | --- | |||||||
| Clone Of: | Environment: | ||||||||
| Last Closed: | 2014-10-14 07:13:59 UTC | Type: | Bug | ||||||
| Regression: | --- | Mount Type: | --- | ||||||
| Documentation: | --- | CRM: | |||||||
| Verified Versions: | Category: | --- | |||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||
| Embargoed: | |||||||||
| Bug Depends On: | |||||||||
| Bug Blocks: | 994246 | ||||||||
| Attachments: |
|
||||||||
|
Description
Brian J. Atkisson
2014-08-15 16:10:36 UTC
Created attachment 927178 [details]
Hack to get mod_auth_mellon working with a PicketLink IdP
I will take a look at this, however given AssertionConsumerServiceURL (as well as AssertionConsumerServiceIndex) are optional (per spec) you should probably make it so picketlink works when they are not present. (In reply to Simo Sorce from comment #4) > I will take a look at this, however given AssertionConsumerServiceURL (as > well as AssertionConsumerServiceIndex) are optional (per spec) you should > probably make it so picketlink works when they are not present. https://issues.jboss.org/browse/PLINK-445 is open to add this functionality to PicketLink. Currently, it is not configurable. Simo, Agreed with regard to PicketLink (and we currently have an issue open with them for that functionality). The same flexibility would be nice to have in mod_auth_mellon as well. I'd be happy to work with you guys to extend our patch so that it can be enabled in an optional way. -mike Created attachment 927254 [details]
Engineering patch
This patch may be sent upstream.
It works in my test envornment in the sense that it does not annoy my IdP (Ipsilon) which can understand AssertionConsumerServiceURL but does not require it.
Can you test with this patch against PicketLink and let me know if it makes it happy ?
Verified and all looks good. One note: I had to set CanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#" in picketlink.xml (PicketLinkIDP section) on the JBoss IdP, but this didn't seem to break any existing SPs. Thanks for the quick turn-around on this. (In reply to Simo Sorce from comment #8) > Created attachment 927254 [details] > Engineering patch > > This patch may be sent upstream. > It works in my test envornment in the sense that it does not annoy my IdP > (Ipsilon) which can understand AssertionConsumerServiceURL but does not > require it. > Can you test with this patch against PicketLink and let me know if it makes > it happy ? Simo, Can you rebuild the mod_auth_mellon RPM with this patch included? I applied this patch and rebuilt the SRC RPM in an ad hoc build environment, but I'd like to rule out my build environment as the cause of bz#1131682. Thank you, Brian I was waiting for acks, but I guess I can do a scratch build for now. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHEA-2014-1514.html |