Description of problem:
In order for mod_auth_mellon to be usable with a JBoss PicketLink IdP, we need mod_auth_mellon to send AssertionConsumerServiceURLs in AuthNs. There is an upstream bug at https://github.com/UNINETT/mod_auth_mellon/issues/3 for this issue. We'd really like to see this support included for 6.6 GA.
For more information, see https://community.jboss.org/thread/212244?_sscc=t.
Version-Release number of selected component (if applicable):
I'm attaching a hack for mod_auth_mellon-0.7.0 where we were able to get it working.
Created attachment 927178 [details]
Hack to get mod_auth_mellon working with a PicketLink IdP
I will take a look at this, however given AssertionConsumerServiceURL (as well as AssertionConsumerServiceIndex) are optional (per spec) you should probably make it so picketlink works when they are not present.
(In reply to Simo Sorce from comment #4)
> I will take a look at this, however given AssertionConsumerServiceURL (as
> well as AssertionConsumerServiceIndex) are optional (per spec) you should
> probably make it so picketlink works when they are not present.
https://issues.jboss.org/browse/PLINK-445 is open to add this functionality to PicketLink. Currently, it is not configurable.
Agreed with regard to PicketLink (and we currently have an issue open with them for that functionality). The same flexibility would be nice to have in mod_auth_mellon as well. I'd be happy to work with you guys to extend our patch so that it can be enabled in an optional way.
Created attachment 927254 [details]
This patch may be sent upstream.
It works in my test envornment in the sense that it does not annoy my IdP (Ipsilon) which can understand AssertionConsumerServiceURL but does not require it.
Can you test with this patch against PicketLink and let me know if it makes it happy ?
Verified and all looks good.
I had to set CanonicalizationMethod="http://www.w3.org/2001/10/xml-exc-c14n#" in picketlink.xml (PicketLinkIDP section) on the JBoss IdP, but this didn't seem to break any existing SPs.
Thanks for the quick turn-around on this.
(In reply to Simo Sorce from comment #8)
> Created attachment 927254 [details]
> Engineering patch
> This patch may be sent upstream.
> It works in my test envornment in the sense that it does not annoy my IdP
> (Ipsilon) which can understand AssertionConsumerServiceURL but does not
> require it.
> Can you test with this patch against PicketLink and let me know if it makes
> it happy ?
Can you rebuild the mod_auth_mellon RPM with this patch included? I applied this patch and rebuilt the SRC RPM in an ad hoc build environment, but I'd like to rule out my build environment as the cause of bz#1131682.
I was waiting for acks, but I guess I can do a scratch build for now.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.