Bug 1277681 - Exception triggered when Ipsilon receives AuthnRequest via SOAP endpoint
Summary: Exception triggered when Ipsilon receives AuthnRequest via SOAP endpoint
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipsilon
Version: 7.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Rob Crittenden
QA Contact: Namita Soman
Depends On:
TreeView+ depends on / blocked
Reported: 2015-11-03 20:14 UTC by Nathan Kinder
Modified: 2016-11-23 11:17 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2016-11-23 11:17:57 UTC
Target Upstream Version:

Attachments (Terms of Use)

Description Nathan Kinder 2015-11-03 20:14:42 UTC
This bug is created as a clone of upstream ticket:

When a SAML AuthnRequest is posted to the SOAP endpoint Ipsilon responds with a 400 error because an exception is raised when an attempt is made to save transaction data.

The root cause of the problem is the transaction object created in provider/saml2/auth.AuthenticateRequest._preop() is not initialized.

    def _preop(self, *args, **kwargs):
            # generate a new id or get current one
            self.trans = Transaction('saml2', **kwargs)


slightly later when this code tries to update and save the transaction

                # SAML binding known, store in transaction
                data = {'saml2_binding': self.binding}


an exception is thrown because the uninitialized Transaction object has no uuid associated with it, a requirement for storing the value.

As to why the transaction is uninitialized is a long and complicated story which will be the subject of another ticket.

But for now it appears the most expedient solution is to remove the following block of code from _preop

            if self.binding is None:
                # SAML binding is unknown, try to get it from transaction
                transdata = self.trans.retrieve()
                self.binding = transdata.get('saml2_binding')
                # SAML binding known, store in transaction
                data = {'saml2_binding': self.binding}

because it's not actually accomplishing anything. No one references the saml2_binding value being stored in the transaction, it was put there for bullet-proofing. In hindsight it was probably a bad idea because the binding is a property of the current request, not a property of the series of requests forming a transaction.

This doesn't solve the problem of the uninitialized transaction, but the uninitialized transactions in this code block currently only occurs in the SOAP case, which is the one failing.

Comment 2 John Dennis 2015-11-04 15:33:06 UTC
The upstream commit fixing this is


Comment 4 Martin Kosek 2016-11-23 11:17:57 UTC
Red Hat Enterprise Linux 7.2 introduced the Ipsilon identity provider service for federated single sign-on (SSO). Subsequently, Red Hat has released Red Hat Single Sign-On as a web SSO solution based on the Keycloak community project. Red Hat Single Sign-On provides greater capabilities than Ipsilon and is designated as the standard web SSO solution across the Red Hat product portfolio.

Therefore, as mentioned in the RHEL-7.3 Release Notes:
Ipsilon is now obsolete in RHEL and all existing Ipsilon users are recommended to migrate to Red Hat SSO product:
Please approach the Customer Service for advice.

Given above, this Bugzilla is now closed as WONTFIX.

Note You need to log in before you can comment on or make changes to this bug.