Bug 1277681 - Exception triggered when Ipsilon receives AuthnRequest via SOAP endpoint
Exception triggered when Ipsilon receives AuthnRequest via SOAP endpoint
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipsilon (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Rob Crittenden
Namita Soman
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2015-11-03 15:14 EST by Nathan Kinder
Modified: 2016-11-23 06:17 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-23 06:17:57 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Nathan Kinder 2015-11-03 15:14:42 EST
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/ipsilon/ticket/177

When a SAML AuthnRequest is posted to the SOAP endpoint Ipsilon responds with a 400 error because an exception is raised when an attempt is made to save transaction data.

The root cause of the problem is the transaction object created in provider/saml2/auth.AuthenticateRequest._preop() is not initialized.


{{{
    def _preop(self, *args, **kwargs):
        try:
            # generate a new id or get current one
            self.trans = Transaction('saml2', **kwargs)

}}}

slightly later when this code tries to update and save the transaction


{{{
                # SAML binding known, store in transaction
                data = {'saml2_binding': self.binding}
                self.trans.store(data)

}}}

an exception is thrown because the uninitialized Transaction object has no uuid associated with it, a requirement for storing the value.

As to why the transaction is uninitialized is a long and complicated story which will be the subject of another ticket.

But for now it appears the most expedient solution is to remove the following block of code from _preop


{{{
            if self.binding is None:
                # SAML binding is unknown, try to get it from transaction
                transdata = self.trans.retrieve()
                self.binding = transdata.get('saml2_binding')
            else:
                # SAML binding known, store in transaction
                data = {'saml2_binding': self.binding}
                self.trans.store(data)
}}}

because it's not actually accomplishing anything. No one references the saml2_binding value being stored in the transaction, it was put there for bullet-proofing. In hindsight it was probably a bad idea because the binding is a property of the current request, not a property of the series of requests forming a transaction.

This doesn't solve the problem of the uninitialized transaction, but the uninitialized transactions in this code block currently only occurs in the SOAP case, which is the one failing.
Comment 2 John Dennis 2015-11-04 10:33:06 EST
The upstream commit fixing this is

f04fa820d439513de6a2c55bb097c7fde12d6806
Comment 4 Martin Kosek 2016-11-23 06:17:57 EST
Red Hat Enterprise Linux 7.2 introduced the Ipsilon identity provider service for federated single sign-on (SSO). Subsequently, Red Hat has released Red Hat Single Sign-On as a web SSO solution based on the Keycloak community project. Red Hat Single Sign-On provides greater capabilities than Ipsilon and is designated as the standard web SSO solution across the Red Hat product portfolio.

Therefore, as mentioned in the RHEL-7.3 Release Notes:
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.3_Release_Notes/chap-Red_Hat_Enterprise_Linux-7.3_Release_Notes-Deprecated_Functionality.html
Ipsilon is now obsolete in RHEL and all existing Ipsilon users are recommended to migrate to Red Hat SSO product:
https://access.redhat.com/products/red-hat-single-sign-on
Please approach the Customer Service for advice.

Given above, this Bugzilla is now closed as WONTFIX.

Note You need to log in before you can comment on or make changes to this bug.