Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1481322

Summary:	mellon-root and mellon-protected-locations need to be validated
Product:	Red Hat Enterprise Linux 7	Reporter:	John Dennis <jdennis>
Component:	keycloak-httpd-client-install	Assignee:	John Dennis <jdennis>
Status:	CLOSED ERRATA	QA Contact:	Kaleem <ksiddiqu>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.5	CC:	extras-qa, jdennis, nkinder, spoore
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	keycloak-httpd-client-install-0.6-2.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1456855	Environment:
Last Closed:	2018-04-10 18:16:10 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1456855
Bug Blocks:

Description John Dennis 2017-08-14 15:19:14 UTC

+++ This bug was initially created as a clone of Bug #1456855 +++

keycloak-httpd-client-install will permit creating a non-working configuration if mellon-protected-locations are not equal to or ancestors of mellon-root. The relationship between mellon-root and mellon-protected-locations should be validated.

This error was evident in this bug #1447770 which ran keycloak-httpd-client-install this way:

[root@sp1 ~]# keycloak-httpd-client-install   \
      --client-originate-method registration \
      --keycloak-server-url https://idp.keycloak.test:8443 \
      --keycloak-admin-username admin \
      --keycloak-admin-password Secret1230 \
      --app-name testapp \
      --keycloak-realm test_realm \
      --mellon-protected-locations "/private" \
      --mellon-root mellon_root \
      --force

It produced this run time error message in the error_log:

"Error adding IdP to lasso server object. Please verify the following configuration directives: MellonIdPMetadataFile and MellonIdPPublicKeyFile."

And a server 500 error during access to the protected location.

The fundamental problem is there were no IdP's defined for the protected location.

The error message is cryptic and misleading, it implies there is a problem loading the IdP metadata, e.g. file access permissions, bad XML etc. when in fact the problem is there was no metadata to load, not that the metadata file was the problem. We need to check the count of IdP metadata and emit a different message if no IdP metadata is defined. The reason this is confusing is because the IdP metadata often is defined, it's just not available to the protected location. Also there probably should be a better error than server 500, is there an HTTP error for server misconfiguration? If not then the configuration should be validated at mellon load time so the server fails to start rather than a lazy load which permits the server to start with a non-functioning configuration.

Comment 3 Scott Poore 2018-01-10 15:53:52 UTC

Verified.

Version :: 

keycloak-httpd-client-install-0.6-2.el7.noarch

Results ::

Test 1 with root and protected locations differing:  Failed as expected:

[root@sp2 ~]# keycloak-httpd-client-install   \
>     --client-originate-method registration \
>     --keycloak-server-url https://idp.keycloak.test:8443 \
>     --keycloak-admin-username admin \
>     --keycloak-admin-password Secret123 \
>     --app-name example_app \
>     --keycloak-realm demorealm \
>     --mellon-https-port 8443 \
>     --mellon-root mellon_root \
>     --mellon-protected-locations "/private" \
>     --force
/mellon_root/ /private/
ValueError: Invalid protected location "/private/" must be equal to or ancestor of the mellon root "/mellon_root/"


Test 2 with protected and locations being equal:  passed:

[root@sp2 ~]# keycloak-httpd-client-install   \
>     --client-originate-method registration \
>     --keycloak-server-url https://idp.keycloak.test:8443 \
>     --keycloak-admin-username admin \
>     --keycloak-admin-password Secret123 \
>     --app-name example_app \
>     --keycloak-realm demorealm \
>     --mellon-https-port 8443 \
>     --mellon-root mellon_root \
>     --mellon-protected-locations "/mellon_root" \
>     --force
/mellon_root/ /mellon_root/
[Step  1] Connect to Keycloak Server
[Step  2] Create Directories
[Step  3] Set up template environment
[Step  4] Set up Service Provider X509 Certificiates
[Step  5] Build Mellon httpd config file
[Step  6] Build Mellon SP metadata file
[Step  7] Query realms from Keycloak server
[Step  8] Use existing realm on Keycloak server
[Step  9] Query realm clients from Keycloak server
[Step 10] Get new initial access token
[Step 11] Creating new client using registration service
[Step 12] Enable saml.force.post.binding
[Step 13] Add group attribute mapper to client
[Step 14] Add Redirect URIs to client
[Step 15] Retrieve IdP metadata from Keycloak server
[Step 16] Completed Successfully

And I confirmed proper login from web browser.

Test 3 with protected location as ancestor of root: passed

First I removed the client from the IdP from the RH-SSO admin interface.

Next, cleanup SP from previous test:

[root@sp2 ~]# cd /etc/httpd/
[root@sp2 httpd]# rm -rf saml2/
[root@sp2 httpd]# cd conf.d
[root@sp2 conf.d]# rm example_app_*
rm: remove regular file ‘example_app_mellon_keycloak_demorealm.conf’? y
rm: remove regular file ‘example_app_private.conf’? y
rm: remove regular file ‘example_app_ssl.conf’? y
[root@sp2 ~]# systemctl stop httpd

Now run test:

[root@sp2 ~]# keycloak-httpd-client-install   \
>     --client-originate-method registration \
>     --keycloak-server-url https://idp.keycloak.test:8443 \
>     --keycloak-admin-username admin \
>     --keycloak-admin-password Secret123 \
>     --app-name example_app \
>     --keycloak-realm demorealm \
>     --mellon-https-port 8443 \
>     --mellon-root mellon_root \
>     --mellon-protected-locations "/mellon_root/private" \
>     --force
/mellon_root/ /mellon_root/private/
[Step  1] Connect to Keycloak Server
[Step  2] Create Directories
[Step  3] Set up template environment
[Step  4] Set up Service Provider X509 Certificiates
[Step  5] Build Mellon httpd config file
[Step  6] Build Mellon SP metadata file
[Step  7] Query realms from Keycloak server
[Step  8] Use existing realm on Keycloak server
[Step  9] Query realm clients from Keycloak server
[Step 10] Get new initial access token
[Step 11] Creating new client using registration service
[Step 12] Enable saml.force.post.binding
[Step 13] Add group attribute mapper to client
[Step 14] Add Redirect URIs to client
[Step 15] Retrieve IdP metadata from Keycloak server
[Step 16] Completed Successfully

[root@sp2 ~]# cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/example_app_ssl.conf
[root@sp2 ~]# sed -i 's/443/8443/g' /etc/httpd/conf.d/example_app_ssl.conf
[root@sp2 ~]# systemctl restart httpd
[root@sp2 ~]# vim /var/www/html/mellon_root/logged_out.html 

Then verified with web browser.

Comment 6 errata-xmlrpc 2018-04-10 18:16:10 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0973