get_valid_transaction() vs Transaction()?
by John Dennis
I'm trying to understand why we have 2 almost identical ways to obtain a
Transaction object and what the actual logical requirements are. This an
area that's always been a bit confusing to me.
1) Do we have cases where it is an error if a page handler cannot find a
preexisting transaction? I would expect so, but I'm not sure I see that
in the code. I would expect the method Page.get_valid_transaction() to
be method that enforces that. The only thing in get_valid_transaction()
that looks like it might enforce that is catch on a ValueError at the
end of the function. But I have no clue who might be throwing a value
error or why. In fact a ValueError is such a broad generic error I don't
know how or why it might indicate a bad transaction id. See point 2 below.
2) get_valid_transaction will create a tid if find_tid(kwargs) fails. Is
the catch on the ValueError supposed to be for anything prior to calling
find_tid(kwargs)?
3) Both the Transaction constructor and get_valid_transaction will
create a tid if one is not found. The difference is the Transaction
constructor only does this if kwargs is passed. Why? (there is a comment
indicating this is for backwards compatibility, how/why?)
It seems like the fundamental difference between Transaction() and
get_valid_transaction() is:
a) Transaction() only creates a tid if there are kwargs
b) get_valid_transaction also examines the referer and REQUEST_URI
Is there ever a case where finding the tid in the referer or
REQUEST_URI would be invalid for a page expecting an existing
transaction? In other words can the logic be combined and
simplified?
4) Is there any reason why saml2.AuthenticateRequest._preop()
https://git.fedorahosted.org/cgit/ipsilon.git/tree/ipsilon/providers/saml...
Is doing this:
# generate a new id or get current one
self.trans = Transaction('saml2', **kwargs)
Instead of:
# generate a new id or get current one
self.trans = self.get_valid_transaction('saml2', **kwargs)
The comment is inaccurate, a new id is *NOT* generated unless there are
kwargs (why?)
5) Is there a preexisting assumption that Transaction objects are only
required/valid for flows where more than one page handler is involved?
For requests where there is only a single request/response (i.e. no
multi-page flow) a Transaction object is still a handy place to store
additional information about a request. This is the use case that is now
failing.
6) Have we ever checked to see if we're leaking transaction id's? i.e.
we create them but they never get cleaned up.
---------------------------------------------------------------------
The fundamental problem is not all SAML Authentication endpoints will
have query or post parameters passed in kwargs. For example anything
passed through the SOAP binding won't and this is now causing problems
because later code that tries to save the transaction fails if there
isn't a transaction id (new behavior).
I'll confess, I never really understood the logic surrounding
transaction ids, it's a bit obtuse. I've tried tweaking things in the
past to get past immediate problems and often it's caused something to
break. Now I'm unwilling to put a change in without understanding the
actual logic requirements because I'm likely to unintentionally break
something (again). The code needs to be simpler and/or have much better
documentation.
--
John
8 years, 6 months
show sp metadata on sp admin page?
by John Dennis
It's been a while since I've used admin web interface and it looks like
things have changed a bit. I thought one of the data items we used to
show on the saml2 sp page (the page which shows an individual sp
configuration) was the metadata for the sp but metadata isn't shown. Why?
While debugging the rippowan demo I was pretty sure either the metadata
for the keystone SP was missing or wasn't complete. The only way I could
confirm this was by using the sqlite command line tool to examine the
sqlite databases in /var/lib/ipsilon/idp. Hardly a friendly or efficient
way to be able to examine the metadata for a configured SP.
Also, I couldn't find the code that populates the SP configuration page,
where is it?
Anyway, the metadata used in the demo is missing an
AssertionConsumerService which is one of the reasons ECP with
keystoneclient isn't working.
So if I were an Ipsilon admin how could I identify and fix this problem
using the web interface?
--
John
8 years, 7 months
Ipsilon 1.1.0 released
by Patrick Uiterwijk
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi all,
I'm thrilled to hereby officially announce the release of Ipsilon 1.1.0: history has been rewritten.
Main changes since 1.0.0:
- - Service Provider portal interface
- - Support SOAP based SAML single logout
- - Fixes for CVE-2015-5215[1], CVE-2015-5216[2], CVE-2015-5217[3]
- - Database schema upgrade and management*
- - Database indexes*
- - Automatic database cleanup
- - A lot of bugfixes
*: This change has required a schema version bump. For information on upgrading your database, see [4].
For more information, please see the release page[5] for version 1.1.0.
Thanks to everyone that contributed during this release!
With kind regards,
Patrick Uiterwijk
[1]: https://access.redhat.com/security/cve/CVE-2015-5215
[2]: https://access.redhat.com/security/cve/CVE-2015-5216
[3]: https://access.redhat.com/security/cve/CVE-2015-5217
[4]: https://fedorahosted.org/ipsilon/wiki/Upgrading
[5]: https://fedorahosted.org/ipsilon/wiki/Releases/v1.1.0
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV7IZWAAoJEIZXmA2atR5QVkwP/02adC46ZlBoQl7UeHSxi6xd
YdSejNTUTeo241JhcSPlnC0+fpixvWTjuJmJYzM4IAN9NhlsMppzFGBwD/gG5Yr/
PzYyHIbzoSinKloL+2cyhZX+nF3DsjyYlhu9dd4hoeiwc9jtlN3j7s1gEsbBuxhO
b/T7OP1rI4TGdX3L1Ol7EKC+53sdriT4B1+XhXmixrXt+I5L4tpdRlt5wzuMLVUU
mmcnn4/rhX7IGj3+8yZfYwClAKRUrVxlAMZ9s79PbW+HqiMt/r/NmYPQ4EKiY+XM
jCwZg9rk9E7b4m2bOdkjtX35Gxj4mChQV3XF8GvHltVar3oMFKYhtCA3YOm3Q4f7
yY4BOGN41OsW0qK9lNwpHjWR/lkf/rJJ0fA3yG2IU7o7Wh6COF1yBwDZJynmNCkd
MzxWeqPOAtlU50yWKdl9ut3byZ4Wu+vC24IQ0g4fskZnsx4C63/mQuIf0hp45ELa
8poFtgVGe3WCW23+hq/m04/ZHu2oi9jj4WwZY9AKn4f8Gv1xby/I4BRrxYd9BRNa
SlVYmKHO6Jp4dSmgpJzZ8d7bo+vdOydjKK5haX3Bkh6nLzqcG9M+MFBUiIV9/abr
nsanqN2wfpsV4T4PqQf9/81iVVpmXHlL5S5clKepE6SLa5RIE9ErPgdhlyFZeQSU
shy16dec/zyZOsemj3kK
=170+
-----END PGP SIGNATURE-----
8 years, 7 months