On Sat, 2015-03-07 at 22:06 -0800, Nathan Kinder wrote:
On 03/07/2015 08:23 PM, Nathan Kinder wrote:
> Hi,
>
> I've been working on running through the documentation Rob has been
> preparing for next week's Fedora test day [1]. I'm running into a
> problem with the SP configuration using the 0.4.0 packages on F21.
>
> In the past, I've been configuring mod_auth_mellon by hand, but this
> time I'm using ipsilon-client-install as mentioned in the wiki:
>
> ipsilon-client-install --saml-idp-metadata
> https://$IPA_FQDN/idp/saml2/metadata --saml-auth /sp
>
> After uploading the metadata to the Ipsilon server, attempting to access
> my sp at
https://sp1.example.test/sp (using Kerberos auth) ends up in a
> ping-pong loop of redirects that ultimately just fails in a bad request.
I did a bit more experimenting, and it turns out that this is related to
using http vs. https URLs. If I access the protected area of my SP
using plain http,
This is expected as the mellon cookie is set with the 'secure' option
the browser will not replay it back on http, so mellon will try again.
What is strange is that you do not get a flat out error, IIRC we
configure mellon with SSLrequireSSL ...
I encounter the redirect loop problem. If I access it
using https, it works fine. The httpd error log on the SP is showing
crashes when the redirect loop occurs. The backtraces vary, but they
all are related to memory issues in mellon/lasso. For example, here are
two different backtraces I encountered:
---------------------------------------------------------------------------------
[Sat Mar 07 16:13:54.938523 2015] [core:notice] [pid 14032] AH00052:
child pid 14047 exit signal Aborted (6)
*** Error in `/usr/sbin/httpd': double free or corruption (out):
0x00007f4d750d8af0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x77d9e)[0x7f4d72df0d9e]
/lib64/libc.so.6(cfree+0x5b5)[0x7f4d72dfc9f5]
/lib64/libxml2.so.2(xmlFreeNodeList+0x1da)[0x7f4d63d5a99a]
/lib64/libxml2.so.2(xmlFreeNodeList+0xce)[0x7f4d63d5a88e]
/lib64/libxml2.so.2(xmlFreeNodeList+0xce)[0x7f4d63d5a88e]
/lib64/libxml2.so.2(xmlFreeNodeList+0xce)[0x7f4d63d5a88e]
/lib64/libxml2.so.2(xmlFreeNodeList+0xce)[0x7f4d63d5a88e]
/lib64/libxml2.so.2(xmlFreeNodeList+0xce)[0x7f4d63d5a88e]
/lib64/libxml2.so.2(xmlFreeDoc+0xb6)[0x7f4d63d5a606]
/lib64/liblasso.so.3(+0x48763)[0x7f4d6519d763]
/lib64/liblasso.so.3(+0x4ee8f)[0x7f4d651a3e8f]
/etc/httpd/modules/mod_auth_mellon.so(am_handler+0x1410)[0x7f4d653db4b0]
/usr/sbin/httpd(ap_run_handler+0x40)[0x7f4d748cb2a0]
/usr/sbin/httpd(ap_invoke_handler+0x69)[0x7f4d748cb7e9]
/usr/sbin/httpd(ap_process_async_request+0x392)[0x7f4d748e0542]
/usr/sbin/httpd(ap_process_request+0x10)[0x7f4d748e06e0]
/usr/sbin/httpd(+0x52012)[0x7f4d748dd012]
/usr/sbin/httpd(ap_run_process_connection+0x40)[0x7f4d748d4b00]
/etc/httpd/modules/mod_mpm_prefork.so(+0x37e0)[0x7f4d68c717e0]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3a30)[0x7f4d68c71a30]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3a92)[0x7f4d68c71a92]
/etc/httpd/modules/mod_mpm_prefork.so(+0x4754)[0x7f4d68c72754]
/usr/sbin/httpd(ap_run_mpm+0x4e)[0x7f4d748b0f4e]
/usr/sbin/httpd(main+0xa76)[0x7f4d748aa496]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7f4d72d98fe0]
/usr/sbin/httpd(+0x1f5ca)[0x7f4d748aa5ca]
[Sun Mar 08 03:14:01.847352 2015] [core:notice] [pid 14032] AH00052:
child pid 14051 exit signal Aborted (6)
*** Error in `/usr/sbin/httpd': corrupted double-linked list:
0x00007f4d75064b30 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x77d9e)[0x7f4d72df0d9e]
/lib64/libc.so.6(+0x80169)[0x7f4d72df9169]
/lib64/libc.so.6(+0x826a4)[0x7f4d72dfb6a4]
/lib64/libc.so.6(realloc+0xee)[0x7f4d72dfd42e]
/lib64/libcrypto.so.10(CRYPTO_realloc+0x50)[0x7f4d667d6480]
/lib64/libcrypto.so.10(BUF_MEM_grow+0x6f)[0x7f4d6684695f]
/lib64/libcrypto.so.10(PEM_read_bio+0x248)[0x7f4d66883558]
/lib64/libcrypto.so.10(PEM_X509_INFO_read_bio+0xda)[0x7f4d668819aa]
/lib64/libcrypto.so.10(X509_load_cert_crl_file+0x49)[0x7f4d66890ad9]
/lib64/libcrypto.so.10(+0x123c22)[0x7f4d66890c22]
/lib64/libcrypto.so.10(X509_STORE_set_default_paths+0x30)[0x7f4d66887b20]
/lib64/libxmlsec1-openssl.so.1(+0x29c81)[0x7f4d64744c81]
/lib64/libxmlsec1.so.1(xmlSecKeyDataStoreCreate+0x48)[0x7f4d644db5d8]
/lib64/libxmlsec1-openssl.so.1(xmlSecOpenSSLKeysMngrInit+0x3d)[0x7f4d6472e49d]
/lib64/libxmlsec1-openssl.so.1(xmlSecOpenSSLAppDefaultKeysMngrInit+0x24)[0x7f4d6472bdb4]
/lib64/liblasso.so.3(+0x1cfea)[0x7f4d65171fea]
/lib64/liblasso.so.3(+0x3f4b3)[0x7f4d651944b3]
/lib64/liblasso.so.3(lasso_server_new_from_buffers+0xcf)[0x7f4d65198a0f]
/etc/httpd/modules/mod_auth_mellon.so(+0x9fff)[0x7f4d653d6fff]
/etc/httpd/modules/mod_auth_mellon.so(am_handler+0x13e8)[0x7f4d653db488]
/usr/sbin/httpd(ap_run_handler+0x40)[0x7f4d748cb2a0]
/usr/sbin/httpd(ap_invoke_handler+0x69)[0x7f4d748cb7e9]
/usr/sbin/httpd(ap_process_async_request+0x392)[0x7f4d748e0542]
/usr/sbin/httpd(ap_process_request+0x10)[0x7f4d748e06e0]
/usr/sbin/httpd(+0x52012)[0x7f4d748dd012]
/usr/sbin/httpd(ap_run_process_connection+0x40)[0x7f4d748d4b00]
/etc/httpd/modules/mod_mpm_prefork.so(+0x37e0)[0x7f4d68c717e0]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3a30)[0x7f4d68c71a30]
/etc/httpd/modules/mod_mpm_prefork.so(+0x3a92)[0x7f4d68c71a92]
/etc/httpd/modules/mod_mpm_prefork.so(+0x4754)[0x7f4d68c72754]
/usr/sbin/httpd(ap_run_mpm+0x4e)[0x7f4d748b0f4e]
/usr/sbin/httpd(main+0xa76)[0x7f4d748aa496]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7f4d72d98fe0]
/usr/sbin/httpd(+0x1f5ca)[0x7f4d748aa5ca]
---------------------------------------------------------------------------------
Looks like we're going to have to chase this down by catching it with a
debugger, or using something like valgrind.
Yep.
And we need a decent suppression file for openssl.
Simo.
>
> I've hit this sort of problem when configuring things by hand and the
> URLs in the SP metadata didn't match up with my httpd config. I'm just
> letting ipsilon-client-install configure everything though, so this
> feels like a bug.
>
> I've attached the SP metadata and the httpd config that
> ipsilon-client-install set up. I'd like to know if anything looks
> amiss. I'm really not sure myself, since I've been manually configuring
> my SPs quite differently.
>
> I have debug logs from the IdP as well, but they are pretty huge due to
> the large number or redirects. They're available here:
>
>
https://nkinder.fedorapeople.org/failure.log
>
> Thanks,
> -NGK
>
> [1]
https://fedoraproject.org/wiki/Test_Day:2015-03-12_Ipsilon
>
>
>
> _______________________________________________
> ipsilon mailing list
> ipsilon(a)lists.fedorahosted.org
>
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>
_______________________________________________
ipsilon mailing list
ipsilon(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/ipsilon
--
Simo Sorce * Red Hat, Inc * New York