Menu
▾
▴
unity-idm-discuss — Unity discussion and support
You can subscribe to this list here.
| 2014 |
Jan
(3) |
Feb
(1) |
Mar
|
Apr
(1) |
May
|
Jun
|
Jul
(2) |
Aug
(2) |
Sep
|
Oct
(3) |
Nov
|
Dec
(1) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2015 |
Jan
(20) |
Feb
(3) |
Mar
|
Apr
|
May
|
Jun
(15) |
Jul
(1) |
Aug
(7) |
Sep
(13) |
Oct
(2) |
Nov
(10) |
Dec
(1) |
| 2016 |
Jan
|
Feb
(2) |
Mar
|
Apr
(2) |
May
(1) |
Jun
|
Jul
(1) |
Aug
(2) |
Sep
(11) |
Oct
(7) |
Nov
(6) |
Dec
(11) |
| 2017 |
Jan
(10) |
Feb
(5) |
Mar
(27) |
Apr
(34) |
May
(25) |
Jun
(14) |
Jul
(7) |
Aug
(17) |
Sep
(11) |
Oct
(6) |
Nov
(14) |
Dec
(10) |
| 2018 |
Jan
(8) |
Feb
(19) |
Mar
(40) |
Apr
(9) |
May
(16) |
Jun
(23) |
Jul
(31) |
Aug
(7) |
Sep
(9) |
Oct
(6) |
Nov
(14) |
Dec
(19) |
| 2019 |
Jan
(4) |
Feb
(6) |
Mar
(1) |
Apr
(2) |
May
(6) |
Jun
(3) |
Jul
|
Aug
|
Sep
|
Oct
(2) |
Nov
(19) |
Dec
(14) |
| 2020 |
Jan
(10) |
Feb
(24) |
Mar
(49) |
Apr
(26) |
May
(12) |
Jun
(4) |
Jul
(13) |
Aug
(32) |
Sep
(13) |
Oct
(10) |
Nov
(4) |
Dec
(16) |
| 2021 |
Jan
(2) |
Feb
(8) |
Mar
(15) |
Apr
(19) |
May
(5) |
Jun
(13) |
Jul
(6) |
Aug
(38) |
Sep
(11) |
Oct
(18) |
Nov
(11) |
Dec
(13) |
| 2022 |
Jan
(10) |
Feb
(21) |
Mar
(28) |
Apr
(3) |
May
(7) |
Jun
(9) |
Jul
(14) |
Aug
(13) |
Sep
(8) |
Oct
(29) |
Nov
(1) |
Dec
(21) |
| 2023 |
Jan
(19) |
Feb
(9) |
Mar
|
Apr
(10) |
May
(7) |
Jun
(10) |
Jul
(14) |
Aug
(17) |
Sep
(1) |
Oct
(9) |
Nov
(5) |
Dec
(14) |
| 2024 |
Jan
(12) |
Feb
(2) |
Mar
(8) |
Apr
(1) |
May
(6) |
Jun
(6) |
Jul
(24) |
Aug
(15) |
Sep
(1) |
Oct
(6) |
Nov
(20) |
Dec
(14) |
| 2025 |
Jan
(12) |
Feb
(2) |
Mar
(10) |
Apr
(11) |
May
(13) |
Jun
(1) |
Jul
(2) |
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Sander A. <sa....@fz...> - 2022-08-01 12:12:04
|
Dear Krzysztof, I found an issue in x500Name identity. It says that GN (givenname) is not supported, while SN (surname) is supported. Could you add GN as well? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-08-01 11:27:28
|
Hi Hubert, W dniu 29.07.2022 o 11:05, Hubert Siejkowski pisze: > Hi, > > we get feedback from our users and two things make us troubles to solve: > > 1. While a user logs in to Unity using the local account and she/he > types a wrong password, both fields username and password are cleared > out. In other systems (e.g. GitHub) only the password is cleared out. > Is there any way to keep the username in the login form from the first > attempt? > Yes, sounds good. There is always a concern that users might be fouled that the username (preserved) was entered correctly, while in fact it has a typo. But at scale most likely the password is most often the problem, so your suggestion makes sense. We will add it in one of upcoming releases (it is trivial). > 2. A user creates an account with remote authentication in an external > system. After some time the user forgets that she/he should use the > external authentication and tries to log in using his username and a > possible password. Of course, the user is denied access but is there > possible to: > - redirect the users to the remote authentication system (best scenario); > - or show information that the authentication should be done in the > remote system given the name or link to the system; > - or at least show information that the login is done via a remote > system? That one is more tricky. I don't think that general feature allowing anyone to enter a username/email and get information on the all possible authentication options for that identity is eligible due to sensitive information exposure. Implementing the first, the most preferred option also requires a major change in authN flow: that Unity first asks for username alone, and only then for password, or allows for choosing option, or just redirects to proper source system. We have some plans around a feature like that, but that would be augmented with server-side configuration, so that admins can control (and take responsibility) how much of authN setup of each account is exposed publiclly. Also this approach has a range of other concerns (e.g. now if I wanted to authN with Google I was one click away from that; after such change I'd need to first enter my email identity...). Anyway long-term we should have a feature like that available. Currently we store this information in a cookie. So if you are returning to Unity from the same browser, you should be automatically presented with your last authN option that you successfully used. Most of the time that works nicely. Best, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2022-08-01 11:12:15
|
Hi Daniel, W dniu 28.07.2022 o 11:03, Fernandez Rodriguez Daniel pisze: > Dear all, > > Ok so my problem was that I assigned "Privileged Inspector" to > sys:AuthorizationRole for my user "*test-user**"* but I did it within > the /unicore/users group and not in Root (/). > After now the mapping works \o/ > > ----------------------------- > > Identities: > - MappedIdentity [mode=CREATE_OR_MATCH, identity=IdentityParam > [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne > (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, > remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo > [confirmed=false, confirmationDate=0, sentRequestAmount=0], > metadata=null], credentialRequirement=Certificate requirement] > Attributes: > - MappedAttribute [mode=CREATE_OR_UPDATE, attribute=name[/]: [danielfr]] > - MappedAttribute [mode=CREATE_OR_UPDATE, > attribute=urn:unicore:attrType:xlogin[/unicore]: [danielfr]] > Groups: > - /unicore/users > > > Thank you very much for your help, > Daniel. Cool, that big upgrade surely was pretty involving. Should be way smoother from now on. Best, Krzysztof |
|
From: Hubert S. <h.s...@cy...> - 2022-07-29 09:23:24
|
Hi, we get feedback from our users and two things make us troubles to solve: 1. While a user logs in to Unity using the local account and she/he types a wrong password, both fields username and password are cleared out. In other systems (e.g. GitHub) only the password is cleared out. Is there any way to keep the username in the login form from the first attempt? 2. A user creates an account with remote authentication in an external system. After some time the user forgets that she/he should use the external authentication and tries to log in using his username and a possible password. Of course, the user is denied access but is there possible to: - redirect the users to the remote authentication system (best scenario); - or show information that the authentication should be done in the remote system given the name or link to the system; - or at least show information that the login is done via a remote system? Our Unity is quite recent (3.8.2). Cheers, Hubert |
|
From: Krzysztof B. <kb...@un...> - 2022-07-28 09:24:25
|
W dniu 22.07.2022 o 13:10, Sander Apweiler pisze: > Hi Krzysztof, > there is an error in unitys Authentication failed error message. The > message says: > "The remote authentication was successful, however the the > server's policy requires more information then was provided to > register your account" > > There is an the to much. It should be: > > "The remote authentication was successful, however the > server's policy requires more information then was provided to > register your account" > Thanks, fixed |
|
From: Fernandez R. D. <dan...@ep...> - 2022-07-28 09:03:38
|
Dear all, Ok so my problem was that I assigned "Privileged Inspector" to sys:AuthorizationRole for my user "test-user" but I did it within the /unicore/users group and not in Root (/). After now the mapping works \o/ ----------------------------- Identities: - MappedIdentity [mode=CREATE_OR_MATCH, identity=IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null], credentialRequirement=Certificate requirement] Attributes: - MappedAttribute [mode=CREATE_OR_UPDATE, attribute=name[/]: [danielfr]] - MappedAttribute [mode=CREATE_OR_UPDATE, attribute=urn:unicore:attrType:xlogin[/unicore]: [danielfr]] Groups: - /unicore/users Thank you very much for your help, Daniel. ________________________________ From: Fernandez Rodriguez Daniel Sent: Wednesday, July 27, 2022 7:00:57 PM To: Krzysztof Benedyczak; uni...@li... Subject: Re: [Unity-idm-discuss] VO-PULL attribute source: CAN'T CONNECT Invalid user name, credential or external authentication failed. Dear Krzysztof and all, Thanks a lot for your answer, I think I made some progress. Long story short, the reason why I could not connect from Unicore to Unity was because the UNICORE/X certificate I am using does not have a CN set (apparently certbot does not set CN https://github.com/certbot/certbot/issues/6463#issuecomment-435151087 so there is nothing I can do...) Because of this, the server’s DN extracted from the certificate was empty and therefore Unity was throwing an "Authentication failed" error. (more info: https://unicore-docs.readthedocs.io/en/latest/admin-docs/unicorex/manual.html#saml-pull-and-unicore-basic-case) So, to workaround this, I created a Unity local user "test-user" and assigned it the “Priviledged Inspector” role. I specify this user and its password in the unicorex/vo.config file, and now there is no error anymore from UnicoreX about connecting to Unity's attribute source. Yay! External connections ******************** Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] Registry: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry ] VO-PULL attribute source: OK [VO-PULL connected to https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService] TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS listens on port 7654]] But still when I try to run a job via Unicore I get: "Access is denied. The operation getPreference requires 'read' capability" in the Unity logs. ==> /opt/unity/logs/unity-server.log <== 2022-07-27T18:44:14,247 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [] INFO unity.server.authn.SessionManagementImpl: Created a new session c1c531fe-d09b-4992-887d-ef0844968aa7 for logged entity danielfr (5) in realm defaultRealm 2022-07-27T18:44:14,324 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] 2022-07-27T18:44:15,722 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [test-user] WARN unity.server.web.IdPPreferences: It was impossible to establish preferences for [x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH for https://bbpcb133.bbp.epfl.ch:8080/BB5-CSCS@defaultRealm will use defaults pl.edu.icm.unity.exceptions.AuthorizationException: Access is denied. The operation getPreference requires 'read' capability ------------------------------- Any idea what else do I need to do? Thank you very much, Daniel. ________________________________ From: Krzysztof Benedyczak <kb...@un...> Sent: Monday, July 18, 2022 5:55:31 PM To: Fernandez Rodriguez Daniel; uni...@li... Subject: Re: [Unity-idm-discuss] VO-PULL attribute source: CAN'T CONNECT Invalid user name, credential or external authentication failed. Hi Daniel, W dniu 15.07.2022 o 16:25, Fernandez Rodriguez Daniel via Unity-idm-discuss pisze: Hello, my name is Daniel, I am an SRE working for the EPFL's BlueBrain project. I inherited a VERY old UNICORE+UNITY (7.13 and unity 2.6.2) server from a colleague who left months ago, and now I am trying to replace it with a new instance running a more up-to-date version of everything. There is NO documentation about what the changes my colleague did but I have access to the old running instance. In the new server I am running the latest version of all packages: unicore-servers-8.3.0-p2 and Unity 3.9.1. This is the authentication workflow we have: - Users get an OIDC token from Keycloak - Use that bearer token to send a request to our Unicore rest API - We configured Unity to use a custom translationProfile and get users information (username) But this is not working in the new server, all services are running (unicoreX, registry, gateway, unity, remote tsi server) but when I try to launch a job it fails. >From the UnicoreX logs I get: ******************** Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] VO-PULL attribute source: CAN'T CONNECT [ERROR: org.apache.cxf.binding.soap.SoapFault: Invalid user name, credential or external authentication failed. ] Registry: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry ] TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS listens on port 7654]] Subsystems *********** User authentication: * Unity with OAuth Bearer token [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] * Unity with username+password [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] User mapping & user attributes: SAMLPullAuthoriser ** Note that both OAuth Bearer token and username+password point to same endpoint. (it was like this is current running system) And from Unity logs in DEBUG: 2022-07-15T15:05:13,108 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.AuthnResponseProcessor: Requested identity urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName, mapped to x500Name, returning identities: [IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null]] 2022-07-15T15:05:13,110 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] 2022-07-15T15:05:13,111 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.BaseResponseProcessor: Processed attributes to be returned: [urn:unicore:attrType:role[/unicore]: [user], name[/]: [danielfr], urn:unicore:attrType:xlogin[/unicore]: [danielfr], memberOf[/]: [/, /unicore, /unicore/users]] 2022-07-15T15:05:13,497 [qtp1546629479-31-acceptor-0@3e3b616-SecuredServerConnector@7352cf80{SSL, (ssl, http/1.1)}{bbpcb144.bbp.epfl.ch:2443}] [] [] DEBUG unicore.connections.SecuredServerConnector: Connection attempt from 10.80.65.154 2022-07-15T15:05:13,683 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.core.ClientIPSettingHandler: Handling client 10.80.65.154 request to URL /unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.rest.AuthenticationInterceptor: Authentication set failed to authenticate the client using flow oauthWS, will try another: pl.edu.icm.unity.engine.api.authn.AuthenticationException: AuthenticationProcessorImpl.authnFailed 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.rest.AuthenticationInterceptor: Authentication failed for client ------------------------------- >From the logs we can assume: - the translation profile works and it is able to map my username (danielfr) from the OIDC token to the x509 identity - auth fails when "using flow oauthWS" This oauthWS flow is defined as: unityServer.core.authenticators.oauthWS.authenticatorName=oauthWS unityServer.core.authenticators.oauthWS.authenticatorType=oauth-rp unityServer.core.authenticators.oauthWS.configurationFile=${CONF}/modules/oauth/remoteOAuth-RP.properties <------ file containing verificationEndpoint, clientID, clientSecret, etc. And this flow is also referenced in unicoreWithOAuthRP.module as: unityServer.core.endpoints.unicoreSOAP.endpointAuthenticators=pwd;oauthWS --- Can you please help me with this? I can of course provide more detailed information or try to answer any question. I am no expert in UNICORE/UNITY but I will try my best. Yes, your findings seems correct. So we can have two cases: 1. Unity gets no token for the failing request in header. UNICORE client config should be checked (or UNICORE support contacted, although Bernd might be on this list as well) 2. Unity gets the token, but fails to verify it. I'd try first to enable TRACE logging for the oauth facility on Unity and also try to look into Keycloak logs. If we are right then something is failing there, hopefully logs will give some clue. Essentially Unity should contact Keycloak to check whether the access token issued from Keycloack is genuine. Best, Krzysztof |
|
From: Fernandez R. D. <dan...@ep...> - 2022-07-27 17:01:13
|
Dear Krzysztof and all, Thanks a lot for your answer, I think I made some progress. Long story short, the reason why I could not connect from Unicore to Unity was because the UNICORE/X certificate I am using does not have a CN set (apparently certbot does not set CN https://github.com/certbot/certbot/issues/6463#issuecomment-435151087 so there is nothing I can do...) Because of this, the server’s DN extracted from the certificate was empty and therefore Unity was throwing an "Authentication failed" error. (more info: https://unicore-docs.readthedocs.io/en/latest/admin-docs/unicorex/manual.html#saml-pull-and-unicore-basic-case) So, to workaround this, I created a Unity local user "test-user" and assigned it the “Priviledged Inspector” role. I specify this user and its password in the unicorex/vo.config file, and now there is no error anymore from UnicoreX about connecting to Unity's attribute source. Yay! External connections ******************** Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] Registry: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry ] VO-PULL attribute source: OK [VO-PULL connected to https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService] TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS listens on port 7654]] But still when I try to run a job via Unicore I get: "Access is denied. The operation getPreference requires 'read' capability" in the Unity logs. ==> /opt/unity/logs/unity-server.log <== 2022-07-27T18:44:14,247 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [] INFO unity.server.authn.SessionManagementImpl: Created a new session c1c531fe-d09b-4992-887d-ef0844968aa7 for logged entity danielfr (5) in realm defaultRealm 2022-07-27T18:44:14,324 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] 2022-07-27T18:44:15,722 [qtp1993606315-61] [UNITY UNICORE SOAP SAML service for REST queries] [test-user] WARN unity.server.web.IdPPreferences: It was impossible to establish preferences for [x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH for https://bbpcb133.bbp.epfl.ch:8080/BB5-CSCS@defaultRealm will use defaults pl.edu.icm.unity.exceptions.AuthorizationException: Access is denied. The operation getPreference requires 'read' capability ------------------------------- Any idea what else do I need to do? Thank you very much, Daniel. ________________________________ From: Krzysztof Benedyczak <kb...@un...> Sent: Monday, July 18, 2022 5:55:31 PM To: Fernandez Rodriguez Daniel; uni...@li... Subject: Re: [Unity-idm-discuss] VO-PULL attribute source: CAN'T CONNECT Invalid user name, credential or external authentication failed. Hi Daniel, W dniu 15.07.2022 o 16:25, Fernandez Rodriguez Daniel via Unity-idm-discuss pisze: Hello, my name is Daniel, I am an SRE working for the EPFL's BlueBrain project. I inherited a VERY old UNICORE+UNITY (7.13 and unity 2.6.2) server from a colleague who left months ago, and now I am trying to replace it with a new instance running a more up-to-date version of everything. There is NO documentation about what the changes my colleague did but I have access to the old running instance. In the new server I am running the latest version of all packages: unicore-servers-8.3.0-p2 and Unity 3.9.1. This is the authentication workflow we have: - Users get an OIDC token from Keycloak - Use that bearer token to send a request to our Unicore rest API - We configured Unity to use a custom translationProfile and get users information (username) But this is not working in the new server, all services are running (unicoreX, registry, gateway, unity, remote tsi server) but when I try to launch a job it fails. >From the UnicoreX logs I get: ******************** Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] VO-PULL attribute source: CAN'T CONNECT [ERROR: org.apache.cxf.binding.soap.SoapFault: Invalid user name, credential or external authentication failed. ] Registry: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry ] TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS listens on port 7654]] Subsystems *********** User authentication: * Unity with OAuth Bearer token [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] * Unity with username+password [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] User mapping & user attributes: SAMLPullAuthoriser ** Note that both OAuth Bearer token and username+password point to same endpoint. (it was like this is current running system) And from Unity logs in DEBUG: 2022-07-15T15:05:13,108 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.AuthnResponseProcessor: Requested identity urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName, mapped to x500Name, returning identities: [IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null]] 2022-07-15T15:05:13,110 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] 2022-07-15T15:05:13,111 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.BaseResponseProcessor: Processed attributes to be returned: [urn:unicore:attrType:role[/unicore]: [user], name[/]: [danielfr], urn:unicore:attrType:xlogin[/unicore]: [danielfr], memberOf[/]: [/, /unicore, /unicore/users]] 2022-07-15T15:05:13,497 [qtp1546629479-31-acceptor-0@3e3b616-SecuredServerConnector@7352cf80{SSL, (ssl, http/1.1)}{bbpcb144.bbp.epfl.ch:2443}] [] [] DEBUG unicore.connections.SecuredServerConnector: Connection attempt from 10.80.65.154 2022-07-15T15:05:13,683 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.core.ClientIPSettingHandler: Handling client 10.80.65.154 request to URL /unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.rest.AuthenticationInterceptor: Authentication set failed to authenticate the client using flow oauthWS, will try another: pl.edu.icm.unity.engine.api.authn.AuthenticationException: AuthenticationProcessorImpl.authnFailed 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.rest.AuthenticationInterceptor: Authentication failed for client ------------------------------- >From the logs we can assume: - the translation profile works and it is able to map my username (danielfr) from the OIDC token to the x509 identity - auth fails when "using flow oauthWS" This oauthWS flow is defined as: unityServer.core.authenticators.oauthWS.authenticatorName=oauthWS unityServer.core.authenticators.oauthWS.authenticatorType=oauth-rp unityServer.core.authenticators.oauthWS.configurationFile=${CONF}/modules/oauth/remoteOAuth-RP.properties <------ file containing verificationEndpoint, clientID, clientSecret, etc. And this flow is also referenced in unicoreWithOAuthRP.module as: unityServer.core.endpoints.unicoreSOAP.endpointAuthenticators=pwd;oauthWS --- Can you please help me with this? I can of course provide more detailed information or try to answer any question. I am no expert in UNICORE/UNITY but I will try my best. Yes, your findings seems correct. So we can have two cases: 1. Unity gets no token for the failing request in header. UNICORE client config should be checked (or UNICORE support contacted, although Bernd might be on this list as well) 2. Unity gets the token, but fails to verify it. I'd try first to enable TRACE logging for the oauth facility on Unity and also try to look into Keycloak logs. If we are right then something is failing there, hopefully logs will give some clue. Essentially Unity should contact Keycloak to check whether the access token issued from Keycloack is genuine. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-07-22 11:11:10
|
Hi Krzysztof, there is an error in unitys Authentication failed error message. The message says: "The remote authentication was successful, however the the server's policy requires more information then was provided to register your account" There is an the to much. It should be: "The remote authentication was successful, however the server's policy requires more information then was provided to register your account" Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-07-18 15:55:52
|
Hi Daniel, W dniu 15.07.2022 o 16:25, Fernandez Rodriguez Daniel via Unity-idm-discuss pisze: > > Hello, > > > my name is Daniel, I am an SRE working for the EPFL's BlueBrain project. > > > I inherited a VERY old UNICORE+UNITY (7.13 and unity 2.6.2) server > from a colleague who left months ago, and now I am trying to replace > it with a new instance running a more up-to-date version of everything. > > > There is NO documentation about what the changes my colleague did but > I have access to the old running instance. > > > In the new server I am running the latest version of all packages: > unicore-servers-8.3.0-p2 and Unity 3.9.1. > > > This is the authentication workflow we have: > > - Users get an OIDC token from Keycloak > > - Use that bearer token to send a request to our Unicore rest API > > - We configured Unity to use a custom translationProfile and get users > information (username) > > > But this is not working in the new server, all services are running > (unicoreX, registry, gateway, unity, remote tsi server) but when I try > to launch a job it fails. > > > From the UnicoreX logs I get: > > > ******************** > Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] > VO-PULL attribute source: CAN'T CONNECT [ERROR: > org.apache.cxf.binding.soap.SoapFault: Invalid user name, credential > or external authentication failed. ] > Registry: OK [connected to > https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry > ] > TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS > listens on port 7654]] > > Subsystems > *********** > User authentication: > * Unity with OAuth Bearer token > [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] > * Unity with username+password > [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] > User mapping & user attributes: SAMLPullAuthoriser > > *** Note* that both OAuth Bearer token and username+password point to > same endpoint. (it was like this is current running system) > > And from Unity logs in DEBUG: > > 2022-07-15T15:05:13,108 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] DEBUG > unity.server.saml.AuthnResponseProcessor: Requested identity > urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName, mapped to > x500Name, returning identities: [IdentityParam [[x500Name] > CN=danielfr, O=Ecole polytechnique federale de Lausanne > (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, > remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo > [confirmed=false, confirmationDate=0, sentRequestAmount=0], > metadata=null]] > 2022-07-15T15:05:13,110 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] INFO > unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam > [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne > (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, > remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo > [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] > 2022-07-15T15:05:13,111 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] DEBUG > unity.server.saml.BaseResponseProcessor: Processed attributes to be > returned: [urn:unicore:attrType:role[/unicore]: [user], name[/]: > [danielfr], urn:unicore:attrType:xlogin[/unicore]: [danielfr], > memberOf[/]: [/, /unicore, /unicore/users]] > 2022-07-15T15:05:13,497 > [qtp1546629479-31-acceptor-0@3e3b616-SecuredServerConnector@7352cf80{SSL, > (ssl, http/1.1)}{bbpcb144.bbp.epfl.ch:2443}] [] [] DEBUG > unicore.connections.SecuredServerConnector: Connection attempt from > 10.80.65.154 > 2022-07-15T15:05:13,683 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] DEBUG > unity.server.core.ClientIPSettingHandler: Handling client 10.80.65.154 > request to URL /unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService > 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] DEBUG > unity.server.rest.AuthenticationInterceptor: Authentication set failed > to authenticate the client using flow oauthWS, will try another: > pl.edu.icm.unity.engine.api.authn.AuthenticationException: > AuthenticationProcessorImpl.authnFailed > 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML > service for REST queries] [danielfr] INFO > unity.server.rest.AuthenticationInterceptor: Authentication failed for > client > > ------------------------------- > > From the logs we can assume: > - the translation profile works and it is able to map my username > (danielfr) from the OIDC token to the x509 identity > - *auth fails when "using flow oauthWS" > * > > This oauthWS flow is defined as: > > > unityServer.core.authenticators.oauthWS.authenticatorName=oauthWS > unityServer.core.authenticators.oauthWS.authenticatorType=oauth-rp > unityServer.core.authenticators.oauthWS.configurationFile=${CONF}/modules/oauth/remoteOAuth-RP.properties > <------ file containing verificationEndpoint, clientID, clientSecret, etc. > > And this flow is also referenced in unicoreWithOAuthRP.module as: > > unityServer.core.endpoints.unicoreSOAP.endpointAuthenticators=pwd;oauthWS > > --- > > Can you please help me with this? I can of course provide more > detailed information or try to answer any question. > I am no expert in UNICORE/UNITY but I will try my best. > Yes, your findings seems correct. So we can have two cases: 1. Unity gets no token for the failing request in header. UNICORE client config should be checked (or UNICORE support contacted, although Bernd might be on this list as well) 2. Unity gets the token, but fails to verify it. I'd try first to enable TRACE logging for the oauth facility on Unity and also try to look into Keycloak logs. If we are right then something is failing there, hopefully logs will give some clue. Essentially Unity should contact Keycloak to check whether the access token issued from Keycloack is genuine. Best, Krzysztof |
|
From: Fernandez R. D. <dan...@ep...> - 2022-07-15 14:26:09
|
Hello, my name is Daniel, I am an SRE working for the EPFL's BlueBrain project. I inherited a VERY old UNICORE+UNITY (7.13 and unity 2.6.2) server from a colleague who left months ago, and now I am trying to replace it with a new instance running a more up-to-date version of everything. There is NO documentation about what the changes my colleague did but I have access to the old running instance. In the new server I am running the latest version of all packages: unicore-servers-8.3.0-p2 and Unity 3.9.1. This is the authentication workflow we have: - Users get an OIDC token from Keycloak - Use that bearer token to send a request to our Unicore rest API - We configured Unity to use a custom translationProfile and get users information (username) But this is not working in the new server, all services are running (unicoreX, registry, gateway, unity, remote tsi server) but when I try to launch a job it fails. >From the UnicoreX logs I get: ******************** Gateway: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/BB5-CSCS] VO-PULL attribute source: CAN'T CONNECT [ERROR: org.apache.cxf.binding.soap.SoapFault: Invalid user name, credential or external authentication failed. ] Registry: OK [connected to https://bbpcb144.bbp.epfl.ch:8080/REGISTRY/services/Registry?res=default_registry ] TSI 1: OK [TSI v8.0.0 (1/1 nodes up) at bbpv2.epfl.ch:4433, XNJS listens on port 7654]] Subsystems *********** User authentication: * Unity with OAuth Bearer token [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] * Unity with username+password [https://bbpcb144.bbp.epfl.ch:2443/unicore-soapidp/saml2unicoreidp-soap/AuthenticationService] User mapping & user attributes: SAMLPullAuthoriser ** Note that both OAuth Bearer token and username+password point to same endpoint. (it was like this is current running system) And from Unity logs in DEBUG: 2022-07-15T15:05:13,108 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.AuthnResponseProcessor: Requested identity urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName, mapped to x500Name, returning identities: [IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null]] 2022-07-15T15:05:13,110 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.saml.SAMLETDAuthnImpl: Authentication of IdentityParam [[x500Name] CN=danielfr, O=Ecole polytechnique federale de Lausanne (EPFL),L=Lausanne,ST=Vaud,C=CH, translationProfile=keycloak2UNICORE, remoteIdp=oauth-rp, confirmationInfo=ConfirmationInfo [confirmed=false, confirmationDate=0, sentRequestAmount=0], metadata=null] 2022-07-15T15:05:13,111 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.saml.BaseResponseProcessor: Processed attributes to be returned: [urn:unicore:attrType:role[/unicore]: [user], name[/]: [danielfr], urn:unicore:attrType:xlogin[/unicore]: [danielfr], memberOf[/]: [/, /unicore, /unicore/users]] 2022-07-15T15:05:13,497 [qtp1546629479-31-acceptor-0@3e3b616-SecuredServerConnector@7352cf80{SSL, (ssl, http/1.1)}{bbpcb144.bbp.epfl.ch:2443}] [] [] DEBUG unicore.connections.SecuredServerConnector: Connection attempt from 10.80.65.154 2022-07-15T15:05:13,683 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.core.ClientIPSettingHandler: Handling client 10.80.65.154 request to URL /unicore-soapidp/saml2unicoreidp-soap/AssertionQueryService 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] DEBUG unity.server.rest.AuthenticationInterceptor: Authentication set failed to authenticate the client using flow oauthWS, will try another: pl.edu.icm.unity.engine.api.authn.AuthenticationException: AuthenticationProcessorImpl.authnFailed 2022-07-15T15:05:13,733 [qtp1546629479-33] [UNITY UNICORE SOAP SAML service for REST queries] [danielfr] INFO unity.server.rest.AuthenticationInterceptor: Authentication failed for client ------------------------------- >From the logs we can assume: - the translation profile works and it is able to map my username (danielfr) from the OIDC token to the x509 identity - auth fails when "using flow oauthWS" This oauthWS flow is defined as: unityServer.core.authenticators.oauthWS.authenticatorName=oauthWS unityServer.core.authenticators.oauthWS.authenticatorType=oauth-rp unityServer.core.authenticators.oauthWS.configurationFile=${CONF}/modules/oauth/remoteOAuth-RP.properties <------ file containing verificationEndpoint, clientID, clientSecret, etc. And this flow is also referenced in unicoreWithOAuthRP.module as: unityServer.core.endpoints.unicoreSOAP.endpointAuthenticators=pwd;oauthWS --- Can you please help me with this? I can of course provide more detailed information or try to answer any question. I am no expert in UNICORE/UNITY but I will try my best. Thank you, Daniel. |
|
From: Krzysztof B. <kb...@un...> - 2022-07-15 09:07:37
|
Hi, W dniu 13.07.2022 o 15:37, Sander Apweiler pisze: > Hi Krzysztof, > the refresh token rotation mechanism would be a suitable solution for > the application and it would be great to get this into unity. You might > know the next question. When could it be available? Makes sense - I'm adding it to our backlog. Re timing - let's sync up separately - I have bunch of questions around relative priority of various tasks we have from your side in our queue. There is also a potential for this work in HIFIS context. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-07-13 13:38:12
|
Hi Krzysztof, the refresh token rotation mechanism would be a suitable solution for the application and it would be great to get this into unity. You might know the next question. When could it be available? Best regards, Sander On Thu, 2022-07-07 at 09:58 +0200, Krzysztof Benedyczak wrote: > Hi Sander, > > W dniu 07.07.2022 o 07:46, Sander Apweiler pisze: > > Good morning Krzysztof, > > Good morning Roman, > > > > one of our connected services is a single page application using > > OIDC > > with PKCE. They asked for a possibility to fetch new tokens using > > the > > refresh token, without authenticating the client. Reading the > > documentation, this is not possible. > > > > What is your opinion to this? Do you see another solution to their > > problem getting new tokens without sendign client credentials? > > So yes, as of now for public clients Unity blocks the refresh token > flow. > > Enabling that is not a big deal, but essentially means that we would > have to lift bunch of very important security protections. > > When it comes to PKCE+refresh tokens use, the industry standard is to > use one additional feature, which is called "refresh token rotation". > This one is not that super easy to implement - not super hard either, > but a noticeable amount of work. Surely we can put it on our roadmap > if > you have a decent use case. > > Best, > Krzysztof > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-07-12 07:38:14
|
Hi Sander, W dniu 08.07.2022 o 10:53, Sander Apweiler pisze: > Hi Krzysztof, > hi Roman, > > is there a way to confirm multiple email address, provided by the IdP > in input translation profiles, like attr["emailAddress"] + > "[CONFIRMED]". Just using attrs would not work. Do I need to build a > loop over the provided emails and confirm them one by one and return an > array of confirmed email addresses? Yes, precisely :-) You need to output MVEL array of confirmed email addresses, i.e. end result should be like this: |['fo...@ex...[CONFIRMED]', 'ba...@ex...[CONFIRMED]']| HTH, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-07-08 08:53:54
|
Hi Krzysztof, hi Roman, is there a way to confirm multiple email address, provided by the IdP in input translation profiles, like attr["emailAddress"] + "[CONFIRMED]". Just using attrs would not work. Do I need to build a loop over the provided emails and confirm them one by one and return an array of confirmed email addresses? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Roman K. <ro...@un...> - 2022-07-07 09:57:23
|
Hi Sander, Sorry to be long in my reply, this is to let you know that we have reproduced the problem, and are working on it. Currently it is scheduled for 3.10.0 release. The only workaround till then is to restart unity after logging configuration is changed. Thank you, Roman czw., 30 cze 2022 o 07:09 Sander Apweiler <sa....@fz...> napisał(a): > Good morning Roman, > I attached our log config file. We changed the Root Level from DEBUG to > TRACE and from TRACE to DEBUG. In both cases the logging stopped and > nothing was written to the file or the log rotation was not done for > several days. > > Best regards, > Sander > > On Wed, 2022-06-29 at 16:43 +0200, Roman Krysiński wrote: > > Hi Sander, > > > > Could you please provide the log config file with information about > > what changes were made? > > > > Thank you, > > Roman > > > > wt., 28 cze 2022 o 14:48 Sander Apweiler <sa....@fz...> > > napisał(a): > > > Hi Krzysztof, > > > hi Roman, > > > > > > we might have found a serious bug in unity. When we change the root > > > loglevel and do not restart unity, it stops logging. We have > > > reproduced > > > this issue. Unity itself is running without any further problems, > > > but > > > we don't have any log entries since changing the log level. > > > > > > Best regards, > > > Sander > > -- > Federated Systems and Data > Juelich Supercomputing Centre > > phone: +49 2461 61 8847 > fax: +49 2461 61 6656 > email: sa....@fz... > > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > Forschungszentrum Juelich GmbH > 52425 Juelich > Sitz der Gesellschaft: Juelich > Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 > Vorsitzender des Aufsichtsrats: MinDir Volker Rieke > Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), > Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, > Prof. Dr. Frauke Melchior > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > > > > > |
|
From: Krzysztof B. <kb...@un...> - 2022-07-07 07:59:04
|
Hi Sander, W dniu 07.07.2022 o 07:46, Sander Apweiler pisze: > Good morning Krzysztof, > Good morning Roman, > > one of our connected services is a single page application using OIDC > with PKCE. They asked for a possibility to fetch new tokens using the > refresh token, without authenticating the client. Reading the > documentation, this is not possible. > > What is your opinion to this? Do you see another solution to their > problem getting new tokens without sendign client credentials? So yes, as of now for public clients Unity blocks the refresh token flow. Enabling that is not a big deal, but essentially means that we would have to lift bunch of very important security protections. When it comes to PKCE+refresh tokens use, the industry standard is to use one additional feature, which is called "refresh token rotation". This one is not that super easy to implement - not super hard either, but a noticeable amount of work. Surely we can put it on our roadmap if you have a decent use case. Best, Krzysztof |
|
From: Sander A. <sa....@fz...> - 2022-07-07 05:46:51
|
Good morning Krzysztof, Good morning Roman, one of our connected services is a single page application using OIDC with PKCE. They asked for a possibility to fetch new tokens using the refresh token, without authenticating the client. Reading the documentation, this is not possible. What is your opinion to this? Do you see another solution to their problem getting new tokens without sendign client credentials? Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2022-06-30 05:09:28
|
Good morning Roman, I attached our log config file. We changed the Root Level from DEBUG to TRACE and from TRACE to DEBUG. In both cases the logging stopped and nothing was written to the file or the log rotation was not done for several days. Best regards, Sander On Wed, 2022-06-29 at 16:43 +0200, Roman Krysiński wrote: > Hi Sander, > > Could you please provide the log config file with information about > what changes were made? > > Thank you, > Roman > > wt., 28 cze 2022 o 14:48 Sander Apweiler <sa....@fz...> > napisał(a): > > Hi Krzysztof, > > hi Roman, > > > > we might have found a serious bug in unity. When we change the root > > loglevel and do not restart unity, it stops logging. We have > > reproduced > > this issue. Unity itself is running without any further problems, > > but > > we don't have any log entries since changing the log level. > > > > Best regards, > > Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Roman K. <ro...@un...> - 2022-06-29 14:43:44
|
Hi Sander, Could you please provide the log config file with information about what changes were made? Thank you, Roman wt., 28 cze 2022 o 14:48 Sander Apweiler <sa....@fz...> napisał(a): > Hi Krzysztof, > hi Roman, > > we might have found a serious bug in unity. When we change the root > loglevel and do not restart unity, it stops logging. We have reproduced > this issue. Unity itself is running without any further problems, but > we don't have any log entries since changing the log level. > > Best regards, > Sander > -- > Federated Systems and Data > Juelich Supercomputing Centre > > phone: +49 2461 61 8847 > fax: +49 2461 61 6656 > email: sa....@fz... > > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > Forschungszentrum Juelich GmbH > 52425 Juelich > Sitz der Gesellschaft: Juelich > Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 > Vorsitzender des Aufsichtsrats: MinDir Volker Rieke > Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), > Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, > Prof. Dr. Frauke Melchior > ----------------------------------------------------------------------- > ----------------------------------------------------------------------- > > > > > _______________________________________________ > Unity-idm-discuss mailing list > Uni...@li... > https://lists.sourceforge.net/lists/listinfo/unity-idm-discuss > |
|
From: Sander A. <sa....@fz...> - 2022-06-28 12:48:44
|
Hi Krzysztof, hi Roman, we might have found a serious bug in unity. When we change the root loglevel and do not restart unity, it stops logging. We have reproduced this issue. Unity itself is running without any further problems, but we don't have any log entries since changing the log level. Best regards, Sander -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Krzysztof B. <kb...@un...> - 2022-06-08 07:31:12
|
Hi Sander, W dniu 31.05.2022 o 13:16, Krzysztof Benedyczak pisze: >> 4. Is schema and mapping definition only online possible? I assume yes. > > No, you can also do it with config file. However, we haven't > documented the JSON format :-). > > It is so complex that I think it is anyway the only way to do it with > a help of proper UI. > > Still if you want to eventually have this file configured we can > easily add an option to export schema with mapping as a file. Then it > would be only pointed in the configuration. How does it sound? > > BTW note that in UI you can import schema file (w/o mappings) already. In case you missed that: in 3.9.1 the export feature mentioned above is already available. HTH, Krzysztof |
|
From: Krzysztof B. <kb...@un...> - 2022-06-07 10:51:21
|
Dear Subscribers,
A new release was published with the following content:
* We have delivered further SAML performance optimizations which are
based on the groundwork of the 3.9.0 release. Currently speed of
loading, refreshing and handling of even super-large SAML
federations should be excellent. We are finally happy with
performance of this area now.
* Export of SCIM schema (together with mapping) was added. It can be
used in a file configuration
* Spring dependency with a serious (but rather not relevant for Unity)
security vulnerability was upgraded – to be on the safe side.
* Few minor bugs were fixed
All relevant assets are available at
https://unity-idm.eu/releases/release-3-9-1
Best regards,
Krzysztof
|
|
From: Sander A. <sa....@fz...> - 2022-06-07 05:38:31
|
Good morning Krzysztof, today it works fine as expected. I assume that the IdP did still use the old certificate, although the admin said they updated it. Best regards, Sander On Fri, 2022-06-03 at 13:45 +0200, Sander Apweiler wrote: > Hi Krzysztof, > we updated our certificate today and splittet web part and SAML > signing > part into two different certificates. While the Webserver part and > the > SAML part in direction to SPs is working fine, I got errors while > trying to login with our IdP. I see an unable to find a decryption > key > error in the logs. The IdP admin said, he already fetched the new > federation metadata which contains the new signing certificate. Do > you > know some other reasons for the problem? Stacktrace and config is > below. > > Cheers, > Sander > > pki.properties: > unity.pki.credentials.SAML.format=pkcs12 > unity.pki.credentials.SAML.path=/usr/local/unity/pki/b2access.eudat.e > u_SAML.p12 > unity.pki.credentials.SAML.keyAlias=saml > unity.pki.credentials.SAML.password=******** > unity.pki.truststores.SAML.type=directory > unity.pki.truststores.SAML.allowProxy=DENY > unity.pki.truststores.SAML.directoryLocations.1=/usr/local/unity/cert > s/* > unity.pki.truststores.SAML.crlLocations.1=/etc/grid- > security/certificates/*.crl > unity.pki.truststores.SAML.directoryEncoding=PEM > unity.pki.truststores.SAML.crlUpdateInterval=400 > > remoteSamlAuth.properties: > unity.saml.requester.requesterCredential=SAML > > > 2022-06-03T13:36:27,462 [qtp1691841404-39] ERROR > org.apache.xml.security.encryption.XMLCipher: > XMLCipher::decryptElement unable to resolve a decryption key > 2022-06-03T13:36:27,462 [qtp1691841404-39] INFO > unity.server.saml.SAMLResponseVerificator: SAML response verification > or processing failed > pl.edu.icm.unity.engine.api.authn.RemoteAuthenticationException: The > SAML response is either invalid or is issued by an untrusted identity > provider. > at > pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SA > MLResponseValidatorUtil.java:89) ~[unity-server-saml-3.8.1.jar:?] > at > pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.getRemotelyAuthentic > atedInput(SAMLResponseVerificator.java:118) ~[unity-server-saml- > 3.8.1.jar:?] > at > pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.verifySAMLResponse(S > AMLResponseVerificator.java:88) ~[unity-server-saml-3.8.1.jar:?] > at > pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.processResponse(SAML > ResponseVerificator.java:75) ~[unity-server-saml-3.8.1.jar:?] > at > pl.edu.icm.unity.saml.sp.SAMLVerificator.processResponse(SAMLVerifica > tor.java:289) ~[unity-server-saml-3.8.1.jar:?] > at > pl.edu.icm.unity.engine.api.authn.remote.RedirectedAuthnState.process > Answer(RedirectedAuthnState.java:99) ~[unity-server-engine-api- > 3.8.1.jar:?] > at > pl.edu.icm.unity.engine.authn.remote.RemoteAuthnResponseProcessorImpl > .processResponseInProductionMode(RemoteAuthnResponseProcessorImpl.jav > a:62) ~[unity-server-engine-3.8.1.jar:?] > at > pl.edu.icm.unity.engine.authn.remote.RemoteAuthnResponseProcessorImpl > .processResponse(RemoteAuthnResponseProcessorImpl.java:52) ~[unity- > server-engine-3.8.1.jar:?] > at > pl.edu.icm.unity.webui.authn.remote.RemoteRedirectedAuthnResponseProc > essingFilter.doFilter(RemoteRedirectedAuthnResponseProcessingFilter.j > ava:78) ~[unity-server-web-common-3.8.1.jar:?] > at > org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193 > ) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandle > r.java:1601) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java > :548) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandl > er.java:233) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandl > er.java:1624) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandl > er.java:233) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandl > er.java:1434) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandle > r.java:188) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java: > 501) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandle > r.java:1594) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandle > r.java:186) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandle > r.java:1349) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.j > ava:141) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper > .java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > pl.edu.icm.unity.engine.server.ClientIPSettingHandler.handle(ClientIP > SettingHandler.java:68) ~[unity-server-engine-3.8.1.jar:?] > at > org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(Cont > extHandlerCollection.java:234) ~[jetty-server- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper > .java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandle > r.java:322) ~[jetty-rewrite-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler. > java:763) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper > .java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at org.eclipse.jetty.server.Server.handle(Server.java:516) > ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > pl.edu.icm.unity.engine.server.JettyServer$1.handle(JettyServer.java: > 216) ~[unity-server-engine-3.8.1.jar:?] > at > org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java > :400) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:645) > [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:392) > [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.jav > a:277) [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(Abstra > ctConnection.java:311) [jetty-io- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) > [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(S > slConnection.java:555) [jetty-io- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java: > 410) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java > :164) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) > [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) > [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhat > YouKill.java:338) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWh > atYouKill.java:315) [jetty-util- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatW > hatYouKill.java:173) [jetty-util- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouK > ill.java:131) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.r > un(ReservedThreadExecutor.java:409) [jetty-util- > 9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPoo > l.java:883) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927] > at > org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThrea > dPool.java:1034) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927] > at java.lang.Thread.run(Thread.java:829) [?:?] > Caused by: eu.unicore.samly2.exceptions.SAMLValidationException: XML > handling problem during retrieval of response assertions > at > eu.unicore.samly2.validators.SSOAuthnResponseValidator.validate(SSOAu > thnResponseValidator.java:97) ~[samly2-2.7.1.jar:?] > at > pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SA > MLResponseValidatorUtil.java:86) ~[unity-server-saml-3.8.1.jar:?] > ... 49 more > Caused by: org.apache.xml.security.encryption.XMLEncryptionException: > encryption.nokey > at > org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(XMLCi > pher.java:1746) ~[xmlsec-2.2.2.jar:2.2.2] > at > org.apache.xml.security.encryption.XMLCipher.decryptElement(XMLCipher > .java:1662) ~[xmlsec-2.2.2.jar:2.2.2] > at > org.apache.xml.security.encryption.XMLCipher.doFinal(XMLCipher.java:9 > 46) ~[xmlsec-2.2.2.jar:2.2.2] > at > eu.unicore.security.enc.EncryptionUtil.decrypt(EncryptionUtil.java:53 > ) ~[samly2-2.7.1.jar:?] > at > eu.unicore.samly2.assertion.AssertionParser.<init>(AssertionParser.ja > va:74) ~[samly2-2.7.1.jar:?] > at > eu.unicore.samly2.SAMLUtils.extractAllAssertions(SAMLUtils.java:204) > ~[samly2-2.7.1.jar:?] > at > eu.unicore.samly2.validators.SSOAuthnResponseValidator.validate(SSOAu > thnResponseValidator.java:94) ~[samly2-2.7.1.jar:?] > at > pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SA > MLResponseValidatorUtil.java:86) ~[unity-server-saml-3.8.1.jar:?] > ... 49 more > 2022-06-03T13:36:27,463 [qtp1691841404-39] INFO > unity.server.authn.InteractiveAuthneticationProcessorImpl: > Authentication failure: AuthenticationProcessorImpl.authnFailed deny > > -- Federated Systems and Data Juelich Supercomputing Centre phone: +49 2461 61 8847 fax: +49 2461 61 6656 email: sa....@fz... ----------------------------------------------------------------------- ----------------------------------------------------------------------- Forschungszentrum Juelich GmbH 52425 Juelich Sitz der Gesellschaft: Juelich Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498 Vorsitzender des Aufsichtsrats: MinDir Volker Rieke Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender), Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht, Prof. Dr. Frauke Melchior ----------------------------------------------------------------------- ----------------------------------------------------------------------- |
|
From: Sander A. <sa....@fz...> - 2022-06-03 11:45:40
|
Hi Krzysztof,
we updated our certificate today and splittet web part and SAML signing
part into two different certificates. While the Webserver part and the
SAML part in direction to SPs is working fine, I got errors while
trying to login with our IdP. I see an unable to find a decryption key
error in the logs. The IdP admin said, he already fetched the new
federation metadata which contains the new signing certificate. Do you
know some other reasons for the problem? Stacktrace and config is
below.
Cheers,
Sander
pki.properties:
unity.pki.credentials.SAML.format=pkcs12
unity.pki.credentials.SAML.path=/usr/local/unity/pki/b2access.eudat.eu_SAML.p12
unity.pki.credentials.SAML.keyAlias=saml
unity.pki.credentials.SAML.password=********
unity.pki.truststores.SAML.type=directory
unity.pki.truststores.SAML.allowProxy=DENY
unity.pki.truststores.SAML.directoryLocations.1=/usr/local/unity/certs/*
unity.pki.truststores.SAML.crlLocations.1=/etc/grid-security/certificates/*.crl
unity.pki.truststores.SAML.directoryEncoding=PEM
unity.pki.truststores.SAML.crlUpdateInterval=400
remoteSamlAuth.properties:
unity.saml.requester.requesterCredential=SAML
2022-06-03T13:36:27,462 [qtp1691841404-39] ERROR org.apache.xml.security.encryption.XMLCipher: XMLCipher::decryptElement unable to resolve a decryption key
2022-06-03T13:36:27,462 [qtp1691841404-39] INFO unity.server.saml.SAMLResponseVerificator: SAML response verification or processing failed
pl.edu.icm.unity.engine.api.authn.RemoteAuthenticationException: The SAML response is either invalid or is issued by an untrusted identity provider.
at pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SAMLResponseValidatorUtil.java:89) ~[unity-server-saml-3.8.1.jar:?]
at pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.getRemotelyAuthenticatedInput(SAMLResponseVerificator.java:118) ~[unity-server-saml-3.8.1.jar:?]
at pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.verifySAMLResponse(SAMLResponseVerificator.java:88) ~[unity-server-saml-3.8.1.jar:?]
at pl.edu.icm.unity.saml.sp.SAMLResponseVerificator.processResponse(SAMLResponseVerificator.java:75) ~[unity-server-saml-3.8.1.jar:?]
at pl.edu.icm.unity.saml.sp.SAMLVerificator.processResponse(SAMLVerificator.java:289) ~[unity-server-saml-3.8.1.jar:?]
at pl.edu.icm.unity.engine.api.authn.remote.RedirectedAuthnState.processAnswer(RedirectedAuthnState.java:99) ~[unity-server-engine-api-3.8.1.jar:?]
at pl.edu.icm.unity.engine.authn.remote.RemoteAuthnResponseProcessorImpl.processResponseInProductionMode(RemoteAuthnResponseProcessorImpl.java:62) ~[unity-server-engine-3.8.1.jar:?]
at pl.edu.icm.unity.engine.authn.remote.RemoteAuthnResponseProcessorImpl.processResponse(RemoteAuthnResponseProcessorImpl.java:52) ~[unity-server-engine-3.8.1.jar:?]
at pl.edu.icm.unity.webui.authn.remote.RemoteRedirectedAuthnResponseProcessingFilter.doFilter(RemoteRedirectedAuthnResponseProcessingFilter.java:78) ~[unity-server-web-common-3.8.1.jar:?]
at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501) ~[jetty-servlet-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at pl.edu.icm.unity.engine.server.ClientIPSettingHandler.handle(ClientIPSettingHandler.java:68) ~[unity-server-engine-3.8.1.jar:?]
at org.eclipse.jetty.server.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:234) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.rewrite.handler.RewriteHandler.handle(RewriteHandler.java:322) ~[jetty-rewrite-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:763) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.Server.handle(Server.java:516) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at pl.edu.icm.unity.engine.server.JettyServer$1.handle(JettyServer.java:216) ~[unity-server-engine-3.8.1.jar:?]
at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:400) ~[jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:645) [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:392) [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277) [jetty-server-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:555) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:410) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:164) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104) [jetty-io-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:409) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034) [jetty-util-9.4.44.v20210927.jar:9.4.44.v20210927]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: eu.unicore.samly2.exceptions.SAMLValidationException: XML handling problem during retrieval of response assertions
at eu.unicore.samly2.validators.SSOAuthnResponseValidator.validate(SSOAuthnResponseValidator.java:97) ~[samly2-2.7.1.jar:?]
at pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SAMLResponseValidatorUtil.java:86) ~[unity-server-saml-3.8.1.jar:?]
... 49 more
Caused by: org.apache.xml.security.encryption.XMLEncryptionException: encryption.nokey
at org.apache.xml.security.encryption.XMLCipher.decryptToByteArray(XMLCipher.java:1746) ~[xmlsec-2.2.2.jar:2.2.2]
at org.apache.xml.security.encryption.XMLCipher.decryptElement(XMLCipher.java:1662) ~[xmlsec-2.2.2.jar:2.2.2]
at org.apache.xml.security.encryption.XMLCipher.doFinal(XMLCipher.java:946) ~[xmlsec-2.2.2.jar:2.2.2]
at eu.unicore.security.enc.EncryptionUtil.decrypt(EncryptionUtil.java:53) ~[samly2-2.7.1.jar:?]
at eu.unicore.samly2.assertion.AssertionParser.<init>(AssertionParser.java:74) ~[samly2-2.7.1.jar:?]
at eu.unicore.samly2.SAMLUtils.extractAllAssertions(SAMLUtils.java:204) ~[samly2-2.7.1.jar:?]
at eu.unicore.samly2.validators.SSOAuthnResponseValidator.validate(SSOAuthnResponseValidator.java:94) ~[samly2-2.7.1.jar:?]
at pl.edu.icm.unity.saml.SAMLResponseValidatorUtil.verifySAMLResponse(SAMLResponseValidatorUtil.java:86) ~[unity-server-saml-3.8.1.jar:?]
... 49 more
2022-06-03T13:36:27,463 [qtp1691841404-39] INFO unity.server.authn.InteractiveAuthneticationProcessorImpl: Authentication failure: AuthenticationProcessorImpl.authnFailed deny
--
Federated Systems and Data
Juelich Supercomputing Centre
phone: +49 2461 61 8847
fax: +49 2461 61 6656
email: sa....@fz...
-----------------------------------------------------------------------
-----------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht,
Prof. Dr. Frauke Melchior
-----------------------------------------------------------------------
-----------------------------------------------------------------------
|
|
From: Krzysztof B. <kb...@un...> - 2022-06-02 09:15:42
|
Good morning Sander, W dniu 02.06.2022 o 10:57, Sander Apweiler pisze: > Good morning Krzysztof, > thanks again for the information. It is working for password > authentication. Now we want to enable it for OAuth token as well. Can > we use normal tokens from unity, if they request sys:scim:read_profile > scope? Or do we need to configure a full authenticator beside of our > default OAauth authenticator? Great to hear that. Sure, you can use your "normal" tokens from Unity, after enabling SCIM scopes on the IdP OAuth endpoint which issue those tokens (and of course requesting them by your client). I'm sure what do you mean by "full" vs "default" OAuth authenticator. To enable access with OAuth tokens you need to add oauth-rp authenticator to your scim endpoint, and this authenticator should validate tokens issued by Unity (or any other provider which you choose). If you have one like that already - sure, you can reuse it, just enable it on the SCIM endpoint. Best, Krzysztof |
