[Bug 20879] New: Shibboleth matchpoint no longer works after upgrade to 17.11
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Bug ID: 20879 Summary: Shibboleth matchpoint no longer works after upgrade to 17.11 Change sponsored?: --- Product: Koha Version: 17.11 Hardware: PC OS: Linux Status: NEW Severity: major Priority: P5 - low Component: Authentication Assignee: koha-bugs@lists.koha-community.org Reporter: cking@uttyler.edu QA Contact: testopia@bugs.koha-community.org CC: dpavlin@rot13.org Shibboleth authentication was working on 16.05.17, but after upgrading to 17.11.06, the OPAC returns the "Sorry, your Shibboleth identity does not match a valid library identity. If you have a local login..." koha-conf: <useshibboleth>1</useshibboleth> <shibboleth> <matchpoint>cardnumber</matchpoint> <mapping> <cardnumber is="employeeNumber"></cardnumber> </mapping> </shibboleth> Relevant attribute from /Shibboleth.sso/Session output: Attributes employeeNumber: 5000120216 MySQL output: mysql> select cardnumber,borrowernumber from borrowers where cardnumber='5000120216'; +------------+----------------+ | cardnumber | borrowernumber | +------------+----------------+ | 5000120216 | 12046 | +------------+----------------+ 1 row in set (0.00 sec) -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 cking@uttyler.edu changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - low |P1 - high -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |katrin.fischer@bsz-bw.de, | |martin.renvoize@ptfs-europe | |.com -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|koha-bugs@lists.koha-commun |martin.renvoize@ptfs-europe |ity.org |.com -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #1 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I'm currently unable to replicate this.. could you let me know if you're using Plack or not to help narrow it down a bit. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #2 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- It may also be worth enabling debugging (SetEnv DEBUG=1) and see what pops out in the logs. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=18880 CC| |jonathan.druart@bugs.koha-c | |ommunity.org -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #3 from cking@uttyler.edu --- I get the following in the opac-error log now with $debug=1. The uninitialized value on line 86 appears to relate to this line in get_login_shib: $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute}; I don't believe we are using Plack, but I'm not familiar with it either. [Tue Jun 05 09:44:25.029248 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: koha borrower field to match: cardnumber at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 166, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.029403 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: shibboleth attribute to match: employeeNumber at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 168, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.029520 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: koha borrower field to match: cardnumber at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 166, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.029638 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: shibboleth attribute to match: employeeNumber at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 168, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.029764 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: Use of uninitialized value in concatenation (.) or string at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 86, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.029866 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] Auth.pm: employeeNumber value: at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 86, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.092226 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: C4::Tags external dictionary = none: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl [Tue Jun 05 09:44:25.215447 2018] [cgi:error] [pid 189874] [client 129.114.255.234:51435] AH01215: [Tue Jun 5 09:44:25 2018] opac-search.pl: Use of uninitialized value in concatenation (.) or string at /usr/share/koha/lib/C4/Auth.pm line 550, <DATA> line 755.: /usr/share/koha/opac/cgi-bin/opac/opac-search.pl -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugs.koha-community | |.org/bugzilla3/show_bug.cgi | |?id=17776 --- Comment #4 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- I guess it comes from: Auth.pm: employeeNumber value: at /usr/share/koha/lib/C4/Auth_with_shibboleth.pm line 86 85 $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute}; See bug 17776. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #5 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to cking from comment #3)
I get the following in the opac-error log now with $debug=1. The uninitialized value on line 86 appears to relate to this line in get_login_shib: $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute};
I don't believe we are using Plack, but I'm not familiar with it either.
I read to fast. To know if you are using plack, go to the about page, tab "Server information", line "PSGI". -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #6 from cking@uttyler.edu --- (In reply to Jonathan Druart from comment #5)
(In reply to cking from comment #3)
I get the following in the opac-error log now with $debug=1. The uninitialized value on line 86 appears to relate to this line in get_login_shib: $debug and warn $matchAttribute . " value: " . $ENV{$matchAttribute};
I don't believe we are using Plack, but I'm not familiar with it either.
I read to fast. To know if you are using plack, go to the about page, tab "Server information", line "PSGI".
Ah, thanks. No mention of PSGI in the About screen. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #7 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Well the fact that $ENV{$matchAttribute} is undefined is the root cause of the problem. I've never seen that happen outside of the plack context though so I'm not really sure what to advise. Are you sure your SP is running and passing attributes through to the vhost in apache? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #8 from cking@uttyler.edu --- I must have copied the wrong log entries from the wrong timeframe. Upon further testing, the value is actually present. Could LDAP being enabled throw off the auth process for Shibboleth? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #9 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- LDAP shouldn't throw off Shibboleth.. the code flow is to check for the shibboleth session first and only after testing for that fallback to the other authentication mechanisms. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #10 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Are you seeing this line triggered in your logs at all? http://git.koha-community.org/gitweb/?p=koha.git;a=blob;f=C4/Auth_with_shibb... -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #11 from cking@uttyler.edu --- (In reply to Martin Renvoize from comment #10)
Are you seeing this line triggered in your logs at all?
http://git.koha-community.org/gitweb/?p=koha.git;a=blob;f=C4/ Auth_with_shibboleth.pm;h=6b20511df5854a666ddde4a15b72643b9ff25556; hb=5f846a33abe89599fa7b9a37cb3c00632d30ec90#l111
I am not seeing that line in the log. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #12 from cking@uttyler.edu --- >From what I'm seeing in the logs: 1. It starts shibboleth validation (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L946) with $shib = 1 and $shib_login = 5000120216 2. Within the call to checkpw, it first hits elseif ($ldap) and userid and password are empty (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L1776) 3. Builds the principal_name as [empty userid]@domain.edu (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth_with_ldap.pm#L146) 4. Fails LDAP bind with invalid principal name and empty password (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth_with_ldap.pm#L169) with "LDAP error #48: LDAP_INAPPROPRIATE_AUTH The server requires the client which had attempted to bind anonymously or without supplying credentials to provide some form of credentials" 5. Back in checkpw (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L1778), retval is 0. 6. I do not make it into this elseif block (https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L1801) 7. The next error in the log is an uninitialized value in subroutine entry at https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L1911 8. And then https://github.com/Koha-Community/Koha/blob/7f2ffda09f04adf0cfe244b48a09fb130752f330/C4/Auth.pm#L1159 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #13 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Created attachment 76220 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=76220&action=edit Bug 20879: Fix regression in shibboleth when ldap enabled -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #14 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Very well sleuthed! Could you try out the patch attached and let me know if it resolves the problem for you? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Shibboleth matchpoint no |Shibboleth in combination |longer works after upgrade |with LDAP as an alternative |to 17.11 |no longer works after | |upgrade to 17.11 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |nick@bywatersolutions.com --- Comment #15 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- *** Bug 20943 has been marked as a duplicate of this bug. *** -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #16 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- I think this may well also affect CAS with LDAP as an alternative.. I've notified Matthias to take a look. -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #17 from Nick Clemens <nick@bywatersolutions.com> --- Affects 17.05 as well -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Trivial patch -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #76220|0 |1 is obsolete| | --- Comment #18 from Nick Clemens <nick@bywatersolutions.com> --- Created attachment 76226 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=76226&action=edit Bug 20879: Fix regression in shibboleth when ldap enabled Signed-off-by: Nick Clemens <nick@bywatersolutions.com> -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #19 from cking@uttyler.edu --- Applied the patch and tested LDAP and Shibboleth logins, logoffs, etc. All seem to be working as expected now. Thanks! -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #20 from Katrin Fischer <katrin.fischer@bsz-bw.de> --- As LDAP/Shibboleth are so hard to test I suggest counting cking's test as a sign-off and Nick for QA. Would that be agreeable? -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 --- Comment #21 from Jonathan Druart <jonathan.druart@bugs.koha-community.org> --- (In reply to Katrin Fischer from comment #20)
As LDAP/Shibboleth are so hard to test I suggest counting cking's test as a sign-off and Nick for QA. Would that be agreeable?
Yes please :) -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Jonathan Druart <jonathan.druart@bugs.koha-community.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Shibboleth in combination |Shibboleth in combination |with LDAP as an alternative |with LDAP as an alternative |no longer works after |no longer works |upgrade to 17.11 | Version|17.11 |master -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Katrin Fischer <katrin.fischer@bsz-bw.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Passed QA -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Nick Clemens <nick@bywatersolutions.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Passed QA |Pushed to Master --- Comment #22 from Nick Clemens <nick@bywatersolutions.com> --- Awesome work all! Pushed to master for 18.11.x -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Martin Renvoize <martin.renvoize@ptfs-europe.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Pushed to Master |Pushed to Stable --- Comment #23 from Martin Renvoize <martin.renvoize@ptfs-europe.com> --- Pushed to 18.05.x for 18.05.02 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fridolin.somers@biblibre.co | |m --- Comment #24 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.11.x for 17.11.08 -- You are receiving this mail because: You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=20879 Fridolin SOMERS <fridolin.somers@biblibre.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|Pushed to Stable |RESOLVED --- Comment #25 from Fridolin SOMERS <fridolin.somers@biblibre.com> --- Pushed to 17.05.x for 17.05.14 -- You are receiving this mail because: You are watching all bug changes.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org