Topic on Extension talk:PluggableAuth

Empty redirect URL

13 comments • 18:21, 11 August 2019 4 years ago

13

Summary by Cindy.cicalese

Configuration issue. Not a problem with PluggableAuth.

Ravikzm (talkcontribs)

Configured Mediawiki to use the simplesamlphp with PluggableAuth extensions. But getting blank page (url : wiki.domain.com/index.php?title=Special:PluggableAuthLogin) when try to access wiki.domain.com but working when access wiki.internal.domain.com

- My wiki lives at wiki.internal.domain.com, but is exposed to the world at wiki.domain.com

in both causes authentication is success.

Details :

Media wiki, PluggableAuth, Simplesamlphp version : 1.32.2

Configuration

$wgSimpleSAMLphp_InstallDir = "D:\home\site\wwwroot\simplesamlphp";

$wgSimpleSAMLphp_AuthSourceId = "aadwiki";

$wgSimpleSAMLphp_UsernameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name';

$wgSimpleSAMLphp_RealNameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // Real Name attribute

$wgSimpleSAMLphp_EmailAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // email address attribute

$wgGroupPermissions['*']['autocreateaccount'] = true;

code

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "167.220.26.111",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[PluggableAuth] Authenticated existing user: ravicv

[error] [ea50d7447bb7b57d1992ec8e] /index.php?title=Special:PluggableAuthLogin ErrorException from line 174 of D:\home\site\wwwroot\includes\Hooks.php: PHP Warning: Parameter 1 to SimpleSAMLphp::populateGroups() expected to be a reference, value given

#0 D:\home\site\wwwroot\includes\Hooks.php(174): MWExceptionHandler::handleError(integer, string, string, integer, array)

#1 D:\home\site\wwwroot\includes\Hooks.php(202): Hooks::callHook(string, array, array, NULL)

#2 D:\home\site\wwwroot\extensions\PluggableAuth\includes\PluggableAuthLogin.php(44): Hooks::run(string, array)

#3 D:\home\site\wwwroot\includes\specialpage\SpecialPage.php(569): PluggableAuthLogin->execute(NULL)

#4 D:\home\site\wwwroot\includes\specialpage\SpecialPageFactory.php(568): SpecialPage->run(NULL)

#5 D:\home\site\wwwroot\includes\MediaWiki.php(288): MediaWiki\Special\SpecialPageFactory->executePath(Title, RequestContext)

#6 D:\home\site\wwwroot\includes\MediaWiki.php(860): MediaWiki->performRequest()

#7 D:\home\site\wwwroot\includes\MediaWiki.php(517): MediaWiki->main()

#8 D:\home\site\wwwroot\index.php(42): MediaWiki->run()

#9 {main}

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "nhjgllihdf5qf2ddxxxxxxxnf1e1o09djpav7i4vb" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth]

[PluggableAuth] ERROR: return to URL is null or empty

00:34, 10 July 2019 4 years ago

MarkAHershberger (talkcontribs)

could you file a bug for this in phabricator?

03:21, 10 July 2019 4 years ago

Cindy.cicalese (talkcontribs)

You are using an old version of SimpleSAMLphp. That bug was fixed in version 4.4. The current version is 4.5. As best as I can tell from what you have above, you got REL1_32 from ExtensionDistributor, which corresponds to version 4.2. The more recent versions will work with MW 1.32.

13:31, 10 July 2019 4 years ago

Ravikzm (talkcontribs)

Hi Cindy,

I have upgraded the PlugableAuth and Simplesamlphp to 5.7 and 4.5 respectively with MW 1.32.3. still I am seeing the same issue and getting "Fatal error authenticating user' message in UI.

also updated the SimpleSamlphp config to 1.17.4

Log

X-WAWS-UNENCODED-URL: /index.php?title=Special:PluggableAuthLogin

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" is unsaved, marking dirty in constructor

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531290464", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531290464", "/", "", "", "1"

[PluggableAuth] In execute()

[PluggableAuth] Getting PluggableAuth singleton

[PluggableAuth] Class name: SimpleSAMLphp

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openConnection: calling initLB() before first connection.

[DBReplication] Cannot use ChronologyProtector with EmptyBagOStuff.

[DBReplication] Wikimedia\Rdbms\LBFactory::getChronologyProtector: using request info {

"IPAddress": "167.220.26.111",

"UserAgent": "Mozilla\/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/75.0.3770.100 Safari\/537.36",

"ChronologyProtection": false,

"ChronologyPositionIndex": 0,

"ChronologyClientId": null

}

[DBConnection] Wikimedia\Rdbms\LoadBalancer::openLocalConnection: connected to database 0 at 'localhost'.

[PluggableAuth] Authenticated existing user: ravicv

[SimpleSAMLphp] $wgSimpleSAMLphp_GroupMap is not an array

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->getSecretKeys/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): PluggableAuthLogin->execute/MediaWiki\Auth\AuthManager->setAuthenticationSessionData/MediaWiki\Session\Session->setSecret/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

[PluggableAuth] User is authorized.

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

[PluggableAuth] ERROR: return to URL is null or empty

User: loading options for user 8944 from override cache.

[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache

Unstubbing $wgParser on call of $wgParser::getFreshParser from OutputPage->addWikiTextTitleInternal

Parser: using preprocessor: Preprocessor_DOM

MediaWiki::preOutputCommit: primary transaction round committed

MediaWiki::preOutputCommit: pre-send deferred updates completed

MediaWiki::preOutputCommit: LBFactory shutdown completed

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" data dirty due to dirty(): User->getEditToken/User->getEditTokenObject/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty

User: loading options for user 8944 from override cache.

[session] SessionBackend "erc1nfki9ueng2dobp0sadfdsfdsfske7hh30780bj" save: dataDirty=1 metaDirty=0 forcePersist=0

OutputPage::sendCacheControl: private caching;

14:40, 11 July 2019 4 years ago

Ravikzm (talkcontribs)

I have tried MW 1.33.0 and the issue persistent

17:20, 11 July 2019 4 years ago

Cindy.cicalese (talkcontribs)

I see two errors there. The first is:

[SimpleSAMLphp] $wgSimpleSAMLphp_GroupMap is not an array

The second is:

[PluggableAuth] ERROR: return to URL is null or empty

When I have seen the second error, it is usually due to some underlying configuration error in the authentication library. I do see that you are able to authenticate the user, but the session has been cleared by the time you need to get the return to URL. It may be that the first error is causing the second error as a side effect. But, that seems somewhat unlikely (although I encourage you to fix that if you can - are you setting $wgSimpleSAMLphp_GroupMap or is it using its default value?). This seems to be a session-related error. Have you looked at Extension:SimpleSAMLphp#Known_Bugs?

19:55, 11 July 2019 4 years ago

Ravikzm (talkcontribs)

I already verified the known bugs and changed to sql instead of phpsession when i got a infinite loop when authenticating with Azure AAD app.we do not have any group, so not set $wgSimpleSAMLphp_GroupMap and it using default

02:36, 12 July 2019 4 years ago

Cindy.cicalese (talkcontribs)

I filed a bug and submitted a patch for the $wgSimpleSAMLphp_GroupMap warning: https://phabricator.wikimedia.org/T227956.

Regarding the null return to URL, I looked back at your original post and will restate the problem. You mention that logging in with wiki.internal.domain.com gives you a blank page (due to the null return to URL), but logging in with wiki.domain.com does not. The wiki lives at wiki.internal.domain.com, but is exposed to the world at wiki.domain.com. In both cases, you are actually logged in, even though you get the blank page. You can see that in the log:

[PluggableAuth] Authenticated existing user: ravicv

...

[PluggableAuth] User is authorized.

The null return to URL is an indication that the session got cleared or is inaccessible. I would capture the network response from the simpleSAMLphp library redirecting to PluggableAuthLogin, comparing between the access on the two different URLs. I'm wondering if there is an error in the simpleSAMLphp library configuration for the external URL where it is referring to the internal URL or something similar.

To give you some background, the workflow for authentication is as follows. Special:UserLogin redirects to Special:PluggableAuthLogin. The return to URL (the URL of the page to which you should return after authentication is complete) is saved in the session and then a redirect is done by the simpleSAMLphp library to the remote identity provider. When a response is received, the simpleSAMLphp library redirects back to Special:PluggableAuthLogin. The response is processed and then the return to URL is retrieved from the session for a redirect back to the correct page. What is happening here is that the URL is saved, but it is somehow inaccessible after the redirect back to Special:PluggableAuthLogin. The key seems to be the configuration related to the internal/external URLs.

20:15, 13 July 2019 4 years ago

Ravikzm (talkcontribs)

when accessing the MW via external link (wiki.domain.com), the session ("wiki_session" [COOKIE: ARRAffinity=0e33341a591f61ae9bcf90304e488a9c9ec333dcd731e258d7545141a9e14669; wiki_session=j9v7futippng3mddd8676rmad5otusg7082] ) is not set and not sure from where the session name is picked (assuming based on DB name??). The wiki_session is set when I access the MW from wiki.internal.domain.com (see the logs below). Looks the missing session causing the problem.

In SimpleSamlPhp config, I haven't changed any thing related to sessions and configured to use Sqlite instead of PHPSession.

in Local settings I have the below configuration

## The protocol and server name to use in fully-qualified URLs

$wgServer = "https://wiki.domain.com";

wfLoadExtension( 'PluggableAuth' );

wfLoadExtension( 'SimpleSAMLphp' );

$wgSimpleSAMLphp_InstallDir = "D:\home\site\wwwroot\simplesamlphp";

$wgSimpleSAMLphp_AuthSourceId = "wiki";

$wgSimpleSAMLphp_UsernameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name';

$wgSimpleSAMLphp_RealNameAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // Real Name attribute

$wgSimpleSAMLphp_EmailAttribute = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'; // email address attribute

$wgGroupPermissions['*']['autocreateaccount'] = true;

$wgUserrightsInterwikiDelimiter = "%";

$wgInvalidUsernameCharacters = "%:";

Wiki.domain.com log

IP: 1.1.1.1

Start request GET /index.php?title=Special:UserLogin

HTTP HEADERS:

CONTENT-TYPE:

CONTENT-LENGTH: 0

X-APPSERVICE-PROTO: https

X-FORWARDED-PROTO: https

X-ARR-SSL: 2048|256|C=US, O=DigiCert Inc, CN=DigiCert SHA2 Secure Server CA|C=US, S=Washington, L=Redmond, O=Microsoft Corporation, CN=*.azurewebsites.net

X-FORWARDED-FOR: 1.1.1.1:37085

X-ORIGINAL-URL: /index.php?title=Special:UserLogin

WAS-DEFAULT-HOSTNAME: wiki.domain.com

X-SITE-DEPLOYMENT-ID: wikidomain

DISGUISED-HOST: wiki.domain.com

X-ARR-LOG-ID: b916f493-6952-4293-978d-4c59725928ce

CLIENT-IP: 1.1.1.1:37085

X-WAWS-UNENCODED-URL: /index.php?title=Special:UserLogin

UPGRADE-INSECURE-REQUESTS: 1

USER-AGENT: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36

REFERER: https://wiki.domain.com/

MAX-FORWARDS: 10

HOST: wiki.domain.com

COOKIE: ARRAffinity=0e33341a591f61ae9bcf90304e488a9c9ec333dcd731e258d7545141a9e14669

ACCEPT-LANGUAGE: en-US,en;q=0.9,ta;q=0.8

ACCEPT-ENCODING: gzip, deflate, br

ACCEPT: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3

CONNECTION: Keep-Alive

[caches] cluster: WinCacheBagOStuff, WAN: mediawiki-main-default, stash: db-replicated, message: WinCacheBagOStuff, session: WinCacheBagOStuff

[caches] LocalisationCache: using store LCStoreCDB

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" is unsaved, marking dirty in constructor

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=1 metaDirty=1 forcePersist=0

[cookie] already deleted setcookie: "wiki_session", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" force-persist due to persist()

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] setcookie: "wiki_session", "h06p6o4qts74nvdrf8j3goqf58a1778p", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" Taking over PHP session

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" save: dataDirty=0 metaDirty=1 forcePersist=1

[cookie] already set setcookie: "wiki_session", "h06p6o4qts74nvdrf8j3goqf58a1778p", "0", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiUserID", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "wikiToken", "", "1531777142", "/", "", "1", "1"

[cookie] already deleted setcookie: "forceHTTPS", "", "1531777142", "/", "", "", "1"

[MessageCache] MessageCache::load: Loading en... local cache is empty, got from global cache

Unstubbing $wgParser on call of $wgParser::firstCallInit from MessageCache->transform

Parser: using preprocessor: Preprocessor_DOM

Unstubbing $wgLang on call of $wgLang::_unstub from ParserOptions->__construct

[session] SessionBackend "h06p6o4qts74nvdrf8j3goqf58a1778p" data dirty due to dirty(): LoginSignupSpecialPage->execute/SpecialUserLogin->getToken/MediaWiki\Session\Session->getToken/MediaWiki\Session\Session->set/MediaWiki\Session\SessionBackend->dirty