6:28 a.m.
Hi All,
I am getting an error for one of my SAML enabled application in one of our
environment.
"Request URI does not match SAML request destination"
It seems to be an issue with the reverse proxy but I want to debug it to
find some more information about it. I checked the class "
*AbstractSamlAuthenticationHandler*" and can see that there is no good
debug logging codded. Can you please guide me how can I gather some more
information about the issue at hand.
--
PULKIT GUPTA
SENIOR SOFTWARE APPLICATIONS ENGINEER
Red Hat IN IT GBD <https://www.redhat.com/>
Pune - India
pulgupta(a)redhat.com T: +91-2066817536
<http://redhatemailsignature-marketing.itos.redhat.com/> IM: pulgupta
<https://red.ht/sig>
7:17 a.m.
You can enable TRACE logging on org.keycloak.saml package to see the
whole parsed / generated SAML documents (together with lots of other
stuff). On WildFly/EAP you can use the following jboss-cli.sh command:
/subsystem=logging/logger=org.keycloak.saml:add(level=TRACE)
You can also capture the requests at the client or the reverse proxy
and decode SAML requests/responses manually.
--Hynek
On Mon, May 22, 2017 at 1:28 PM, Pulkit Gupta <pulgupta(a)redhat.com> wrote:
Hi All,
I am getting an error for one of my SAML enabled application in one of our
environment.
"Request URI does not match SAML request destination"
It seems to be an issue with the reverse proxy but I want to debug it to
find some more information about it. I checked the class "
*AbstractSamlAuthenticationHandler*" and can see that there is no good
debug logging codded. Can you please guide me how can I gather some more
information about the issue at hand.
--
PULKIT GUPTA
SENIOR SOFTWARE APPLICATIONS ENGINEER
Red Hat IN IT GBD <https://www.redhat.com/>
Pune - India
pulgupta(a)redhat.com T: +91-2066817536
<http://redhatemailsignature-marketing.itos.redhat.com/> IM: pulgupta
<https://red.ht/sig>
_______________________________________________
keycloak-user mailing list
keycloak-user(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user
--
--Hynek
9:28 a.m.
Thanks Hynek,
However it did'nt solve my issue.
The method in question is
protected AuthOutcome handleSamlResponse(String samlResponse, String
relayState, OnSessionCreated onCreateSession) {
SAMLDocumentHolder holder = null;
boolean postBinding = false;
String requestUri = facade.getRequest().getURI();
if (facade.getRequest().getMethod().equalsIgnoreCase("GET")) {
int index = requestUri.indexOf('?');
if (index > -1) {
requestUri = requestUri.substring(0, index);
}
holder = extractRedirectBindingResponse(samlResponse);
} else {
postBinding = true;
holder = extractPostBindingResponse(samlResponse);
}
final StatusResponseType statusResponse = (StatusResponseType)
holder.getSamlObject();
// validate destination
if (!requestUri.equals(statusResponse.getDestination())) {
log.error("Request URI does not match SAML request destination");
return AuthOutcome.FAILED;
}
What I am trying to find out is what are the values of requestUri and
statusResponse.getDestination() so that I can then check my redirect rules
effectively.
Regards,
Pulkit
On Mon, May 22, 2017 at 5:47 PM, Hynek Mlnarik <hmlnarik(a)redhat.com> wrote:
You can enable TRACE logging on org.keycloak.saml package to see the
whole parsed / generated SAML documents (together with lots of other
stuff). On WildFly/EAP you can use the following jboss-cli.sh command:
/subsystem=logging/logger=org.keycloak.saml:add(level=TRACE)
You can also capture the requests at the client or the reverse proxy
and decode SAML requests/responses manually.
--Hynek
On Mon, May 22, 2017 at 1:28 PM, Pulkit Gupta <pulgupta(a)redhat.com> wrote:
> Hi All,
>
> I am getting an error for one of my SAML enabled application in one of
our
> environment.
>
> "Request URI does not match SAML request destination"
>
>
> It seems to be an issue with the reverse proxy but I want to debug it to
> find some more information about it. I checked the class "
> *AbstractSamlAuthenticationHandler*" and can see that there is no good
> debug logging codded. Can you please guide me how can I gather some more
> information about the issue at hand.
>
> --
>
> PULKIT GUPTA
>
> SENIOR SOFTWARE APPLICATIONS ENGINEER
>
> Red Hat IN IT GBD <https://www.redhat.com/>
>
> Pune - India
>
> pulgupta(a)redhat.com T: +91-2066817536
> <http://redhatemailsignature-marketing.itos.redhat.com/> IM:
pulgupta
> <https://red.ht/sig>
> _______________________________________________
> keycloak-user mailing list
> keycloak-user(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/keycloak-user
--
--Hynek
--
PULKIT GUPTA
SENIOR SOFTWARE APPLICATIONS ENGINEER
Red Hat IN IT GBD <https://www.redhat.com/>
Pune - India
pulgupta(a)redhat.com T: +91-2066817536
<http://redhatemailsignature-marketing.itos.redhat.com/> IM: pulgupta
<https://red.ht/sig>
10:06 a.m.
On 05/22/2017 07:28 AM, Pulkit Gupta wrote:
Hi All,
I am getting an error for one of my SAML enabled application in one of our
environment.
"Request URI does not match SAML request destination"
It seems to be an issue with the reverse proxy but I want to debug it to
find some more information about it. I checked the class "
*AbstractSamlAuthenticationHandler*" and can see that there is no good
debug logging codded. Can you please guide me how can I gather some more
information about the issue at hand.
When behind a proxy, load balancer or SSL terminator an invalid
destination error is usually caused by the web server not properly
identifying itself. For services hosted by Apache this can be fixed by
utilizing the ServerName and UseCanonicalName directives in the
VirtualHost section. The ServerName *must* be fully qualified with the
*scheme*, host, and *port*, not just the host. See this section of Red
Hat documentation on configuring Apache SAML SP's as clients of Keycloak.
https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/...
The easiest way to debug these issues is the read the SAML messages.
Since typically most people use SAML for WebSSO the browser has access
to both the request and response SAML messages. Each of the major
browsers have plugins to display the SAML messages. With Firefox use
SAMLTracer, Chrome has at least 3 different SAML plugins. Just make sure
SAML encryption is turned off, the plugins cannot decrypt. You'll want
to examine the URL's in both the request and response and make sure they
line up. If they don't it should be obvious who is not sending the
expected URL.
--
John
2776
days inactive
2776
days old
3 comments
3 participants
participants (3)
-
Hynek Mlnarik -
John Dennis -
Pulkit Gupta