WinError 5

[justinforlenza]

So I'm working on getting SAML with G-Suite. When going to /saml2/login, it takes me to the correct google login page, I log in, it authenticates, but when I am returned to the /saml2/acs view, it throws the following error:
PermissionError at /saml2/acs/ [WinError 5] Access is denied

I have attempted to fix this, by setting access to all project directories & files to allow Everyone to access/modify them and even ran the server as an administrator. All to no prevail.

Here is my SAML Config:
saml_config.txt

[knaperek]

What do you see in the logs? Are you able to locate the line in djangosaml2 source code that's throwing this exception? I'd suggest you use a debugger and set a breakpoint into the djangosaml2.assertion_consumer_service function.

[justinforlenza]

Here is the full Django Traceback

Environment:


Request Method: POST
Request URL: https://localhost:8000/saml2/acs/

Django Version: 1.11.5
Python Version: 3.6.2
Installed Applications:
['django.contrib.admin',
 'django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.messages',
 'django.contrib.staticfiles',
 'compliance',
 'djangosaml2',
 'sslserver']
Installed Middleware:
['django.middleware.security.SecurityMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.middleware.common.CommonMiddleware',
 'django.middleware.csrf.CsrfViewMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware',
 'django.contrib.messages.middleware.MessageMiddleware',
 'django.middleware.clickjacking.XFrameOptionsMiddleware']



Traceback:

File "C:\Users\justin\SVA\lib\site-packages\django\core\handlers\exception.py" in inner
  41.             response = get_response(request)

File "C:\Users\justin\SVA\lib\site-packages\django\core\handlers\base.py" in _get_response
  187.                 response = self.process_exception_by_middleware(e, request)

File "C:\Users\justin\SVA\lib\site-packages\django\core\handlers\base.py" in _get_response
  185.                 response = wrapped_callback(request, *callback_args, **callback_kwargs)

File "C:\Users\justin\SVA\lib\site-packages\django\views\decorators\http.py" in inner
  40.             return func(request, *args, **kwargs)

File "C:\Users\justin\SVA\lib\site-packages\django\views\decorators\csrf.py" in wrapped_view
  58.         return view_func(*args, **kwargs)

File "C:\Users\justin\SVA\lib\site-packages\djangosaml2\views.py" in assertion_consumer_service
  260.         response = client.parse_authn_request_response(xmlstr, BINDING_HTTP_POST, outstanding_queries)

File "C:\Users\justin\SVA\lib\site-packages\saml2\client_base.py" in parse_authn_request_response
  597.                                             binding, **kwargs)

File "C:\Users\justin\SVA\lib\site-packages\saml2\entity.py" in _parse_response
  1140.                 response = response.loads(xmlstr, False, origxml=origxml)

File "C:\Users\justin\SVA\lib\site-packages\saml2\response.py" in loads
  512.         self._loads(xmldata, decode, origxml)

File "C:\Users\justin\SVA\lib\site-packages\saml2\response.py" in _loads
  337.                 **args)

File "C:\Users\justin\SVA\lib\site-packages\saml2\sigver.py" in correctly_signed_response
  1762.                                       class_name(response), origdoc)

File "C:\Users\justin\SVA\lib\site-packages\saml2\sigver.py" in _check_signature
  1563.                                          node_id=item.id, id_attr=id_attr):

File "C:\Users\justin\SVA\lib\site-packages\saml2\sigver.py" in verify_signature
  1508.                                               node_id=node_id, id_attr=id_attr)

File "C:\Users\justin\SVA\lib\site-packages\saml2\sigver.py" in validate_signature
  986.                                                       exception=SignatureError)

File "C:\Users\justin\SVA\lib\site-packages\saml2\sigver.py" in _run_xmlsec
  1007.         pof = Popen(com_list, stderr=PIPE, stdout=PIPE)

File "C:\Python36\lib\subprocess.py" in __init__
  707.                                 restore_signals, start_new_session)

File "C:\Python36\lib\subprocess.py" in _execute_child
  992.                                          startupinfo)

Exception Type: PermissionError at /saml2/acs/
Exception Value: [WinError 5] Access is denied

And Here is the info for lib\site-packages\djangosaml2\views.py in assertion_consumer_service

attribute_mapping | {'uid': ('username',)}
client | <djangosaml2.overrides.Saml2Client object at 0x047B55B0>
conf | <saml2.config.SPConfig object at 0x04691D50>
config_loader_path | None
create_unknown_user | True
oq_cache | <djangosaml2.cache.OutstandingQueriesCache object at 0x047B5D70>
outstanding_queries | {'id-cNYBnMpmSaMzYcwSQ': '/accounts/profile/'}
request | <WSGIRequest: POST '/saml2/acs/'>
xmlstr | 'PD94bWwgdmVyc2lvbj0iMS4wIiBlbm...

[knaperek]

Seems you have not configured IdP Entity ID correctly in your settings:

https://localhost/simplesaml/saml2/idp/metadata.php' does not seem like a legit G-Suite engity ID to me.

[justinforlenza]

Sorry for the late reply, been away for a while. I have updated to the correct gsuite URL, however this did not resolve the issue, I dug a little deeper, and found out that the issue is with the xmlsec library in Windows, it is unable to access the Windows Temp directory, i tried updating permissions of the directory and even running the server as Admin, but to no prevail again.

This issue was pointed out in the original djangosaml2 bitbucket repo issue reporting:
https://bitbucket.org/lgs/djangosaml2/issues/23/verifying-signatures-will-not-work-on

[justinforlenza]

I have setup a Ubuntu VM to test to see if its just the permission issue with Windows, this was not the case. It seems that the way the TMP files are being created is that only the creator is able to access, so the xmlsec is unable to access the files created. I even changed the TMPDIR environment variable, but it still creates the file with the same permissions, no matter what the inherited permissions of that folder is.