idp preauth: handle multiple State messages from ipa-otpd #6088
Assignees
Labels
Comments
|
Example of the failing communication: |
pbrezina
added a commit
to pbrezina/sssd
that referenced
this issue
Apr 1, 2022
State attribute can be present only once (RFC-2865), but some IdPs can return larger data. This patch switches to Proxy-State which make take multiple values and concatenates these into single krb5_data like we already do with Reply-Message. Resolves: SSSD#6088
pbrezina
added a commit
to pbrezina/sssd
that referenced
this issue
Apr 1, 2022
State attribute can be present only once (RFC-2865), but some IdPs can return larger data. This patch switches to Proxy-State which make take multiple values and concatenates these into single krb5_data like we already do with Reply-Message. Resolves: SSSD#6088
pbrezina
added a commit
to pbrezina/sssd
that referenced
this issue
Apr 1, 2022
State attribute can be present only once (RFC-2865), but some IdPs can return larger data. This patch switches to Proxy-State which make take multiple values and concatenates these into single krb5_data like we already do with Reply-Message. Resolves: SSSD#6088
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 5, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 5, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 5, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 5, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 21, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 21, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 21, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
abbra
added a commit
to abbra/freeipa
that referenced
this issue
Apr 25, 2022
For RADIUS protocol 'State' attribute value length must be 253 characters or less. Some IdPs produce states larger than this length. In addition, 'State' attribute can only be present once in a RADIUS packet. This means we cannot use 'State' to handle large IdP states. Switch to use 'Proxy-State' instead. 'Proxy-State' is optional and can be present multiple times. Since we have control for both sides of the RADIUS communication here (ipa-otpd and SSSD's KDC plugin for 'idp' preauth method), pass multiple 'Proxy-State' attributes with size below MAX_ATTRSIZE and reassemble a state on the KDC side. The same logic is already applied to 'Reply-Message' attribute. Related: SSSD/sssd#6088 Fixes: https://pagure.io/freeipa/issue/8805 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
When an external IdP returns a state that is longer than 254 characters, it is not possible to package it into a State response over RADIUS protocol exchange from
ipa-otpdto KDC. This is the case, for example, for Microsoft's IdPs in Azure.We already have support for Reply-Message to be split over multiple attribute sets. Add the same for State.
The text was updated successfully, but these errors were encountered: