Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make_satosa_saml_metadata.py fails with hardcoded metadata location #8

Closed
surfnet-niels opened this issue Jul 8, 2016 · 1 comment

Comments

@surfnet-niels
Copy link
Contributor

surfnet-niels commented Jul 8, 2016

When configuring a new saml2 frontend using the template provided (saml2_frontend.yaml.example) generating metadata fails if the metadata location is not defined

metadata:
local: [metadata/idp.xml]

Traceback (most recent call last):
File "/home/ubuntu/vopaas/virtualenv/bin/make_satosa_saml_metadata.py", line 328, in
make_satosa_metadata(option)
File "/home/ubuntu/vopaas/virtualenv/bin/make_satosa_saml_metadata.py", line 168, in make_satosa_metadata
backend_modules = _load_endpoint_modules(backend_plugins, None, conf_mod.INTERNAL_ATTRIBUTES)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/satosa/plugin_loader.py", line 170, in _load_endpoint_modules
module_inst = plugin.module(callback, internal_attributes, plugin.config)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/satosa/backends/saml2.py", line 68, in init
sp_config = SPConfig().load(copy.deepcopy(config["config"]), False)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/config.py", line 350, in load
self.load_complex(cnf, metadata_construction=metadata_construction)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/config.py", line 290, in load_complex
self.load_metadata(cnf["metadata"]))
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/config.py", line 394, in load_metadata
mds.imp(metadata_conf)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/mdstore.py", line 885, in imp
self.load(key, val)
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/mdstore.py", line 871, in load
_md.load()
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/mdstore.py", line 638, in load
_txt = self.get_metadata_content()
File "/home/ubuntu/vopaas/virtualenv/lib/python3.5/site-packages/saml2/mdstore.py", line 635, in get_metadata_content
return open(self.filename, 'rb').read()
FileNotFoundError: [Errno 2] No such file or directory: 'metadata/idp.xml'

According to https://github.com/its-dirg/SATOSA/blob/master/doc/README.md#saml_plugin this file should list all SAML entities the proxy will engage with. Though I understand a none existing file is an issue, I do not understand why make_satosa_saml_metadata.py should fail if the proxy has no entities. It should not need to know about remote entities for generating its own metadata?
In addition, it is not clear whete the file should be located.
Finally, if it should contains both IdP and SP metadata, would a filename like "remote_entities" or something not make more sence?

@zamzterz
Copy link

zamzterz commented Jul 8, 2016

  1. In the VOPaaS case it actually has to know about all remote entities, since it mirrors them. So for each target provider, VOPaaS creates an IdP descriptor in its frontend metadata which includes the original UI-info, etc. Hence, it must know all target providers when generating its own metadata.
  2. In the frontend config (saml2_frontend.yaml), it suffices to specify the metadata for all SP's communicating with the proxy. In the backend config (saml2_backend.yaml), it suffices to specify the metadata for all IdP's the proxy will communicate with. All in all, to generate metadata for VOPaaS both of those files must be configured properly, due to point 1.
  3. The metadata can be located anywhere (it's possible to specify an absolute path). It can even be a URL.

@zamzterz zamzterz closed this as completed Jul 8, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants