Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SmartConnect fails when using a SAML token #1004

Closed
kstallard opened this issue Feb 12, 2023 · 0 comments
Closed

SmartConnect fails when using a SAML token #1004

kstallard opened this issue Feb 12, 2023 · 0 comments
Labels

Comments

@kstallard
Copy link

Describe the bug

When I call SmartConnect with a SAML token, I get the following exception:

pyVmomi.VmomiSupport.vim.fault.InvalidLogin: (vim.fault.InvalidLogin) {
   dynamicType = <unset>,
   dynamicProperty = (vmodl.DynamicProperty) [],
   msg = 'Cannot complete login due to an incorrect user name or password.',
   faultCause = <unset>,
   faultMessage = (vmodl.LocalizableMessage) []

Reproduction steps

I use the following code to get a SAML token:

lookup_service_helper = LookupServiceHelper( wsdl_url='file:///' + os.getcwd() + '/common/sso/wsdl/lookupservice.wsdl',
                                                    soap_url=f'https://{args.hostname}/lookupservice/sdk', 
                                                   skip_verification=True)

lookup_service_helper.connect()
sso_url = lookup_service_helper.find_sso_url()
authenticator = SsoAuthenticator(sso_url)
saml_token = authenticator.get_bearer_saml_assertion(args.username, args.password, delegatable=True, token_duration=300)

With the SAML token in hand, I call:

 service_instance = SmartConnect(host=args.hostname,
                                        sslContext=sslContext,
                                        token=saml_token.strip())

Expected behavior

With a SAML token, I would expect a value service_instance to be created. However, instead I get the aforementioned exception.

Additional context

I made a change to the __login function in connect.py (pyVim/connect.py) that seems to have corrected the problem.

I noticed that one of __login's parameters was 'token' and that this parameter was not being used when creating a SoadStubAdapter object. So I added the parameter 'samlToken=token', as in:

    stub = SoapStubAdapter(
        host,
        port,
        version=version,
        path=path,
        certKeyFile=keyFile,
        certFile=certFile,
        httpProxyHost=httpProxyHost,
        httpProxyPort=httpProxyPort,
        thumbprint=thumbprint,
        sslContext=sslContext,
        httpConnectionTimeout=httpConnectionTimeout,
        connectionPoolTimeout=connectionPoolTimeout,
        customHeaders=customHeaders,
        samlToken=token)    <---My Change

This seems to have corrected the issue. I am not eager to make a change to submit it because I am no expert in pyVim and don't really understand the /sdk soap API in vcenter and the requirements for making a request.

But I do believe SAML token's for pyVim requests is broken and it has something to do with where the token is located in the SOAP request.

Thanks,
Kevin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant