element-hq / element-hq/synapse

SAML2 Expired SAML2 metadata gives cryptic error.

Open
#8,721 0 comments 0 reactions 0 assignees View on GitHub
A-SSO z-p3
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#8721](https://github.com/matrix-org/synapse/issues/8721).

---

A host's saml2 metadata recently expired (as seen by the `validUntil` attribute on the metadata):
```

```
When trying to login, the user is sent to the `https://host/_matrix/client/r0/login/sso/redirect` page and shown a `M_UNKNOWN` ISE page rather than a useful error.

Digging into the logs, the error given by Synapse is also not terribly helpful:

```
2020-11-04 @ 22:55:45.487 saml2.client_base.IdpUnspecified: No IdP to send to given the premises
2020-11-04 @ 22:55:45.487 raise IdpUnspecified("No IdP to send to given the premises")
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/saml2/client_base.py", line 237, in _sso_location
2020-11-04 @ 22:55:45.487 destination = self._sso_location(entityid, binding)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/saml2/client.py", line 115, in prepare_for_negotiated_authenticate
2020-11-04 @ 22:55:45.487 **kwargs)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/saml2/client.py", line 76, in prepare_for_authenticate
2020-11-04 @ 22:55:45.487 relay_state=client_redirect_url
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/synapse/handlers/saml_handler.py", line 127, in handle_redirect_request
2020-11-04 @ 22:55:45.487 return self._saml_handler.handle_redirect_request(client_redirect_url)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/synapse/rest/client/v1/login.py", line 469, in get_sso_url
2020-11-04 @ 22:55:45.487 sso_url = await self.get_sso_url(request, client_redirect_url)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/synapse/rest/client/v1/login.py", line 402, in on_GET
2020-11-04 @ 22:55:45.487 callback_return = await raw_callback_return
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/synapse/http/server.py", line 405, in _async_render
2020-11-04 @ 22:55:45.487 callback_return = await self._async_render(request)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/synapse/http/server.py", line 228, in _async_render_wrapper
2020-11-04 @ 22:55:45.487 Traceback (most recent call last):
2020-11-04 @ 22:55:45.487
2020-11-04 @ 22:55:45.487 During handling of the above exception, another exception occurred:
2020-11-04 @ 22:55:45.487
2020-11-04 @ 22:55:45.487 IndexError: list index out of range
2020-11-04 @ 22:55:45.487 srvs = self.metadata.single_sign_on_service(list(eids.keys())[0], binding)
2020-11-04 @ 22:55:45.487 File "/usr/local/lib/python3.7/site-packages/saml2/client_base.py", line 234, in _sso_location
2020-11-04 @ 22:55:45.487 Traceback (most recent call last):
2020-11-04 @ 22:55:45.487 2020-11-04 22:55:45,486 - synapse.http.server - 83 - ERROR - GET-176132- Failed handle request via 'SAMLRedirectServlet'
```

What would be good here is some kind of error that tells you to update your metadata file. Ideally this would be communicated to the user.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.