oxidecomputer / oxidecomputer/omicron

Insufficient detail logged on connection failure to IdP metadata URL

Open
#7,089 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

customer Debugging idp
Dominant language
Rust
Stars
572
Forks
97
Avg merge
2d 12h
Merged PRs (30d)
96

Description

This issue arose recently when a customer is attempting to register a new SAMP IdP provider.

Nexus was unable to connect to the metadata URL provided, but we do not log enough information to say why the connection failed, returning only "error sending request for url".

Error Response:
status: 400 Bad Request;
headers: {
  "content-type": "application/json",
  "x-request-id": "xxx",
  "content-length": "248",
  "date": "Fri, 12 Nov 2024 22:52:59 GMT"
};
value:Error {
  error_code: Some("InvalidValue"),
  message: "unsupported value for \"url\": error querying url: error sending request for url (https://sso.example- 
  keycloak.com/realms/myrealm/protocol/saml/descriptor)",
  request_id: "xxx"
}

We have a couple similar issues, https://github.com/oxidecomputer/omicron/issues/6717 and https://github.com/oxidecomputer/omicron/issues/6716 around vague connection errors. The underlying issue is probably related to https://github.com/seanmonstar/reqwest/discussions/2342, which has some suggestions around ways to extract more detail.

A systematic way to ensure we're logging sufficient detail on chained errors seems necessary.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at nexus/src/app/silo.rs around the linked metadata URL connection code, then compare the related issues 6717 and 6716 and the reqwest discussion 2342. Determine how chained connection failures are currently reported and define completion as returning enough underlying detail to explain why the IdP metadata request failed across these cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
api, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.