I am having a recurring issue with shinyproxy (currently 2.5.0 - based on Springboot) hosted within a kubernetes cluster (currenty a single node). I'm using Auth0 with SAML. Traffic goes through a Nginx ingress controller that does TLS termination and has a fairly basic configuration. What I don't understand is that I will get the following error, but only once in a while. If I try to login, I will get the error, but then after that, if I go back to the login page and try to log in again, everything works fine.
o.s.security.saml.log.SAMLDefaultLogger : AuthNResponse;FAILURE;[Auth0 URN];;;org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message a12g399012cidi7i2i3ha3ha4h6e6jc
at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:175)
at org.springframework.security.saml.SAMLAuthenticationProvider.authenticate(SAMLAuthenticationProvider.java:88)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:199)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:219)
...
This made me think of a cookies problem, however adjusting the shinyproxy server/proxy configuration for cookies did not change anything. Shinyproxy configuration has:
server:
secure-cookies: true
proxy:
same-site-cookie: None
In the browser when I try to log in I get the following error message:
Error
Status code: 200
Message: Error validating SAML message
Stack Trace:
org.springframework.security.authentication.AuthenticationServiceException: Error validating SAML message
...
Anyone has an idea of what I am missing? I would really appreciate it! Thank you!
Related
I've been trying to add google login to my django app following this tutorial:
https://github.com/RealmTeam/django-rest-framework-social-oauth2
By following exactly the instructions, everything works fine in local.
However, when I try to replicate the same on the server, I get the following error on the redirect page of the login:
Error 400: redirect_uri_mismatch
redirect_uri: http://localhost:8000/auth/complete/google-oauth2/
What is strange to me is, in my google developer console, I have set up the correct redirect url in my app, as follows:
https://mydjangoapp.com/auth/complete/google-oauth2/
And I have also put 'mydjangoapp.com' under 'Authorised JavaScript origins'.
So my question is, why google keeps telling me that the redirect url is
http://localhost:8000/auth/complete/google-oauth2/
which is not the one I have set up in the console? Perhaps there is something obvious that I'm missing here. Thank you!
Why google keeps telling me that the redirect url is
Because your application is sending its in your code the app is running on http://localhost:8000 and if you are using a client library its probably adding the rest automatically.
http://localhost:8000/auth/complete/google-oauth2/
The redirect uri must exactly match what you are sending from your application.
You need to add
http://localhost:8000/auth/complete/google-oauth2/
Javascript origin is only needed if your code is using javascript.
This video will show you how to fix the error. Google OAuth2: How the fix redirect_uri_mismatch error. Part 2 server sided web applications.
If you want your code to send https://mydjangoapp.com then your going to have to be running it from https://mydjangoapp.com probably and you may need to figure out how to configure it so that it is running from the correct host.
I am trying to log into my WSO2 management console. It is containerized and hosted in an AWS EC2 instance. I can navigate to the console login page, but when I try to login I get a 403 Forbidden message.
Navigation to login page is okay
Forbidden error
I know that the cause of this issue is that my login page is not posting the X-CSRF-Token.
Example of the form data posted in my "bad" request:
The console of my WSO2 instance prints an error like this:
WARN {org.owasp.csrfguard.log.JavaLogger} - potential cross-site request forgery (CSRF) attack thwarted (user:<anonymous>, ip:IP_ADDRESS, method:POST, uri:/carbon/admin/login_action.jsp, error:required token is missing from the request)
Example of the form data posted in a "good" request in a local WSO2 instance:
What I have tried:
I have tried turning compression "off" as suggested by this post: wso2 api manger carbon page gives 403 Forbidden
I am not using JDK 1.8.0_151 which is labeled as a version with a bug.
I am able to circumvent the issue if I disable the csrfguard in Owasp.CsrfGuard.Carbon.properties but this is a security risk.
I have sticky sessions enabled
Any ideas on why the posting to the login_action.jsp page would return a 403?
EDIT
I failed to mention in the post that I am using TLS termination with an AWS load balancer. I am almost certain that my issue has something to do with that. This line from my console output details what my error is:
Referer domain https:LOAD_BALANCER_URL/carbon/admin/login.jsp does not match request domain: http://LOAD_BALANCER_URL/carbon/admin/js/csrfPrevention.js
You can see that the referer is using https but the request is using http. I believe that I want the request domain to be https, but I'm not sure how to do that. I think that the first page is making a call to login.jsp with https and the login.jsp page is making a call to the csrfPrevention.js page but changing the protocol to http.
Please refer the OS and JDK incompatibilities matrix and make sure you are not using one of these OS JDK pairs.
Do you have a load balancer fronting your Identity Server? If so, please verify that you have enabled sticky sessions in your LB. You can find sample NGINX the configurations in the guide - docs.wso2.com/display/CLUSTER44x/Configuring+NGINX
Lower the version of java JDK to 1.8.0_144.If it's not worked go to this location
wso2Servers/wso2is-5.5.0/repository/conf/security .
There is a file name Owasp.CsrfGuard.Carbon.properties.
In that file, there is a line
org.owasp.csrfguard.JavascriptServlet.refererMatchDomain = true
set this to
org.owasp.csrfguard.JavascriptServlet.refererMatchDomain = false
This worked for me.
First, when trying to deploy my code to the target url in gcloud, the deployment process hangs.
The target url has the suffix appspot.com.
When I ping the target url, I get a request timeout. When I type the target url in my browser, I get a 502 error: server error.
When I deployed the same code to a different test environment in dialogflow, everything seemed to work fine. However when I try deploying again to this url (it is the correct url obtained from the webhook fulfilment url in dialogflow), I get this error:
Updating service [default] (this may take several minutes)...failed.
ERROR: (gcloud.app.deploy) Error Response: [4] Timed out waiting for
the app infrastructure to become healthy.
Everything else, including the node js code and the dialogflow configurations are the same between the two environments I am deploying to, except for the webhook fulfilment url.
Does anyone know what the issue can be narrowed down to? And please let me know if I can include any more useful information.
My guess is that the server is down for that specific URL. One thing to note is that I am using V1 dialogflow.
Resolved, it ended up being a firewall issue for that specific url.
I get the error on any POST requests (for logging in, or posting data through forms) using Chrome browser. You can try it out at http://52.xx.xx.xxx/users/login. Just use any username / password - should give you:
The change you wanted was rejected.
Here is a snippet of the error from the logs:
W, [2017-07-10T08:40:16.486974 #11349] WARN -- : Can't verify CSRF token authenticity
I, [2017-07-10T08:40:16.487259 #11349] INFO -- : Completed 422 Unprocessable Entity in 1ms (ActiveRecord: 0.0ms)
D, [2017-07-10T08:40:16.487526 #11349] DEBUG -- : User excluded error: #<ActionController::InvalidAuthenticityToken: ActionController::InvalidAuthenticityToken>
The exact same login request, or other post requests go through on Safari. The site has a self signed certificate. So, I've changed Chrome settings to trust the certificate and accept cookies.
Please suggest what else i should look for and what other logs might be helpful in debugging the issue. I've looked at quite a few SO threads over the past 2 days and couldn't find anything that solved my issue.
Edit:
Removed the IP address to prevent unnecessary traffic to the site.
So i got around the problem by using https instead of http at the start of the URL. As expected, chrome throws up the security related warnings, but adding an exception allows post requests to go through without errors.
Safari was somehow able to redirect my requests(with http or nothing at all) to https because of which it was working. Tried with http on safari and ended up with the same issue.
Marking this as solved - since the original observation doesn't hold anymore. I need to figure how to make the http and non http requests redirect to https on my nginx backend and that should fix the issue.
I am successful in authenticating users locally, but on the production server I am receiving 502 errors after timeout..
here is my FLOW:
FLOW = OAuth2WebServerFlow(
client_id='YOUR_CLIENT_ID',
client_secret='YOUR_CLIENT_SECRET',
scope='https://www.googleapis.com/auth/calendar',
user_agent='Real_Hub/1.0',
redirect_uri='quickerhub.com',)
locally redirect_uri is simply my localhost ip and it works fine.
here is my error through chrome network panel:
quickerhub.com
GET
502
Bad Gateway
text/html
This likely has to do with your redirect_uri. 502 is a very general error. It indicates that Django (probably uWSGI or Passenger) was unable to get a response before timeout. Have you tried that uri directly in your browser? If you have any HTTP authentication or anything on that domain, it will cause this error. For some reason, the OAuth does not seem to be properly creating the redirect response.
Hope this helps!