SAML2 ECP Accept header incorrect

[Jamie Lennox]

The first SAML ECP request is to the endpoint with an Accept value containing application/vnd.paos+xml. In the spec example and in keystoneclient we send "text/html; application/vnd.paos+xml" however this is incorrect because the mime-type separator in Accept headers is a , (comma), where a ; provides parameters to the type[2].

This has been confirmed by SAML2 working group as a bug in the spec. (Will provide reference for this soon).

This works in Sibolleth because the accept matcher simply does

if 'application/vnd.paos+xml' in req.headers.accept

but fails in mod_auth_mellon which does a more strict type check.

[1] http://docs.oasis-open.org/security/saml/Post2.0/saml-ecp/v2.0/cs01/saml-ecp-v2.0-cs01.html#_Toc366664721
[2] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/216928

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/216928
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=e0276c65364bcb8a4a3fe1ad1c91899b1325836c
Submitter: Jenkins
Branch: master

commit e0276c65364bcb8a4a3fe1ad1c91899b1325836c
Author: Jamie Lennox <email address hidden>
Date: Wed Aug 26 12:25:31 2015 +1000

    Fix Accept header in SAML2 requests

    The ; separator allows providing parameters to a type not separating
    type options. This means that in strict type checks like those performed
    by mod_auth_mellon the check for accept type fails.

    Change-Id: Ieeaa74b304921daef68497fec77cc6629ab2f0a2
    Closes-Bug: #1488722

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/kilo
Review: https://review.openstack.org/217450

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: feature/keystoneauth_integration
Review: https://review.openstack.org/218269

[Steve Martinelli (stevemar)]

this won't go into keystoneauth, but it went into keystoneauth-saml2 - https://review.openstack.org/#/c/216929/

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/217450
Committed: https://git.openstack.org/cgit/openstack/python-keystoneclient/commit/?id=3cc752937e322e4f16eebf048f74c58aec2b2f73
Submitter: Jenkins
Branch: stable/kilo

commit 3cc752937e322e4f16eebf048f74c58aec2b2f73
Author: Jamie Lennox <email address hidden>
Date: Wed Aug 26 12:25:31 2015 +1000

    Fix Accept header in SAML2 requests

    The ; separator allows providing parameters to a type not separating
    type options. This means that in strict type checks like those performed
    by mod_auth_mellon the check for accept type fails.

    Change-Id: Ieeaa74b304921daef68497fec77cc6629ab2f0a2
    Closes-Bug: #1488722
    (cherry picked from commit e0276c65364bcb8a4a3fe1ad1c91899b1325836c)

[OpenStack Infra (hudson-openstack)]

Change abandoned by Steve Martinelli (<email address hidden>) on branch: feature/keystoneauth_integration
Review: https://review.openstack.org/218269
Reason: need to abandon in order to delete branch

[Jamie Lennox (jamielennox)]

Now that we are merging the SAML plugins back into the main repository this affects keystoneauth again. Whilst they were in keystoneauth-saml2 this got merged so the code now in keystoneauth is fixed. The plugins are still marked private though while we rework them. So it's in - but not released.