Horizon UI shows "xmltooling::IOException" when login with SAML Federation IdP

[Peter Struys]

When logging into horizon there is an "xmltooling::IOException" error if the user tries to login with SAML Federation towards our university's Shibboleth portal. When we bypass the haproxy in the file /etc/shibboleth/shibboleth2.xml in the keystone container we do not get the error. We've had this error ever since Xena and are now on ZED.

So, inside the keystone container in the file /etc/shibboleth/shibboleth2.xml we change the line

             172.29.236.199:11211

into

            172.29.237.130:11211,172.29.238.204:11211,172.29.237.170:11211

and then the user can authenticate into horizon via the external user database.

The address 172.29.236.199 is the internal proxy address, the other three are the individual memcached containers.

The complete error is :

"xmltooling::IOException
The system encountered an error at Thu Sep 7 15:31:48 2023
To report this problem, please contact the site administrator.
Please include the following message in any email:

xmltooling::IOException at (https://openstack.x.y.z:5000/v3/auth/OS-FEDERATION/websso/saml2)

Memcache::addMemcache: (0x563694272d50) CONNECTION FAILURE, ::rec() returned zero, server has disconnected, host: 172.29.236.199:11211 -> libmemcached/io.cc:484"

I noticed earlier this week that Vmware in his product Vmware Integrated OpenStack (VIO) did solve this problem. See bug fix 2768005 in https://docs.vmware.com/en/VMware-Integrated-OpenStack/7.2/rn/VMware-Integrated-OpenStack-72-Release-Notes.html.

Does anyone else experiences this bug ?

thx
Peter