SAML does not fail gracefully when Identity Provider does not provide require attribute

Bug #724471 reported by Rich Trott
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Mahara
Fix Released
Medium
François Marier

Bug Description

When a Shibboleth Identity Provider does not provide a required attribute, Mahara presents a page that says "Site Unavailable" and "A nonrecoverable error occured. This probably means you have encountered a bug in the system." You also will get stuff in the error_log like what's in the file attached.

By comparison, when this situation arises with Moodle, the page tells the user something like this:

"You seem to be Shibboleth authenticated but Moodle didn't receive any user attributes. Please check that your Identity Provider releases the necessary attributes ('REMOTE_USER', 'givenName', 'sn' and 'mail') to the Service Provider Moodle is running on or inform the webmaster of this server."

Especially if people intend to run federated authentication, SAML should fail gracefully if an Identity Provider doesn't provide all the attributes Mahara requires. If nothing else, it at least makes it clear that the problem is probably with the Identity Provider and not one or more bugs in Mahara.

Tags: saml
Revision history for this message
Rich Trott (richard-trott) wrote :
Revision history for this message
Rich Trott (richard-trott) wrote :

I always forget to include version information. This is running the 1.3_STABLE branch with the fixes for bugs #670546 and #688395.

tags: added: saml
Changed in mahara:
status: New → Triaged
importance: Undecided → Medium
milestone: none → 1.4.0
Revision history for this message
Carson (carsontam) wrote :

This patch will check the required SSO fields and returns a more sensible error message when any one of these fields is missing.

Revision history for this message
François Marier (fmarier) wrote :

Thanks for the patch Carson!

Changed in mahara:
status: Triaged → Fix Released
status: Fix Released → Fix Committed
assignee: nobody → François Marier (fmarier)
Changed in mahara:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.