OpenStack Identity (keystone)

  1. Bug #1750917
  2. Comment #2

Comment 2 for bug 1750917

Revision history for this message
Guang Yee (guang-yee) wrote : Re: Keystone returns a HTTP 500 error if xmlsec CLI is missing

I agree we should not be changing the API return code. It should be 500 for server misconfiguration. However, from support perspective, we need something that is actionable from the log file.

"[Errno 2] No such file or directory"

is unhelpful because it does not indicate which file or direction is missing. As suggested, perhaps we can add a check prior to line 421 in idp.py? i.e.

if not (os.path.isfile(CONF.saml.xmlsec1_binary) and os.access(CONF.saml.xmlsec1_binary, os.X_OK)):
    msg = ('Misconfiguration detected. %s is either missing or not an executable. Please check to make sure xlmsec1_binary in the [saml] section is properly configured.', CONF.saml.xmlsec1_binary)
    LOG.error(msg)
    raise exception.SAMLSigningError(reason=msg)