More user-friendly websso unauthorized

[Enol Fernández]

Whenever trying to login with horizon with federated identity, if the user is correctly authenticated at the IdP but not authorized by Keystone (mapping failed), the user just gets a json error message:

{"error":
  {
    "message": "The request you have made requires authentication.",
    "code": 401,
    "title": "Unauthorized"
  }
}

which is not very user-friendly.

Would it be possible to catch this error by Horizon/Keystone so user gets a nicer error message?

[Akihiro Motoki (amotoki)]

I added keystone as affected projects. Horizon team now has nobody who is familiar with federated identity and no bug like this can be resolved without keystone team support.

[Colleen Murphy (krinkle)]

The vague error message from keystone is intentional. We can't give more details about the cause of the failed authentication or authorization issue without exposing information an attacker could use to target the system.

If you are in a non-production test environment, you can set [DEFAULT]/insecure_debug to true in keystone which will provide proper error messages and allow you to debug your mapping while you are setting it up, but you must disable it before moving to production for the above reasons.

[Akihiro Motoki (amotoki)]

This is not a horizon issue. Marking as Invalid.