ipsilon

#499 Recovered: With --info-sssd yes, attributes are not in SAML response
Closed: Fixed by t0xic0der. Opened by t0xic0der.

Closed: Fixed
Reopen Issue

I have Ipsilon configured with

ipsilon-server-install --pam yes --info-sssd yes --info-sssd-domain example.com --krb yes --krb-realms EXAMPLE.COM

and I can see mod_lookup_identity enabled and configured in /etc/ipsilon/idp/idp.conf and ifp is enabled and configured in /etc/sssd/sssd.conf and looking at /idp/admin/providers/saml I have the default attribute mapping

    # 1     From *          To *

and the default allowed attributes

    # 1     Name *

However, the

POST /saml2/postResponse

on the SP after successful Kerberos authentication has an empty

   <saml:AttributeStatement/>

element so I don't see the values populated on SP in MELLON_* environment variables.

Rob advised patching Ipsilon with

diff --git a/ipsilon/login/common.py b/ipsilon/login/common.py
index 60f6df1..1835f72 100644
--- a/ipsilon/login/common.py
+++ b/ipsilon/login/common.py
@@ -79,6 +79,8 @@ class LoginManagerBase(PluginConfig, PluginObject):
         # create session login including all the userdata just gathered
         session.login(username, userdata)
+        session.save_user_attrs(userdata)
+
         # save username into a cookie if parent was form base auth
         if auth_type == 'password':
             cookie = SecureCookie(USERNAME_COOKIE, username)

and that fixes the problem, even if I'm not sure it's the correct fix because f7b6d96d284f78b8ee94d252b37e874dc32baf2b seems to suggest session.login was supposed to do the saving.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.

Metadata Update from @t0xic0der:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.