ipsilon

#569 Recovered: Better logging if supported NameID not authenticated
Closed: Fixed by t0xic0der. Opened by t0xic0der.

Closed: Fixed
Reopen Issue

Configure an SP for the Kerberos NameID and configure the IdP to support GSSAPI and form (--ipa yes --form yes for example) and ensure that Kerberos is allowed for the SP.

Now log in without a Kerberos ticket. The GSSAPI auth will fail and fall back to form.

You'll always be denied access.

The only server-side logging is a DEBUG level message:

Unavailable Name ID type [urn:oasis:names:tc:SAML:2.0:status:AuthnFailed]

Which isn't all that useful.

It should say something that the proper NameID was not satisfied, regardless of proper authentication.

This issue ticket was originally removed from the tracker as it clashed with the pull request.
See upstream ticket for migration details.

Metadata Update from @t0xic0der:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.