Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

re-authenticating a non-member causes an error #44

Open
NightJar opened this issue Aug 28, 2019 · 0 comments
Open

re-authenticating a non-member causes an error #44

NightJar opened this issue Aug 28, 2019 · 0 comments

Comments

@NightJar
Copy link
Contributor

Currently testing MTS, login type integration.

There is a Default Admin user, but that is all.

Discovery path:

  1. attempt to gain access to the CMS: /admin
  2. click Login under Login with RealMe® heading.
  3. select Initiate SAML on the RealMe login service Messaging Test Site:SAML v2.0 AuthnRequest validation outcome interface
  4. 👀 Observe the test site's homepage again.
  5. attempt to gain access to the CMS: /admin
  6. 👀 Observe the login form again
  7. click Login under Login with RealMe® heading, again.
  8. 👀 Observe login form presented, message Unfortunately we're not able to log you in through RealMe right now. Please try again shortly.
  9. Use the member authenticator this time (Email & Password), default admin credentials
  10. 👀 Observe a large PHP Emergency error: [Emergency] Uncaught BadMethodCallException: Object->__call(): the method 'getResponse' does not exist on 'SilverStripe\RealMe\Authenticator\LoginHandler' with an HTTP 500 response code.
  11. Visit /admin - be logged in as normal.

You may have noticed between steps 7 and 8 above that the BackURL was altered from /admin/pages/ to /Secuirity/login/RealMe/acs. This triggers the manifestation, however this issue is really about the "not so nice" handling of an already authenticated session.

Alternate recreation steps:

  1. Log in to CMS as default admin.
  2. visit /Security/login
  3. click the RealMe Login button.
  4. 👀 Observe a large PHP Emergency error: [Emergency] Uncaught BadMethodCallException: Object->__call(): the method 'getResponse' does not exist on 'SilverStripe\RealMe\Authenticator\LoginHandler' with an HTTP 500 response code.
Trace
SilverStripe\View\ViewableData->__call(getResponse, Array) 
Security.php:393
SilverStripe\Security\Security::permissionFailure(SilverStripe\RealMe\Authenticator\LoginHandler, Array) 
LoginHandler.php:156
SilverStripe\RealMe\Authenticator\LoginHandler->acs(SilverStripe\Control\HTTPRequest) 
RequestHandler.php:323
SilverStripe\Control\RequestHandler->handleAction(SilverStripe\Control\HTTPRequest, acs) 
RequestHandler.php:202
SilverStripe\Control\RequestHandler->handleRequest(SilverStripe\Control\HTTPRequest) 
Security.php:911
SilverStripe\Security\Security->delegateToHandler(SilverStripe\RealMe\Authenticator\LoginHandler, Log in, Array) 
Security.php:880
SilverStripe\Security\Security->delegateToMultipleHandlers(Array, Log in, Array, Array) 
Security.php:710
SilverStripe\Security\Security->login(SilverStripe\Control\HTTPRequest) 
RequestHandler.php:323
SilverStripe\Control\RequestHandler->handleAction(SilverStripe\Control\HTTPRequest, login) 
Controller.php:284
SilverStripe\Control\Controller->handleAction(SilverStripe\Control\HTTPRequest, login) 
RequestHandler.php:202
SilverStripe\Control\RequestHandler->handleRequest(SilverStripe\Control\HTTPRequest) 
Controller.php:212
SilverStripe\Control\Controller->handleRequest(SilverStripe\Control\HTTPRequest) 
Director.php:360

The execution path comes through here

$authData = $this->service->getAuthData();

down to here

if (!$auth->isAuthenticated()) {
throw new RealMeException(
'OneLogin SAML library did not successfully authenticate, but did not return a specific error',
RealMeException::NOT_AUTHENTICATED
);
}

Log messages give
Error during RealMe authentication process. Code: 7, Message: OneLogin SAML library did not successfully authenticate, but did not return a specific error

Where Code 7 is PRIVATE_KEY_FILE_NOT_FOUND, where the code checks for code 8: SAML_RESPONSE_NOT_FOUND in what looks like an attempt to avoid this

} catch (OneLogin_Saml2_Error $e) {
// If the Exception code indicates there wasn't a response, we ignore it as it simply means the visitor
// isn't authenticated yet. Otherwise, we re-throw the Exception
if ($e->getCode() === OneLogin_Saml2_Error::SAML_RESPONSE_NOT_FOUND) {
return null;
} else {
throw $e;
}
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants