SAML Auth broken: "Error: key http://schemas.xmlsoap.org/.../name must not contain '.' " #10931

toughIQ · 2018-05-29T13:30:21Z

Description:

Login via SAML results in error:

Sorry, an annoying error occured
Error: key http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name must not contain '.'

Some Details:
We have a single RocketChat instance running via Ubuntu Snap. We connected it to our WinADFS Server using SAML. Everything worked fine until a few days back. We didnt change anything on the ADFS side. But I think there was an automatic update via snap to v 0.64.2. Since around then SAML Auth does not work anymore.

Server Setup Information:

Version of Rocket.Chat Server: 0.64.2
Operating System: Ubuntu
Deployment Method(snap/docker/tar/etc): snap
Number of Running Instances: 1

Steps to Reproduce:

Configured SAML according to manual and hints like:
saml configuration #2770 (comment)

Alternative Way:

Install V 0.64.1
Configure SAML
Login via SAML -> should work
Update V 0.64.2
Login via SAML -> should fail

Expected behavior:

SAML Login window pops up at login and closes with success after username/password.

Actual behavior:

Browser displays error in Login window:

Sorry, an annoying error occured
Error: key http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name must not contain '.'

Relevant logs:

ADFS Server:

MSIS1000: The SAML request contained a NameIDPolicy that was not satisfied by the issued token. Requested NameIDPolicy: AllowCreate: True Format: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress SPNameQualifier: . Actual NameID properties: null.

RocketChat Server:

2018-05-29T13:49:23Z : { actionName: 'authorize',
2018-05-29T13:49:23Z :   serviceName: 'adfs',
2018-05-29T13:49:23Z :   credentialToken: 'id-4tgTLLjS9zgQ7oAdz' }
2018-05-29T13:49:23Z : [ { provider: 'adfs',
2018-05-29T13:49:23Z :     entryPoint: 'https://login.mydomain.com/adfs/ls',
2018-05-29T13:49:23Z :     idpSLORedirectURL: 'https://chat.mydomain.com/simplesaml/saml2/idp/SingleLogoutService.php',
2018-05-29T13:49:23Z :     issuer: 'https://chat.mydomain.com/',
2018-05-29T13:49:23Z :     cert: 'MIIC2...MoreCertData...H4=',
2018-05-29T13:49:23Z :     privateCert: false,
2018-05-29T13:49:23Z :     privateKey: false,
2018-05-29T13:49:23Z :     callbackUrl: 'https://chat.mydomain.com/_saml/validate/adfs',
2018-05-29T13:49:23Z :     id: 'id-75TL4oTvi4e8boZqG',
2018-05-29T13:49:23Z :     protocol: 'https://',
2018-05-29T13:49:23Z :     path: '/saml/consume',
2018-05-29T13:49:23Z :     identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
2018-05-29T13:49:23Z :     authnContext: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' } ]
2018-05-29T13:49:23Z : adfs
2018-05-29T13:49:23Z : { actionName: 'validate',
2018-05-29T13:49:23Z :   serviceName: 'adfs',
2018-05-29T13:49:23Z :   credentialToken: undefined }
2018-05-29T13:49:23Z : [ { provider: 'adfs',
2018-05-29T13:49:23Z :     entryPoint: 'https://login.mydomain.com/adfs/ls',
2018-05-29T13:49:23Z :     idpSLORedirectURL: 'https://chat.mydomain.com/simplesaml/saml2/idp/SingleLogoutService.php',
2018-05-29T13:49:23Z :     issuer: 'https://chat.mydomain.com/',
2018-05-29T13:49:23Z :     cert: 'MIIC2...MoreCertData...H4=',
2018-05-29T13:49:23Z :     privateCert: false,
2018-05-29T13:49:23Z :     privateKey: false,
2018-05-29T13:49:23Z :     callbackUrl: 'https://chat.mydomain.com/_saml/validate/adfs',
2018-05-29T13:49:23Z :     id: 'id-4tgTLLjS9zgQ7oAdz',
2018-05-29T13:49:23Z :     protocol: 'https://',
2018-05-29T13:49:23Z :     path: '/saml/consume',
2018-05-29T13:49:23Z :     identifierFormat: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
2018-05-29T13:49:23Z :     authnContext: 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' } ]
2018-05-29T13:49:23Z : adfs
2018-05-29T13:49:26Z : RESULT :undefined

I am not sure, if this might be a hint, but at first we have 2018-05-29T13:49:23Z : credentialToken: 'id-4tgTLLjS9zgQ7oAdz' } and some lines later we see 2018-05-29T13:49:23Z : credentialToken: undefined }
UPDATE: this credentialToken thing seems to be normal. Also found in working 0.64.1.

The text was updated successfully, but these errors were encountered:

toughIQ · 2018-05-30T08:35:40Z

I did some quick testing using Docker images:

Setup V0.64.1 with SAML
Tried SAML Login -> works
Upgraded to V0.64.2
Tried SAML Login again -> fails

Anything changed with SAML except for this multi site issue?

toughIQ · 2018-05-30T10:12:45Z

The error message really drives me crazy, since I cannot figure out, what is wrong here.
Message:
Error: key http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name must not contain '.'

I looked into the logs of a working (0.64.1) instance and found the following result:
RESULT :{"profile":{"inResponseToId":{"name":"InResponseTo","value":"id-dQRMwkLx7RGroK6iY","prefix":"","local":"InResponseTo","uri":""},"issuer":"https://login.mycompany.com/adfs/services/trust","nameID":"[email protected]","nameIDFormat":{"name":"Format","value":"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress","prefix":"","local":"Format","uri":""},"sessionIndex":{"name":"SessionIndex","value":"_81149700-9e21-4be9-b245-c7287c1747a8","prefix":"","local":"SessionIndex","uri":""},"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":"Surname Firstname","http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress":"[email protected]","http://schemas.xmlsoap.org/claims/Group":"Domain Users","username":"Surname Firstname","email":"[email protected]"}}

From my understanding the following part triggers the error message:
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name":"Surname Firstname"

But I cant see any reason, why this result would trigger the must not contain '.' message, since there is no . anywhere.

misi · 2018-05-31T06:51:45Z

The problem is that mongodb don't support dot in key: https://stackoverflow.com/questions/12397118/mongodb-dot-in-key-name

Mongo DB don't support "." as key Fix RocketChat#10931

toughIQ · 2018-05-31T07:05:16Z

@misi so this happens since auth keys were moved from memory to mongo in v0.64.2.

misi · 2018-05-31T07:14:09Z

I have added a PR #10961 that works for me

ChessSpider · 2018-05-31T13:47:35Z

still no SAML unit tests eh 😞 👎 ..broken again

engelgabriel · 2018-06-02T14:59:30Z

@ChessSpider @toughIQ @misi can you help us create unit testing for SAML? We don't have anyone in the core team with enough experience to do it.

ChessSpider · 2018-06-06T11:56:51Z

@engelgabriel Hi, what kind of help is required ?
I have setup SimpleSAML with OpenLDAP and Rocket.Chat. All running in Docker. I can share (parts of) of the Docker images and configurations, if that helps?

misi · 2018-06-06T12:02:53Z

@engelgabriel Sure. Let me know what kind of help you are expecting..

ChessSpider · 2018-06-11T11:22:49Z

@engelgabriel non-intrusive reminder

Additionally, is there a temporary fix for this? Or when will the next version be launched? No one can log in now, still.. I am running 0.65.1

misi · 2018-06-12T04:34:10Z

@ChessSpider
Could you please describe your issue more here?
Or if you opened a separated issue then add the link here to the issue?

ChessSpider · 2018-06-12T04:46:26Z

Still the same issue as described here.. But I use urn uri in saml and not the symbolical name. When I'm at work I'll copy paste the full error. At least we appear to have found an edge case for our unit test! Op di 12 jun. 2018 06:34 schreef Mészáros Mihály <[email protected]>:

…

@ChessSpider <https://github.com/ChessSpider> Could you please describe your issue more here? Or if you opened a separated issue then add the link here to the issue? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#10931 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ACEWNHPOZmZGKDOIjsbxw3KW0f9vqn3dks5t70TWgaJpZM4URfuw> .

ChessSpider · 2018-06-12T06:08:36Z

Sorry, an annoying error occured
Error: key urn:oid:2.5.4.3 must not contain '.'
Close Window

which equals to 'commonName'.

I also saw the same error for this field: http://www.alvestrand.no/objectid/0.9.2342.19200300.100.1.1.html

Any ideas? i am running Version | 0.65.1.

toughIQ · 2018-06-12T06:48:14Z

@ChessSpider this fix is scheduled for 0.66.0 late of June. Since this was a blocker for my installation too, I went from snap to docker installation and used a custom 0.64.2 image to which I applied the SAML fix manually.

ChessSpider · 2018-06-12T06:50:39Z

Cool. Thx. Guess I'll do that too then 👍

Would you want to share your Dockerfile to save me some work?

toughIQ · 2018-06-12T09:45:20Z

@ChessSpider I am sorry, but I did this quick and dirty and didnt save my Dockerfile.
But I pushed my image to DockerHub: https://hub.docker.com/r/toughiq/rocketchat/

docker pull toughiq/rocketchat:0.64.2samlfix

ChessSpider · 2018-06-20T08:19:12Z

@toughIQ
Thanks, but I only want to run the official Docker-releases of Gitlab. Can you maybe help me maybe with my Dockerfile?


RUN apt-get update  && apt-get install -y  --no-install-recommends git &&  rm -rf /var/lib/apt/lists/*

RUN curl https://install.meteor.com/ | sh

RUN git clone https://github.com/RocketChat/Rocket.Chat 
WORKDIR Rocket.Chat
RUN git branch 681b456083835a6c87e0ba9d2cea63144fa2e025
RUN npm update
RUN mkdir -p /home/rocketchat && chown -R rocketchat:rocketchat /home/rocketchat/
#USER rocketchat
ENV METEOR_ALLOW_SUPERUSER=yes
RUN ./example-build-run.sh
MAINTAINER [email protected]

#RUN set -x \
# && cd /app/bundle/programs/server \
# && npm install \
# && npm cache clear --force \
RUN  chown -R rocketchat:rocketchat /app

USER rocketchat

VOLUME /app/uploads

WORKDIR /app/bundle

# needs a mongoinstance - defaults to container linking with alias 'mongo'
ENV DEPLOY_METHOD=docker \
    NODE_ENV=production \
    MONGO_URL=mongodb://mongo:27017/rocketchat \
   HOME=/tmp \
    PORT=3000 \
    ROOT_URL=http://localhost:3000 \
    Accounts_AvatarStorePath=/app/uploads

EXPOSE 3000

CMD ["node", "main.js"]

errors with:

on the very first build, meteor build command should fail due to a bug on emojione package (related to phantomjs installation)
the command below forces the error to happen before build command (not needed on subsequent builds)
set +e

set +e
meteor add rocketchat:lib

meteor add rocketchat:lib
/root/.meteor/packages/meteor-tool/.1.7.0_3.u9lhms.hf7k++os.linux.x86_64+web.browser+web.browser.legacy+web.cordova/mt-os.linux.x86_64/tools/cli/main.js:1522
}).run();
^

SyntaxError: Unexpected token y in JSON at position 0
at JSON.parse ()
at /tools/cli/main.js:837:12
set -e

set -e

meteor build --server-only --directory $DEPLOY_DIR

meteor build --server-only --directory /var/www/rocket.chat
/root/.meteor/packages/meteor-tool/.1.7.0_3.u9lhms.hf7k++os.linux.x86_64+web.browser+web.browser.legacy+web.cordova/mt-os.linux.x86_64/tools/cli/main.js:1522
}).run();
^

SyntaxError: Unexpected token y in JSON at position 0
at JSON.parse ()
at /tools/cli/main.js:837:12

misi added a commit to misi/Rocket.Chat that referenced this issue May 31, 2018

Update saml_utils.js

681b456

Mongo DB don't support "." as key Fix RocketChat#10931

misi mentioned this issue May 31, 2018

[FIX] SAML Auth broken when attributes contains . #10961

Merged

engelgabriel added this to the 0.66.0 milestone Jun 2, 2018

engelgabriel closed this as completed in #10961 Jun 2, 2018

ChessSpider mentioned this issue Jun 28, 2018

SAML login error v 0.66.0 #11279

Closed

Centzilius mentioned this issue Jan 22, 2019

OAuth having problems if a dot is an attribute in the Identity Path #13220

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SAML Auth broken: "Error: key http://schemas.xmlsoap.org/.../name must not contain '.' " #10931

SAML Auth broken: "Error: key http://schemas.xmlsoap.org/.../name must not contain '.' " #10931

toughIQ commented May 29, 2018 •

edited

Loading

toughIQ commented May 30, 2018

toughIQ commented May 30, 2018

misi commented May 31, 2018

toughIQ commented May 31, 2018

misi commented May 31, 2018

ChessSpider commented May 31, 2018

engelgabriel commented Jun 2, 2018

ChessSpider commented Jun 6, 2018

misi commented Jun 6, 2018

ChessSpider commented Jun 11, 2018 •

edited

Loading

misi commented Jun 12, 2018

ChessSpider commented Jun 12, 2018 via email

ChessSpider commented Jun 12, 2018 •

edited

Loading

toughIQ commented Jun 12, 2018

ChessSpider commented Jun 12, 2018 •

edited

Loading

toughIQ commented Jun 12, 2018

ChessSpider commented Jun 20, 2018 •

edited

Loading

SAML Auth broken: "Error: key http://schemas.xmlsoap.org/.../name must not contain '.' " #10931

SAML Auth broken: "Error: key http://schemas.xmlsoap.org/.../name must not contain '.' " #10931

Comments

toughIQ commented May 29, 2018 • edited Loading

Description:

Server Setup Information:

Steps to Reproduce:

Expected behavior:

Actual behavior:

Relevant logs:

toughIQ commented May 30, 2018

toughIQ commented May 30, 2018

misi commented May 31, 2018

toughIQ commented May 31, 2018

misi commented May 31, 2018

ChessSpider commented May 31, 2018

engelgabriel commented Jun 2, 2018

ChessSpider commented Jun 6, 2018

misi commented Jun 6, 2018

ChessSpider commented Jun 11, 2018 • edited Loading

misi commented Jun 12, 2018

ChessSpider commented Jun 12, 2018 via email

ChessSpider commented Jun 12, 2018 • edited Loading

toughIQ commented Jun 12, 2018

ChessSpider commented Jun 12, 2018 • edited Loading

toughIQ commented Jun 12, 2018

ChessSpider commented Jun 20, 2018 • edited Loading

toughIQ commented May 29, 2018 •

edited

Loading

ChessSpider commented Jun 11, 2018 •

edited

Loading

ChessSpider commented Jun 12, 2018 •

edited

Loading

ChessSpider commented Jun 12, 2018 •

edited

Loading

ChessSpider commented Jun 20, 2018 •

edited

Loading