Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-4195

SAML2token saved in CTS with hex tokenId but read without converting to hex

    Details

    • Sprint:
      Sprint 76 - Sustaining
    • Support Ticket IDs:

      Description

      I am trying to use SAML failover. I have setup an external (OpenDJ) CTS and have enables SAML fail over. I have two OpenAM instances behind a load balancer both connecting to the same OpenDJ.

      When I login in OpenAM with a SAML assertion with SAMLId of, e.g., 6388b327-58b5-4c85-99f3-5c050bfa76c4 I find it is saved in the CTS with a coreTokenId of 36333838623332372d353862352d346338352d393966332d356330353062666137366334. This is the hex version of the SamlId.

      However, when I login with the same SAML assertion on the second OpenAM instance OpenAM reads the CTS with the samlId, without converting it to HEX. It can therefore not find it in CTS and will allow the login.

      To be able to keep working I changed (in a local copy) in SAML2CTSPersistentStore.retrieveSAML2Token:

      // Retrieve the SAML2 Token from the Repository using the SAML2 Primary Key.
      // In the save of the SAML token the key is hex encoded therefore we have
      // to do that here too before we try to retrieve it. That it did not
      // happen is a bug in OpenAM which we (TomTom) have fixed locally
      String encodedKey = new KeyConversion().encodeKey(samlKey);
      Token token = persistentStore.read(encodedKey);
      SAMLToken samlToken = tokenAdapter.fromToken(token);
      return samlToken.getToken();
      

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                peter.major Peter Major [X] (Inactive)
                Reporter:
                joza Joost Zalmstra [X] (Inactive)
              • Votes:
                4 Vote for this issue
                Watchers:
                6 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - Not Specified
                  Not Specified
                  Logged:
                  Time Spent - 6h
                  6h