openid-based login broken since upgrade to 8.0.0?

[decathorpe]

Browsing the URL that used to work with older bodhi versions: https://bodhi.fedoraproject.org/login?method=openid

This returns a HTTP 500 / Internal Server Error page now.

[mattiaverga]

Not sure what's going on there. The openid authentication seems to be handled totally by pyramid-fas-openid and I cannot even see any line in the logs when the HTTP 500 / Internal Server Error page is triggered. Maybe @abompard has some ideas and can solve this in two seconds?

[decathorpe]

Thanks for looking into it!

Looks like I will soon need to bite the bullet anyway and implement OIDC or GSSAPI auth for fedora-update-feedback :(

[abompard]

Yeah it looks like the log configuration is wrong, it does not log requests. I'll try to fix that

[abompard]

OK I got the logs back in, and I see a traceback!

2024-02-22 15:37:02,476 ERROR [gunicorn.error][ThreadPoolExecutor-0_0] Error handling request /dologin.html?openid=https%3A%2F%2Fid.fedoraproject.org%2F
Traceback (most recent call last):
  File "/usr/lib/python3.11/site-packages/gunicorn/workers/gthread.py", line 271, in handle
    keepalive = self.handle_request(req, conn)
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/gunicorn/workers/gthread.py", line 323, in handle_request
    respiter = self.wsgi(environ, resp.start_response)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/paste/deploy/config.py", line 291, in __call__
    return self.app(environ, start_response)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/pyramid/router.py", line 270, in __call__
    response = self.execution_policy(environ, self)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/pyramid/router.py", line 276, in default_execution_policy
    return router.invoke_request(request)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/pyramid/router.py", line 248, in invoke_request
    request._process_response_callbacks(response)
  File "/usr/lib/python3.11/site-packages/pyramid/request.py", line 85, in _process_response_callbacks
    callback(self, response)
  File "/usr/lib/python3.11/site-packages/pyramid/session.py", line 258, in set_cookie_callback
    self._set_cookie(response)
  File "/usr/lib/python3.11/site-packages/pyramid/session.py", line 325, in _set_cookie
    serializer.dumps((self.accessed, self.created, dict(self)))
  File "/usr/lib/python3.11/site-packages/webob/cookies.py", line 659, in dumps
    cstruct = self.serializer.dumps(appstruct) # will be bytes
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/site-packages/webob/cookies.py", line 560, in dumps
    return bytes_(json.dumps(appstruct), encoding='utf-8')
                  ^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/__init__.py", line 231, in dumps
    return _default_encoder.encode(obj)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/encoder.py", line 200, in encode
    chunks = self.iterencode(o, _one_shot=True)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/encoder.py", line 258, in iterencode
    return _iterencode(o, 0)
           ^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/json/encoder.py", line 180, in default
    raise TypeError(f'Object of type {o.__class__.__name__} '
TypeError: Object of type YadisServiceManager is not JSON serializable

It does look familiar.

[abompard]

Yeah I'm betting it's the default serializer that was switched to JSON in Pyramid 2.0 that's causing the problem, but I thought we had fixed that a long time ago to avoid having non-json-serializable stuff in the session.

[mattiaverga]

Yeah, I see it was handled in https://github.com/fedora-infra/bodhi/issues/4356 but pyramid_fas_openid is still used for login?method=openid calls... should we drop openid authentication?

[abompard]

Yeah I think so... Sorry @decathorpe !

[decathorpe]

I understand :(

I know OpenID support was only kept for backwards compatibility, but I didn't know that I'd have to deal with this so soon 🫣

[abompard]

Yeah... You can have a look at how the bodhi client handles OIDC, if that can help.

[geraldosimiao]

@decathorpe you know how fedora-easy-karma handles the auth process? It seems not to be affected, its working correctly until now.

[decathorpe]

I think fedora-easy-karma got kerberos and / or OIDC support since it uses the official bodhi client bindings?

[geraldosimiao]

I think it is this yeah https://pagure.io/fedora-easy-karma/blob/master/f/fedora-easy-karma.py It seems it uses some oraculum-endpoint, I don't know what this is... But when I used it the first time, it gave me the link for getting a api key at my Fedora account page, and then I paste it at the terminal and since then I don't need to validate it anymore.

[decathorpe]

If bodhi-server is not going to fix the OpenID endpoint, should it be removed and documented that it's no longer working?