search

mesosphere / traefik-forward-auth

219 stars 47 forks source link

"groups session data is missing, re-authenticating" after adding groups to session #25

Closed brokenjacobs closed 4 years ago

brokenjacobs commented 4 years ago

Trying the v2 codebase since I push group claims from my IDP. And here is what happens on every auth request: ime="2020-03-19T22:36:49Z" level=info msg="creating group claims session with groups: [WebApps.LCS.Access.User.Group K8S.LCS.Admin.User.Group]" source_ip=10.203.53.248 time="2020-03-19T22:36:49Z" level=info msg="groups session data is missing, re-authenticating" source_ip=10.203.53.248 I can verify the forward_auth_claims cookie is being set and sent in the browser, and I even tried renaming it, and it goes back and forth with the corrected name.

It seems like it is decoding the cooking into the session but getting a null value. I'm not sure how that is happening. Any clues?

brokenjacobs commented 4 years ago

Turning up debug: I see the cookie in: level=debug msg="Handling callback" headers="....

But not in: level=debug msg="Authenticate request" headers="

brokenjacobs commented 4 years ago

Save the session: https://github.com/mesosphere/traefik-forward-auth/blob/370a655a9fe24323de1e05f348de16213598f319/internal/server.go#L318 Implementation: https://github.com/mesosphere/traefik-forward-auth/blob/370a655a9fe24323de1e05f348de16213598f319/internal/server_test.go#L54

So... guessing this all doesn't work yet?

brokenjacobs commented 4 years ago

ping?

geiseri commented 4 years ago

this seems like what i am seeing on #23

brokenjacobs commented 4 years ago

looks like this shouldn't be a 'release' as the implementation is incomplete.

jr0d commented 4 years ago

@brokenjacobs Sorry, I've been away from this for a while. Group sessions do work, though they require a SESSION_KEY to be set. We were not checking properly that the SESSION_KEY existed before setting up the group claims session; resulting in this behavior.

brokenjacobs commented 3 years ago

I hadn't checked back in but it looks like this has been resolved now? Yay!

brokenjacobs commented 3 years ago

nope. added a SESSION_KEY setting 32 characters long, and it is still not working. Same error messages, on 2.0.5.