Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-55683

Endless loop on login when using OpenID plugin after upgrading to 2.160 / 2.150.2, preventing user authentication

    XMLWordPrintable

Details

    Description

      Our users where unable to login using OpenID after upgrading our Jenkins instance from 2.159 to 2.160. Downgrading to 2.159 makes the issue disappear.

      From a HTTP perspective, Jenkins forwards the user to the OpenID provider URL, which authenticates the user and redirects him back to Jenkins, where a 403 is returned. Which, in turn, causes Jenkins to redirect the user to the OpenID provider, resulting in an endless loop.

      Unfortunately the logs do not yield any hints. Nevertheless here they are, newest log messages on top:

       

      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.shaded.apache.http.client.protocol.ResponseProcessCookies processCookies
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Starting discovery on URL identifier: http://openid.example.org/user
      # Here the loop starts again.
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.discovery.Discovery discover
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Received positive auth response.
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.consumer.ConsumerManager verify
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Verifying authentication response...
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.consumer.ConsumerManager verify
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Return URL: https://jenkins.example.org/jenkins/securityRealm/finishLogin matches realm: https://jenkins.example.org/jenkins/securityRealm/finishLogin
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.server.RealmVerifier match
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Creating authentication request for OP-endpoint: https://openid.example.org/simpleid/ claimedID: http://specs.openid.net/auth/2.0/identifier_select OP-specific ID: http://specs.openid.net/auth/2.0/identifier_select
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.consumer.ConsumerManager authenticate
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Associated with https://openid.example.org/simpleid/ handle: 5c41bcf00008983de08c93d6
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.consumer.ConsumerManager associate
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Trying to associate with https://openid.example.org/simpleid/ attempts left: 4
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.consumer.ConsumerManager associate
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Discovered 1 OpenID endpoints.
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.discovery.Discovery discover
      Jan 18 12:48:00 ourJenkins jenkins[29449]: INFO: Yadis discovered 1 endpoints from: https://openid.example.org/
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.discovery.yadis.YadisResolver discover
      Jan 18 12:48:00 ourJenkins jenkins[29449]: Jan 18, 2019 12:48:00 PM org.openid4java.shaded.apache.http.client.protocol.ResponseProcessCookies processCookies
      Jan 18 12:47:59 ourJenkins jenkins[29449]: INFO: Starting discovery on URL identifier: https://openid.example.org/
      # Loop start.

      Attachments

        Issue Links

          is duplicated by

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-55686 Updating to 2.150.2 breaks openid plugin

          • Blocker - Blocks development and/or testing work, production could not run.
          • Closed
          is related to

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-55669 Auth plugin doesn't work after upgrade to Jenkins 2.150.2

          • Blocker - Blocks development and/or testing work, production could not run.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-55668 Unable to login with Bitbucket Oauth plugin after Jenkins update (2.150.2)

          • Major - Major loss of function.
          • Resolved
          links to

          Web Link #14 in openid

          Activity

            Ascending order - Click to sort in descending order
            flow Florian Schmaus created issue -
            flow Florian Schmaus made changes -
            Field Original Value New Value
            Environment Jenkins 2.160
            flow Florian Schmaus made changes -
            Component/s core [ 15593 ]
            rdesmond Ryan Desmond added a comment -

            I am using the Bitbucket OAuth 0.7, and just updated from 2.150.1 to 2.150.2 (it looks likethe security patch causing your problem was backported to the LTS release).  I see the same problem.

            rdesmond Ryan Desmond added a comment - I am using the Bitbucket OAuth 0.7, and just updated from 2.150.1 to 2.150.2 (it looks likethe security patch causing your problem was backported to the LTS release).  I see the same problem.
            rdesmond Ryan Desmond added a comment -

            JENKINS-55669 and JENKINS-55668 are variations of this on the LTS.

            rdesmond Ryan Desmond added a comment - JENKINS-55669 and JENKINS-55668 are variations of this on the LTS.
            flow Florian Schmaus made changes -
            Link This issue is related to JENKINS-55669 [ JENKINS-55669 ]
            flow Florian Schmaus made changes -
            Link This issue is related to JENKINS-55668 [ JENKINS-55668 ]
            danielbeck Daniel Beck added a comment -

            Noted in https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+the+SECURITY-901+fix

            FYI wfollonier

            danielbeck Daniel Beck added a comment - Noted in https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+the+SECURITY-901+fix FYI wfollonier
            danielbeck Daniel Beck made changes -
            Labels security-901
            danielbeck Daniel Beck made changes -
            Link This issue is duplicated by JENKINS-55686 [ JENKINS-55686 ]
            wfollonier Wadeck Follonier made changes -
            Component/s core [ 15593 ]
            wfollonier Wadeck Follonier made changes -
            Labels security-901 regression security-901
            wfollonier Wadeck Follonier made changes -
            Priority Critical [ 2 ] Blocker [ 1 ]
            wfollonier Wadeck Follonier added a comment -

            PR proposed: #14

            wfollonier Wadeck Follonier added a comment - PR proposed: #14
            wfollonier Wadeck Follonier made changes -
            Remote Link This issue links to "#14 in openid (Web Link)" [ 22223 ]
            flow Florian Schmaus made changes -
            Summary Endless loop on login when using OpenID plugin after upgrading to 2.160, preventing user authentication Endless loop on login when using OpenID plugin after upgrading to 2.160 / 2.150.2, preventing user authentication
            wfollonier Wadeck Follonier made changes -
            Status Open [ 1 ] In Progress [ 3 ]
            wfollonier Wadeck Follonier made changes -
            Status In Progress [ 3 ] In Review [ 10005 ]
            wfollonier Wadeck Follonier made changes -
            Assignee Kohsuke Kawaguchi [ kohsuke ] t stepanchuk [ step ]
            wfollonier Wadeck Follonier made changes -
            Assignee t stepanchuk [ step ] Stephen Connolly [ stephenconnolly ]
            stephenconnolly Stephen Connolly made changes -
            Assignee Stephen Connolly [ stephenconnolly ] Wadeck Follonier [ wfollonier ]
            wfollonier Wadeck Follonier added a comment -

            Version 2.3 is released, will be available in update-center in ~30min.

            wfollonier Wadeck Follonier added a comment - Version 2.3 is released, will be available in update-center in ~30min.
            wfollonier Wadeck Follonier made changes -
            Resolution Fixed [ 1 ]
            Status In Review [ 10005 ] Resolved [ 5 ]

            People

              wfollonier Wadeck Follonier
              flow Florian Schmaus
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: