HUE SAML error after upgrade to CDP 7.1.6

Question

Hello,

After we upgraded from CDH 5.15 to CDP 7.1.6 runtime. The HUE SAML login got broken. It gives an error below. Any ideas?

ValueError at /saml2/login/ Could not deserialize key data. Request Method: GET Request URL: http://xxxxx.com:8889/saml2/login/?next=/ Django Version: 1.11.29 Exception Type: ValueError Exception Value: Could not deserialize key data. Exception Location: /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/build/env/lib/python2.7/site-packages/cryptography-2.9-py2.7-linux-x86_64.egg/cryptography/hazmat/backends/openssl/backend.py in _handle_key_loading_error, line 1382 Python Executable: /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/build/env/bin/python2.7 Python Version: 2.7.5 Python Path: ['/opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/desktop/libs/libsaml/attribute-maps',

ebeb · Accepted Answer

Darren,

This got resolved with the help of Cloudera Support engineer. There were couple of issues. First the IDP and SP entity_id should be different values. Next there is a SAML property that needs to be set by the IDP which is <saml:AudienceRestriction><saml:Audience /></saml:AudienceRestriction></saml:Conditions>

After setting the Audience property to the entity_id of the SP the error went away and HUE SAML is working again.

See below error before setting Audience property:

response DEBUG conditions: <?xml version='1.0' encoding='UTF-8'?>

<saml:Conditions xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" NotBefore="2021-06-02T16:02:45.573Z" NotOnOrAfter="2021-06-02T17:02:45.573Z"><saml:AudienceRestriction><saml:Audience /></saml:AudienceRestriction></saml:Conditions>

[02/Jun/2021 09:02:45 -0700] client_base ERROR XML parse error: 'NoneType' object has no attribute 'strip'

[02/Jun/2021 09:02:45 -0700] middleware INFO Processing exception: 'NoneType' object has no attribute 'strip': Traceback (most recent call last):

File "/opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/build/env/lib/python2.7/site-packages/Django-1.11.29-py2.7.egg/django/core/handlers/base.py", line 185, in _get_response

This looks like a breaking change from CDH 5.15 HUE saml to CDP 7.1.6 as we never set the Audience value in CDH 5.x in IDP before.

ebeb · Answer

Some more progress:It appears CDP 7.1.6 we need to create the unencrypted dummy key file as below.To create an unencrypted private key file from an encrypted key we have to run:openssl rsa -in ssl_certificate.key -out ssl_certificate-nocrypt.keyThe output file (ssl_certificate-nocrypt.key) is an unencrypted PEM-formatted key that is used for the parameter key_file=/opt/cloudera/security/saml/ssl_certificate-nocrypt.keyNow this error is gone: Could not deserialize key data.But we are getting different error below: AttributeError at /saml2/acs/'NoneType' object has no attribute 'strip'Request Method: POSTRequest URL: http://xxxx.com:8889/saml2/acs/Django Version: 1.11.29Exception Type: AttributeErrorException Value:'NoneType' object has no attribute 'strip'Exception Location: /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/build/env/lib/python2.7/site-packages/pysaml2-4.9.0-py2.7.egg/saml2/response.py in for_me, line 212Python Executable: /opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/build/env/bin/python2.7Python Version: 2.7.5Python Path:['/opt/cloudera/parcels/CDH-7.1.6-1.cdh7.1.6.p0.10506313/lib/hue/desktop/libs/libsaml/attribute-maps',-------------------------------------------------Below is the python code in line 212 which errors out:202 def for_me(conditions, myself):203 """ Am I among the intended audiences """204205 if not conditions.audience_restriction: # No audience restriction206 return True207208 for restriction in conditions.audience_restriction:209 if not restriction.audience:210 continue211 for audience in restriction.audience:212 if audience.text.strip() == myself:213 return True214 else:215 # print("Not for me: %s != %s" % (audience.text.strip(),216 # myself))217 pass218219 return False

Sign up

Please use your Cloudera account.

Login to the community

Please use your Cloudera account.