Project

General

Profile

tickets #88816

openqa login via openid redirects me to mirrorcache-eu.opensuse.org

Added by meissner@suse.de 10 months ago. Updated 4 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Core services and infra
Target version:
-
Start date:
2021-02-19
Due date:
% Done:

100%

Estimated time:

Description

HI,

Logging in to openqa.opensuse.org via OpenID instead logs me into mirrorcache-eu.opensuse.org, but not openqa.

Ciao, Marcus


Related issues

Related to openSUSE admin - tickets #88798: Login to openQA not possible (request to localhost instead of openqa.opensuse.org)Closed2021-02-19

Related to openSUSE admin - tickets #88751: Problem login into openqa.suse.de and openqa.opensuse.orgResolved2021-02-182021-03-05

History

#1 Updated by cboltz 10 months ago

  • Category set to Core services and infra
  • Assignee set to bmwiedemann

#2 Updated by bmwiedemann 10 months ago

  • Assignee changed from bmwiedemann to andriinikitin

It works here atm.
We had this before. Andrii Nikitin is the developer+admin of mirrorcache.

#3 Updated by andriinikitin 10 months ago

I blame ipsilon , because problem randomly raises for some period of time and then disappears, without any changes from mirrorcache side.
Moreover, today for me it did redirect to localhost when I tried to login to both openqa.o.o or mirrorcache.o.o
And a colleague of mine did share the same experience few days ago.

bmwiedemann is there chance you send me ipsilon logs for today, at least for andriinikitin log attempts and maybe meissner?

#4 Updated by andriinikitin 10 months ago

Btw these are times (probably CET, but may be UTC) where login did misbehave:
2021-02-17 08:03:33
2021-02-17 08:20:13
2021-02-18 09:45:52
2021-02-18 10:13:44
2021-02-18 10:18:44
2021-02-18 11:46:11
2021-02-18 12:14:30
2021-02-18 12:55:12
2021-02-18 12:56:07
2021-02-18 13:20:06
2021-02-18 13:51:42
2021-02-18 14:11:50
2021-02-18 15:54:35
2021-02-18 16:05:55
2021-02-18 19:27:37
2021-02-18 20:20:30
2021-02-18 22:31:24
2021-02-19 09:58:58
2021-02-19 10:01:27
2021-02-19 10:30:35

#5 Updated by andriinikitin 10 months ago

  • Assignee changed from andriinikitin to bmwiedemann

Current known cases are (Where users try to log in -> where they are redirected):

  1. openqa.opensuse.org -> mirrorcache-eu.opensuse.org
  2. openqa.suse.de -> mirrorcache-eu.opensuse.org
  3. local instance of openqa -> mirrorcache-eu.opensuse.org
  4. local instance of mirrorcache -> openqa.opensuse.org
  5. local instance of mirrorcache -> localhost
  6. mirrorcache-eu.opensuse.org -> localhost

I was trying to debug log provided by Bernard and see a case with somebody's openqa instance, where the user gets a page containing:

[Fri Feb 19 10:30:01.977542 2021] [wsgi:error] [pid 29902] [remote 192.168.47.21:48512] <h4>You are being asked to login by http://sleposbuilder2.suse.cz/</h4>

and then get this confirmation about new provider for the same request:

[Fri Feb 19 10:30:19.594603 2021] [wsgi:error] [pid 29902] [remote 192.168.47.21:48958] <p>The OpenID relying party <b>https://mirrorcache-eu.opensuse.org/</b> is asking

I cannot imagine client's (mis)configuration which will result in such behavior.

I believe people more often land onto mirrorcache instance, because it sends requests to id.opensuse.org more often than necessary.
I am addressing this particular issue, so the problem should occur less frequently.
( https://github.com/andrii-suse/MirrorCache/pull/78 )
But I still think there is some concurrency issue at ipsilon side. Hopefully it will be less visible after my change.

#6 Updated by cboltz 10 months ago

The "current known cases" list is incomplete - for example, ticket #88798 is about openqa.opensuse.org -> localhost

#7 Updated by okurz 10 months ago

  • Related to tickets #88798: Login to openQA not possible (request to localhost instead of openqa.opensuse.org) added

#8 Updated by okurz 10 months ago

  • Private changed from Yes to No

#9 Updated by okurz 10 months ago

  • Related to tickets #88751: Problem login into openqa.suse.de and openqa.opensuse.org added

#10 Updated by bmwiedemann 9 months ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 50

I moved our transactions sqlite DB to mariadb.
Also properly packaged up my custom patches from pagure.io/forks/bmwiedemann/ipsilon devel branch
and dist-upgraded to 15.2

The interesting question now is, if it keeps working when more mirrorcache logins happen again.

#11 Updated by okurz 9 months ago

thanks for the update. Yes, seems to make sense to await that feedback.

#12 Updated by tinita 7 months ago

I tried to login to https://openqa.opensuse.org/ over 10 times half an hour ago, and it always prompted me with

The OpenID relying party http://127.0.0.1:3110/ is asking to authorize access to <myuser>

Reloading redirected me to http://127.0.0.1:3110/

#13 Updated by andriinikitin 6 months ago

Just an observation - today me and a colleague see often an error 'time_bad_sig: Return_to signature is not valid.' when trying to login to mirrorcache-eu.opensuse.org and mirrorcache-us.opensuse.org .
It let me trough after several attempts.
For reference - example signature used: openid.return_to=https://mirrorcache-eu.opensuse.org/response?oic.time=1622111887-fc18d886a6853dcb5e9e&openid.sig=V8h1e66hDPlF4ygY0LPGAo2gFaI=
Both machines were updated to leap 15.3 recently(, not sure if that matters).

#14 Updated by lrupp 4 months ago

  • Status changed from Feedback to Closed
  • % Done changed from 50 to 100

Bernhard fixed this a while ago.

Closing here.

Also available in: Atom PDF