Project

General

Profile

Actions

tickets #88816

closed

openqa login via openid redirects me to mirrorcache-eu.opensuse.org

Added by meissner@suse.de over 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Core services and virtual infrastructure
Target version:
-
Start date:
2021-02-19
Due date:
% Done:

100%

Estimated time:

Description

HI,

Logging in to openqa.opensuse.org via OpenID instead logs me into mirrorcache-eu.opensuse.org, but not openqa.

Ciao, Marcus


Related issues 2 (0 open2 closed)

Related to openSUSE admin - tickets #88798: Login to openQA not possible (request to localhost instead of openqa.opensuse.org)Closedbmwiedemann2021-02-19

Actions
Related to openSUSE admin - tickets #88751: Problem login into openqa.suse.de and openqa.opensuse.orgResolvedbmwiedemann2021-02-182021-03-05

Actions
Actions #1

Updated by cboltz over 3 years ago

  • Category set to Core services and virtual infrastructure
  • Assignee set to bmwiedemann
Actions #2

Updated by bmwiedemann over 3 years ago

  • Assignee changed from bmwiedemann to andriinikitin

It works here atm.
We had this before. Andrii Nikitin is the developer+admin of mirrorcache.

Actions #3

Updated by andriinikitin over 3 years ago

I blame ipsilon , because problem randomly raises for some period of time and then disappears, without any changes from mirrorcache side.
Moreover, today for me it did redirect to localhost when I tried to login to both openqa.o.o or mirrorcache.o.o
And a colleague of mine did share the same experience few days ago.

@bmwiedemann is there chance you send me ipsilon logs for today, at least for andriinikitin log attempts and maybe meissner?

Actions #4

Updated by andriinikitin over 3 years ago

Btw these are times (probably CET, but may be UTC) where login did misbehave:
2021-02-17 08:03:33
2021-02-17 08:20:13
2021-02-18 09:45:52
2021-02-18 10:13:44
2021-02-18 10:18:44
2021-02-18 11:46:11
2021-02-18 12:14:30
2021-02-18 12:55:12
2021-02-18 12:56:07
2021-02-18 13:20:06
2021-02-18 13:51:42
2021-02-18 14:11:50
2021-02-18 15:54:35
2021-02-18 16:05:55
2021-02-18 19:27:37
2021-02-18 20:20:30
2021-02-18 22:31:24
2021-02-19 09:58:58
2021-02-19 10:01:27
2021-02-19 10:30:35

Actions #5

Updated by andriinikitin over 3 years ago

  • Assignee changed from andriinikitin to bmwiedemann

Current known cases are (Where users try to log in -> where they are redirected):

  1. openqa.opensuse.org -> mirrorcache-eu.opensuse.org
  2. openqa.suse.de -> mirrorcache-eu.opensuse.org
  3. local instance of openqa -> mirrorcache-eu.opensuse.org
  4. local instance of mirrorcache -> openqa.opensuse.org
  5. local instance of mirrorcache -> localhost
  6. mirrorcache-eu.opensuse.org -> localhost

I was trying to debug log provided by Bernard and see a case with somebody's openqa instance, where the user gets a page containing:

[Fri Feb 19 10:30:01.977542 2021] [wsgi:error] [pid 29902] [remote 192.168.47.21:48512] <h4>You are being asked to login by http://sleposbuilder2.suse.cz/</h4>

and then get this confirmation about new provider for the same request:

[Fri Feb 19 10:30:19.594603 2021] [wsgi:error] [pid 29902] [remote 192.168.47.21:48958] <p>The OpenID relying party <b>https://mirrorcache-eu.opensuse.org/</b> is asking

I cannot imagine client's (mis)configuration which will result in such behavior.

I believe people more often land onto mirrorcache instance, because it sends requests to id.opensuse.org more often than necessary.
I am addressing this particular issue, so the problem should occur less frequently.
( https://github.com/andrii-suse/MirrorCache/pull/78 )
But I still think there is some concurrency issue at ipsilon side. Hopefully it will be less visible after my change.

Actions #6

Updated by cboltz over 3 years ago

The "current known cases" list is incomplete - for example, ticket #88798 is about openqa.opensuse.org -> localhost

Actions #7

Updated by okurz over 3 years ago

  • Related to tickets #88798: Login to openQA not possible (request to localhost instead of openqa.opensuse.org) added
Actions #8

Updated by okurz over 3 years ago

  • Private changed from Yes to No
Actions #9

Updated by okurz over 3 years ago

  • Related to tickets #88751: Problem login into openqa.suse.de and openqa.opensuse.org added
Actions #10

Updated by bmwiedemann over 3 years ago

  • Status changed from New to Feedback
  • % Done changed from 0 to 50

I moved our transactions sqlite DB to mariadb.
Also properly packaged up my custom patches from pagure.io/forks/bmwiedemann/ipsilon devel branch
and dist-upgraded to 15.2

The interesting question now is, if it keeps working when more mirrorcache logins happen again.

Actions #11

Updated by okurz over 3 years ago

thanks for the update. Yes, seems to make sense to await that feedback.

Actions #12

Updated by tinita over 3 years ago

I tried to login to https://openqa.opensuse.org/ over 10 times half an hour ago, and it always prompted me with

The OpenID relying party http://127.0.0.1:3110/ is asking to authorize access to <myuser>

Reloading redirected me to http://127.0.0.1:3110/

Actions #13

Updated by andriinikitin over 3 years ago

Just an observation - today me and a colleague see often an error 'time_bad_sig: Return_to signature is not valid.' when trying to login to mirrorcache-eu.opensuse.org and mirrorcache-us.opensuse.org .
It let me trough after several attempts.
For reference - example signature used: openid.return_to=https://mirrorcache-eu.opensuse.org/response?oic.time=1622111887-fc18d886a6853dcb5e9e&openid.sig=V8h1e66hDPlF4ygY0LPGAo2gFaI=
Both machines were updated to leap 15.3 recently(, not sure if that matters).

Actions #14

Updated by lrupp about 3 years ago

  • Status changed from Feedback to Closed
  • % Done changed from 50 to 100

Bernhard fixed this a while ago.

Closing here.

Actions #15

Updated by tinita over 2 years ago

It happens for me and @osukup again right now :(

Actions

Also available in: Atom PDF