Shibboleth v1.8 Not Allowing Login

  • Resolved jmdemuth

    (@jmdemuth)


    7 years, 6 months ago

    I recently updated my Shibboleth plugin to v1.8. After doing that, I was unable to log in. I get the usual WordPress login page with the error message “Unable to create account based on data provided” up at the top. If I click on the “Login with Shibboleth” link, WordPress just takes me back to the same login page.

    Unfortunately, my web-hosting provider’s error log file contains no clues (it is in fact empty, and has remained so while getting the error). My WP Security Audit Log plugin notes failed login attempts for my account and others trying to log in with v1.8.

    I’ve installed this update on three WordPress sites and all give the same result. They are all running WordPress v4.8.1. The good news is that if I restore the v1.7 Shibboleth plugin from backup, users can then log in again.

    Wondering if others are seeing this and if so, is there a fix or workaround? Thanks!

Viewing 5 replies - 1 through 5 (of 5 total)
  • Thread Starter jmdemuth

    (@jmdemuth)

    I did a little tracing through the code. It looks to me like our Shib/web hosting environment stores the Shibboleth username in $_SERVER[“uid”]. In plugin v1.7, it looks like the shibboleth_authenticate_user() function sets the $username variable based on this value.

    However, it the v1.8 plugin, it looks like it’s trying to get the $_SERVER[“uid”] value via the getenv() function with a value of “UID”. This appears to set $username to a boolean “false” value. This is what appears to break the login.

    I’m not quite sure how to fix this, except for suggesting pulling the value from $_SERVER again instead of using getenv(). However, the sites where this is happening are still on PHP v5.x. So I wonder if getenv() not getting the right data is a problem with PHP v5.x? Maybe upgrading to PHP v7 would get around this problem?

    Plugin Author michaelryanmcneill

    (@michaelryanmcneill)

    Thank you for reporting this issue. I’m looking into this now. Can you please cross post your issue to GitHub?

    Plugin Author michaelryanmcneill

    (@michaelryanmcneill)

    @jmdemuth, I’ve been reviewing this and I’m not seeing where the issue is coming in. I’ve just tested on PHP 5.6 without issue. According to the documentation on getenv():

    This function is useful (compared to $_SERVER, $_ENV) because it searches $varname key in those array case-insensitive manner. For example on Windows $_SERVER[‘Path’] is like you see Capitalized, not ‘PATH’ as you expected. So just: <?php getenv(‘path’) ?>

    I’m going to do some additional diagnostic work, but any additional details (operating system, SP configuration, web server, etc.) on your environment would be super helpful.

    Plugin Author michaelryanmcneill

    (@michaelryanmcneill)

    This was resolved with the release of version 1.8.1. You can see the full discussion on GitHub here: https://github.com/michaelryanmcneill/shibboleth/issues/7

    Thread Starter jmdemuth

    (@jmdemuth)

    This is just a follow-up: I did confirm with our web-hosting sysadmins that in our environment we restrict Apache from accessing environment variables for security reasons. This is why using getenv() (as opposed to $_SERVER) in the plugin failed to return any values (for us).

Viewing 5 replies - 1 through 5 (of 5 total)
  • The topic ‘Shibboleth v1.8 Not Allowing Login’ is closed to new replies.