Login failed, oxTrust wasn't allowed to access user data - Switching auth methods

By: Josh Newlin user 26 Nov 2018 at 9:10 a.m. CST

10 Responses
Josh Newlin gravatar
Hi, I created a [ticket previously](https://support.gluu.org/authentication/6313/tried-doing-smoke-test-every-account-gets-an-error-when-attempting-to-login/) about how to get this issue recovered back to normal. However, now I'm experiencing this issue with every attempt to switch the auth method, so I'm looking at potential causes and ways to fix this issue so I can use basic auth for a short period of time. Here's the oxtrust.log file output where it errors out. Then the login screen has the error "login.errorSessionInvalidMessage". ``` 2018-11-26 14:05:01,184 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.AttributeService] (AttributeService.java:558) - Failed to find attribute 'gluuSLAManager' metadata 2018-11-26 14:05:01,185 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.AttributeService] (AttributeService.java:558) - Failed to find attribute 'memberOf' metadata 2018-11-26 14:05:01,185 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.AttributeService] (AttributeService.java:558) - Failed to find attribute 'oxLastLogonTime' metadata 2018-11-26 14:05:01,185 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.AttributeService] (AttributeService.java:558) - Failed to find attribute 'oxTrustEmail' metadata 2018-11-26 14:05:01,298 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.ImageRepository] (ImageRepository.java:357) - Failed to load blank image. ResourceLoader returned null stream. 2018-11-26 14:05:01,299 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.ImageRepository] (ImageRepository.java:372) - Failed to load blank photo. ResourceLoader returned null stream. 2018-11-26 14:05:01,300 ERROR [qtp985655350-16] [org.gluu.oxtrust.ldap.service.ImageRepository] (ImageRepository.java:388) - Failed to load blank icon. ResourceLoader returned null stream. 2018-11-26 14:05:01,555 ERROR [qtp985655350-16] [org.xdi.service.XmlService] (XmlService.java:93) - Failed to create GluuImage from XML javax.xml.bind.UnmarshalException 2018-11-26 14:05:01,557 ERROR [qtp985655350-16] [org.xdi.service.XmlService] (XmlService.java:93) - Failed to create GluuImage from XML javax.xml.bind.UnmarshalException ``` Any more information necessary, I will include. Thanks! Josh N.
Rhel 7.3
closed

Answers

By Aliaksandr Samuseu staff 26 Nov 2018 at 10:30 a.m. CST

Copy
Aliaksandr Samuseu gravatar
Hi, Josh. Have you tried to clear all cookies related to any domains involved in the flow, and see whether this error will go away?

By Josh Newlin user 26 Nov 2018 at 1:36 p.m. CST

Copy
Josh Newlin gravatar
I'm sorry for the delay, Aliaksandr. We're attempting to get a duplicate environment up to test with, so we don't interfere with users who are using it currently. I will update if your fix was successful or not. Thanks!

By Josh Newlin user 26 Nov 2018 at 1:50 p.m. CST

Copy
Josh Newlin gravatar
Hey Aliaksandr, Clearing cookies etc. did not change the error. Josh N.

By Aliaksandr Samuseu staff 26 Nov 2018 at 2:10 p.m. CST

Copy
Aliaksandr Samuseu gravatar
Got it. Could you please re-submit all clues related to this very issue you've collected so far? It's hard to track just using the previous ticket alone. 1. A screenshot of the error page you're getting 2. What is seen in `oxauth.log` and `oxauth_script.log` (I believe a custom script is involved, right?) If your current "loggingLevel" at "Configuration JSON -> Configuration -> oxAuth" isn't "DEBUG", please set it so, and re-collect those logs by re-trying the failing flow; make sure the trace is recorded at DEBUG level in the logs; ideally, you should provide a complete log to us (if your policies allow this) 3. Please also record a network trace and provide HAR file of it here. You can use steps listed [here](https://www.inflectra.com/support/knowledgebase/kb254.aspx) - please use Firefox for that task, Chrome's HARs are flawed. Also don't forget to set "Persist log" and "Disable cache" checkboxes in the console to save everything, not just the recently loaded page. 4. Please provide refined steps needed to reproduce this issue

By Josh Newlin user 26 Nov 2018 at 2:10 p.m. CST

Copy
Josh Newlin gravatar
Here's a line from within `oxauth.log` which seems to be triggered by a new request to the root url. ``` 2018-11-26 20:09:38,582 ERROR [qtp2008017533-11] [xdi.oxauth.authorize.ws.rs.AuthorizeAction] (AuthorizeAction.java:230) - Failed to get CustomScriptConfiguration. auth_step: 1, acr_values: basic ``` I'm switching the auth method to basic from auth_ldap_server. The basic script is active and valid, but it seems to fail.

By Josh Newlin user 26 Nov 2018 at 2:11 p.m. CST

Copy
Josh Newlin gravatar
I will gather the requested info and put an update once I have it. Thanks!

By Josh Newlin user 26 Nov 2018 at 2:33 p.m. CST

Copy
Josh Newlin gravatar
Actually, I think I found the issue. I wasn't aware that `oxauth_script.log` was available, so I read the logs there and it seemed to be getting a PySyntaxError. So, I checked my modified basic auth script and fixed the tabs (python), and it seems like I don't encounter this issue anymore. Thanks!! TLDR: I had syntax errors in my authentication script and it provoked the whole thing to stop working. It's hard to code python in a text box! Thanks Aliaksandr, you helped point me to the right log file! Josh N.

By Mohib Zico staff 29 Nov 2018 at 7:26 a.m. CST

Copy
Mohib Zico gravatar
Hello Josh, Do you think we can close this ticket?

By Josh Newlin user 29 Nov 2018 at 8:19 a.m. CST

Copy
Josh Newlin gravatar
Of course, I'm closing it now.

By Mohib Zico staff 29 Nov 2018 at 8:27 a.m. CST

Copy
Mohib Zico gravatar
Thanks for taking the ownership, Josh!

Post an answer