idpv3 testing: clientIP in audit logs and consent jdbc ?

[Jarno Huuskonen]

Hi,

On Tue, Feb 03, Jarno Huuskonen wrote:
> On Sat, Jan 31, Cantor, Scott wrote:
> > > The retries are probably there to deal with storage write conflicts, not
> > > timeouts, so changing it would be bad. Have to work out if there's a way to
> > > tell the difference. New exception type maybe.
> > 
> > Actually, it's a bug in the JPA code. It's returning false from the create() operation instead of throwing, so the consent action is interpreting that as a duplicate insert and not a storage error.
> 
> Is this something that can be "fixed" in idp/opensaml code or is the
> bug deeper in hibernate/java/jpa code ?
> 
> BTW I created this mysql table for consent (found it from IDP-584):
> create table StorageRecords (
>  context varchar(255) not null,
>  `key` varchar(255) not null,
>  expiration bigint,
>  value varchar(255) not null,
>  version bigint not null,
>  primary key (context, `key`));
> 
> After creating this table "consent" still fails to write results to db:
> Is it possible that "key" column is not quoted in mysql query ?
> (Maybe setting GLOBALLY_QUOTED_IDENTIFIERS would help
> (https://docs.jboss.org/hibernate/orm/4.2/javadocs/org/hibernate/cfg/AvailableSettings.html#GLOBALLY_QUOTED_IDENTIFIERS))

(Replying to myself).
Adding:
      <property name="jpaProperties">
        <props>
          <prop key="hibernate.globally_quoted_identifiers">true</prop>
        </props>
      </property>

to "<bean
id="shibboleth.consent.ConsentStorageService.EntityManagerFactory""

and consent from mysql works. Instead of using
hibernate.globally_quoted_identifiers is it possible to create a hibernate
mapping file to map "key" column to something that's not a reserved
keyword ?

Consent creates _key_idx records to StorageRecords table.
Value for these _key_idx is something like
["uid:entityID1","uid:entityID2"] ... the value column is varchar(255).

Does consent handle if/when _key_idx value is longer than varchar(255)?
(For example In our old uApprove Db I have consent to closer to 50
entityIds --> this creates a string lot longer than 255 chars).

-Jarno

-- 
Jarno Huuskonen