idpv3 testing: clientIP in audit logs and consent jdbc ?

[Tom Zeller]

> On Feb 3, 2015, at 6:06 AM, Jarno Huuskonen <jarno.huuskonen at uef.fi> wrote:
> 
> Hi,
> 
>> On Tue, Feb 03, Jarno Huuskonen wrote:
>> On Sat, Jan 31, Cantor, Scott wrote:
>>>> The retries are probably there to deal with storage write conflicts, not
>>>> timeouts, so changing it would be bad. Have to work out if there's a way to
>>>> tell the difference. New exception type maybe.
>>> 
>>> Actually, it's a bug in the JPA code. It's returning false from the create() operation instead of throwing, so the consent action is interpreting that as a duplicate insert and not a storage error.
>> 
>> Is this something that can be "fixed" in idp/opensaml code or is the
>> bug deeper in hibernate/java/jpa code ?
>> 
>> BTW I created this mysql table for consent (found it from IDP-584):
>> create table StorageRecords (
>> context varchar(255) not null,
>> `key` varchar(255) not null,
>> expiration bigint,
>> value varchar(255) not null,
>> version bigint not null,
>> primary key (context, `key`));
>> 
>> After creating this table "consent" still fails to write results to db:
>> Is it possible that "key" column is not quoted in mysql query ?
>> (Maybe setting GLOBALLY_QUOTED_IDENTIFIERS would help
>> (https://docs.jboss.org/hibernate/orm/4.2/javadocs/org/hibernate/cfg/AvailableSettings.html#GLOBALLY_QUOTED_IDENTIFIERS))
> 
> (Replying to myself).
> Adding:
>      <property name="jpaProperties">
>        <props>
>          <prop key="hibernate.globally_quoted_identifiers">true</prop>
>        </props>
>      </property>
> 
> to "<bean
> id="shibboleth.consent.ConsentStorageService.EntityManagerFactory""
> 
> and consent from mysql works. Instead of using
> hibernate.globally_quoted_identifiers is it possible to create a hibernate
> mapping file to map "key" column to something that's not a reserved
> keyword ?

I actually don't know. I also wasn't sure if that Hibernate property was "supported" or not, meaning suitable for production use.

> Consent creates _key_idx records to StorageRecords table.
> Value for these _key_idx is something like
> ["uid:entityID1","uid:entityID2"] ... the value column is varchar(255).
> 
> Does consent handle if/when _key_idx value is longer than varchar(255)?
> (For example In our old uApprove Db I have consent to closer to 50
> entityIds --> this creates a string lot longer than 255 chars).

Well, no.

Keep in mind that the target storage system for this release was client-side cookies, not a server-side database. The max number of consent records setting would "control" the length of the index key, but obviously that is not what you want if that's -1.

I think that's a fourth bug for server-side consent storage, thank you for testing. If you'd like to create another issue, thanks, otherwise I will when not mobile.