SAML Custom Attributes in Hue

Luke Hebert

July 21, 2017 - 3 minutes read - 495 words

When you authenticate through SAML and Hue immediately shows “Permission Denied” with no further detail, the root cause is usually a mismatch between the attribute names your IDP sends and what Hue expects. The fix is a small mapping file that tells pysaml2 how to translate those custom URIs into local attribute names.

The Problem

After entering credentials at the IDP, Hue displays only “Permission Denied.” Enabling DEBUG logging in Hue reveals the underlying issue:

[18/Jul/2016 04:53:59 -0700] attribute_converter INFO  Unknown attribute name: <?xml version='1.0' encoding='UTF-8'?>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="http://schemas.pwc.com/identity/claims/pwcusertype" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">Internal</saml:AttributeValue></saml:Attribute>
[18/Jul/2016 04:53:59 -0700] attribute_converter INFO  Unknown attribute name: <?xml version='1.0' encoding='UTF-8'?>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="http://schemas.pwc.com/identity/claims/pwcguid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">tgo001</saml:AttributeValue></saml:Attribute>
[18/Jul/2016 04:53:59 -0700] attribute_converter INFO  Unknown attribute name: <?xml version='1.0' encoding='UTF-8'?>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">Tsu Ta</saml:AttributeValue></saml:Attribute>
[18/Jul/2016 04:53:59 -0700] attribute_converter INFO  Unknown attribute name: <?xml version='1.0' encoding='UTF-8'?>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">Go</saml:AttributeValue></saml:Attribute>
[18/Jul/2016 04:53:59 -0700] attribute_converter INFO  Unknown attribute name: <?xml version='1.0' encoding='UTF-8'?>
<saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="http://schemas.pwc.com/identity/claims/organization" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml:AttributeValue xsi:type="xs:string">US</saml:AttributeValue></saml:Attribute>
[18/Jul/2016 04:53:59 -0700] response      DEBUG   --- AVA: {}
[18/Jul/2016 04:53:59 -0700] response      INFO    Subject NameID: <?xml version='1.0' encoding='UTF-8'?>
<saml:NameID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">S-1-5-21-3004155909-1009018432-4119306211-63302</saml:NameID>
[18/Jul/2016 04:53:59 -0700] client_base   INFO    --- ADDED person info ----
[18/Jul/2016 04:53:59 -0700] views         DEBUG   Trying to authenticate the user
[18/Jul/2016 04:53:59 -0700] backends      ERROR   The attributes dictionary is empty
[18/Jul/2016 04:53:59 -0700] backends      DEBUG   attributes: {}
[18/Jul/2016 04:53:59 -0700] backends      DEBUG   attribute_mapping: {u'emailaddress': (u'email',), u'pwcguid': (u'username',)}
[18/Jul/2016 04:53:59 -0700] backends      ERROR   Could not find saml_user value
[18/Jul/2016 04:53:59 -0700] views         ERROR   The user is None

Why This Happens

The IDP sends attributes using custom URI names (for example, http://schemas.pwc.com/identity/claims/pwcguid) without a FriendlyName element. pysaml2 relies on either a known URI mapping or a FriendlyName to translate incoming attributes into local names. When neither is present, it logs “Unknown attribute name” and the resulting attribute dictionary stays empty, so Hue cannot resolve a username and denies access.

The Fix

1. Create the attribute mapping directory

Since you likely already have /opt/cloudera/saml, add a subdirectory for the mapping file:

mkdir /opt/cloudera/saml/attribute_mapping

2. Place the mapping file

Copy the saml-uri.py mapping file into the directory you just created:

cp attachments/saml-uri.py /opt/cloudera/saml/attribute_mapping/
chown hue:hue /opt/cloudera/saml/attribute_mapping/saml-uri.py

Important

Make sure the hue user can read the file. If permissions are wrong, Hue will silently skip the mapping and you will see the same “Permission Denied” error.

3. Update Hue’s service-wide safety valve

In the [libsaml] section, add or update the following keys:

attribute_map_dir=/opt/cloudera/saml/attribute_mapping
user_attribute_mapping='{"huepwcguid":"username", "emailaddress":"email"}'

Note

The only attribute Hue truly needs is the one that maps to username. The email mapping is optional but useful for audit logs.

4. Mapping file contents

The saml-uri.py file tells pysaml2 how to translate the custom URI into a local name:

MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
    "fro": {
        'http://schemas.pwc.com/identity/claims/pwcguid': 'huepwcguid',
    },
    "to": {
        'huepwcguid': 'http://schemas.pwc.com/identity/claims/pwcguid',
    }
}

After applying these changes, restart Hue and test the SAML login flow. The attribute dictionary should now populate correctly, and Hue will resolve the username from the pwcguid claim.