[JIRA] (JENKINS-50016) Contents of saml-sp-metadata.xml changes whenever jenkins service is restarted locking users out

[atulkpa...@yahoo.com (JIRA)]

Title: Message Title

atul patel created an issue   Jenkins / JENKINS-50016 Contents of saml-sp-metadata.xml changes whenever jenkins service is restarted locking users out Issue Type: Bug Assignee: Ivan Fernandez Calvo Components: saml-plugin Created: 2018-03-08 12:50 Environment: Host Machine : Ubuntu Xenial (16.04) , hosted in AWS. Jenkins : ver. 2.89.4 SAML Plugin : saml-1.0.5 Labels: SAML2 saml exception Priority: Major Reporter: atul patel Jenkins setup was configured to talk to AD via SAML,  Users could login via SAML and Jenkins could show AD groups associated with users. All working as expected. A plugin update was available which required Jenkins to be restarted. Upon initiating the plugin update and requesting Jekins to restart resulted in users being locked out with an OOPS message. Restarting Jenkins service either via the WebUI or manually from the backend (systemctl restart) appears to re-generate the contents (x509Certificate data) in JENKINS_HOME/saml-sp-metadata.xml . Thus user is locked out with the following OOPs being reported; org.pac4j.saml.exceptions.SAMLException: Authentication response is not success ; actual urn:oasis:names:tc:SAML:2.0:status:Responder Not sure if regenerating the contents of saml-sp-metadata.xml is expected behaviour by design for perhaps security reasons?   Possible Workarounds; Send new JENKINS_HOME/saml-sp-metadata.xml  file to IT team to import into AD server - need to confirm this works. Attempt to restore a backup copy of JENKINS_HOME/saml-sp-metadata.xml  - attempted but this didn't work. Add Comment   This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.