Was anybody successful by integrating xdmod and ondemand ? Both application are using SSO.
I have the following error in the browser:
The value of the ‘Access-Control-Allow-Credentials’ header in the response is ‘’ which must be ‘true’ when the request’s credentials mode is ‘include’.
When I add
Header always set Access-Control-Allow-Credentials: “true”
in apache config on Xdmod node I get error about no Origin header, but it’s still in the apache config:
No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.
And origin shows as null in the browser inspect area.
My apache configs are:
Header always set Access-Control-Allow-Origin: “https://ondemand”
Header always set Access-Control-Allow-Methods: “GET,POST,PUT,DELETE,OPTIONS”
Header always set Access-Control-Allow-Headers: “Content-Type,Authorization,X-Requested-With”
Header always set Access-Control-Expose-Headers “Authorization, Origin, *”
Header always set Access-Control-Allow-Credentials: “true”
I do have
domains = “https://my-ondemand”
in /etc/xdmod/portal_settings.ini on xdmod server.
On my ondemand web-interface I see Timeout error and it says I need to login to Xdmod server even if I’m already login.
TypeError: Failed to fetch Please ensure you are logged into Open XDMoD first, and then try again.
If I click on the link it will take me to Xdmod server in my logged in session.
In the inspect area of the web-browser I see:
Access to fetch at ‘https://my-xdmod/rest/v1/users/current’ from origin ‘https://my-ondemand’ has been blocked by CORS policy: No ‘Access-Control-Allow-Origin’ header is present on the requested resource. If an opaque response serves your needs, set the request’s mode to ‘no-cors’ to fetch the resource with CORS disabled.
If I use https://my-xdmod/rest/v1/users/current I can see my user info. Origin filed in the browser is the same as settings in my portal.ini file.
Because of this CORS error I started experimenting with the headers, but it didn’t help.
Both of my sites xdmod and ondemand use SSO login. Is it supported method of authentication for integration between Xdmod and Ondemand?
Does anyone use SSO and XDMOD / Ondemand integration successfully?
Yes we use Keycloak OIDC - which is step 3 in that document. What type of SSO do you use?
I looked it up in XDMoD and here’s how they’re setting those headers - based on what they read from the configuration ini. So there’s something off here because it should be reading from that ini file directly.
Maybe there’s a syntax error in the ini structure?
I cannot see our /etc/xdmod/portal_settings.ini because I don’t have the permissions, but I did check our puppet configurations and see we list out many hosts here.
Here are the headers I get when I request to XDMoD. What headers do you get? Note we’re running version 10 and I’d have to lookup what version this integration requires but I’d guess at least 9.
I know there’s an issue with Shibboleth that it’s not complete SSO - meaning you have to authenticate with XDMoD as well. Though I don’t know for sure that’s your issue.
Credentials should have been sent in a cookie header your XDMoD’s apache recognizes.
It looks like it’s erroring out in /usr/share/xdmod/classes/Rest/Controllers/BaseControllerProvider.php on this:
// If role requirements were not given, then the only check to perform
// is that the user is not a public user.
$isPublicUser = $user->isPublicUser();
if (empty($requirements) && $isPublicUser) {
throw new UnauthorizedHttpException('xdmod', self::EXCEPTION_MESSAGE);
}
Another thing I notice I don’t see cookies being passed during the request. I was using fiddler to inspect every request and was checking headers and cookies.
In succfull connections I see these cookies:
PHPSESSID
SimpleSAML
SimpleSAMLAuthToken
xdmod_token
And in unsuccessful ones I don’t see any cookies.
Is it something I need to fix on SSO server like allow it or in my apache config?
