Repository navigation
auth_mellon (SAML) authentication fails after upgrade to 26.5.1 (from 26.4.6) #45680
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
saml
Describe the bug
Hi,
Our web server uses auth_mellon to restrict access to certain resources. The following configuration is in use:
<Location />
MellonEnable info
MellonEndpointPath /mellon/
MellonSPMetadataFile /etc/httpd/mellon/urn_sso-test.esat.kuleuven.be.xml
MellonSPPrivateKeyFile /etc/httpd/mellon/urn_sso-test.esat.kuleuven.be.key
MellonSPCertFile /etc/httpd/mellon/urn_sso-test.esat.kuleuven.be.cert
MellonIdPMetadataFile /etc/httpd/mellon/idp_metadata.xml
MellonSecureCookie On
MellonCookieSameSite none
MellonUser uid
</Location>
<Location /restricted>
AuthType Mellon
MellonEnable auth
require valid-user
</Location>
The client is registered on our Keycloak server. Authentication has worked fine this way until we upgraded the system to Keycloak 26.5.1 (from 26.4.6). Since the upgrade, the authentication fails and the following message is logged in the apache error log:
[Tue Jan 20 16:43:18.459760 2026] [auth_mellon:error] [pid 686360:tid 686382] [remote 10.86.18.4:49801] Error processing authn response. Lasso error: [-427] When looking for an assertion we did not found it., SAML Response: StatusCode1="urn:oasis:names:tc:SAML:2.0:status:Success", StatusCode2="(null)", StatusMessage="(null)"
Downgrading the keycloak server to 26.4.6 makes the login work again. Note that the keycloak login itself seems to work, but auth_mellon is apparently no longer able to find some of the information it needs from the SAML response.
Version
26.5.1
Regression
- The issue is a regression
Expected behavior
The login using auth_mellon should work as it did with keycloak 26.4.6 (and the many versions we had before).
Actual behavior
The login seems to work at the keycloak level, but auth_mellon seems unable to find the information it needs from the SAML response:
[Tue Jan 20 16:43:18.459760 2026] [auth_mellon:error] [pid 686360:tid 686382] [remote 10.86.18.4:49801] Error processing authn response. Lasso error: [-427] When looking for an assertion we did not found it., SAML Response: StatusCode1="urn:oasis:names:tc:SAML:2.0:status:Success", StatusCode2="(null)", StatusMessage="(null)"
How to Reproduce?
- Install keycloak 26.4.6 and add a SAML client that uses auth_mellon
- Verify that login on the service protected by auth_mellon works
- Upgrade keycloak to 26.5.1
- Try to login on the resource gain
Anything else?
No response
Activity
rmartinc commentedon Feb 9, 2026
Hi @rtheys! We probably need more information for this. I can configure auth_melon but it will probably work for me if you son't share the specifics of your configuration. That error means that the assertion is not found in the response. Are you encrypting the assertion or similar? Can you see a difference between the keycloak response in 26.4.6 and 26.5.1?
rtheys commentedon Feb 11, 2026
Hi @rmartinc,
I have the following settings configured in keycloak for the auth_mellon client:
Name ID format: transient
Force name ID format: off
Force POST binding: on
Force artifact binding: off
Include authnstatement: on
include onetimeuse condition: off
optimize redirect signing key lookup: off
allow ecp flow: off
sign documents: on
sign assertions: on
signature algorithm: RSA_SHA256
saml signature key name: none
canonicalization method: exclusive
encryption algorithm: aes_128_cbc
key transport algorithm: RSA-OAEP-MGF1P
digest method for OAEP: SHA-1
I have both an encryption and a signing key. Both keys are identical (auth_mellon only allows to specify a single key).
Since the assertions are encrypted, I don't have an easy way to determine of there's a difference between te versions. I was unable to get any further debug information out of auth_mellon.
I will try to gather more information by checking if I can disable the encryption for testing.
Regards,
Rik
17 remaining items
Upgrade santuario to 3.0.6 to fix SANTUARIO-617
rtheys commentedon Feb 12, 2026
Hi,
Glad to hear the issue has been identified.
Using rsa-oaep fails on the auth_mellon client on both 26.4 and 26.5. Maybe auth_mellon doesn't support this (yet).
I guess I will have to wait for the next minor release of Keycloak 26.5 for the newer santuario version?
Regards,
Rik
Upgrade santuario to 3.0.6 to fix SANTUARIO-617
rtheys commentedon Feb 12, 2026
Hi @rmartinc ,
I see this issue has been closed as it's now fixed in 26.6.0. Are there any plans to backport this fix into the 26.5 series?
Regards,
Rik
rmartinc commentedon Feb 13, 2026
@rtheys I added the label backport/26.5, so this will be backported. I have just set it to important to see if it is merged soon in 26.5.4.
Upgrade santuario to 3.0.6 to fix SANTUARIO-617
Upgrade santuario to 3.0.6 to fix SANTUARIO-617