SAML and OAUTH federated logins not working on 24.6.0 #10275
Description
Describe the bug
After my update to 24.6.0, I have an OAuth connection to CILogon.org that will now no longer bind to users. I also have a SAML source that throws exceptions related to caching and pickling.
Interestingly, these exceptions are only exposed to the log in 24.4.2. After the update to 24.6.0, you can find the exceptions in the docker logs, but the traceback is not in the web UI log.
To Reproduce
Have previously working SAML and OAuth logins that can be connected to accounts. Update to 24.6.0 - now the SAML throws exceptions and neither successfully create a connection.
When using the "connected services page" The OAuth or SAML reports success as a notification and in the log, but then is not attached.
Logs
This is the debug log using the SAML source from the login page on 24.6.0:
server-1 | {"auth_via": "unauthenticated", "domain_url": "users.xxxxxxxxxx.com", "event": "sending event to sentry", "exc": "TypeError("cannot pickle 'RestrictedElement' object")", "host": "users.xxxxxxxxxxx.com", "level": "debug", "logger": "authentik.lib.sentry", "pid": 25812, "request_id": "d9339c3b96c64326b493f2b7ace68500", "schema_name": "public", "source_logger": null, "timestamp": "2024-06-27T17:35:28.957618"}
If I instead try from my admit account to connect to my SAML source user, I get a log entry that the source was connected, but the connected services page does not reflect this and the login will not work for the account.
This stack trace is from 24.4.2. 24.6.0 only shows the last line in the docker logs.
Stacktrace from authentik
Traceback (most recent call last):
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 518, in thread_handler
raise exc_info[1]
File "/ak-root/venv/lib/python3.12/site-packages/django/core/handlers/base.py", line 253, in _get_response_async
response = await wrapped_callback(
^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 468, in __call__
ret = await asyncio.shield(exec_coro)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/current_thread_executor.py", line 40, in run
result = self.fn(*self.args, **self.kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/asgiref/sync.py", line 522, in thread_handler
return func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/sentry_sdk/integrations/django/views.py", line 84, in sentry_wrapped_callback
return callback(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/views/generic/base.py", line 104, in view
return self.dispatch(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/utils/decorators.py", line 48, in _wrapper
return bound_method(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/views/decorators/csrf.py", line 65, in _view_wrapper
return view_func(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django/views/generic/base.py", line 143, in dispatch
return handler(request, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/sources/saml/views.py", line 165, in post
return processor.prepare_flow_manager().get_flow()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/core/sources/flow_manager.py", line 180, in get_flow
return self.handle_auth(connection)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/core/sources/flow_manager.py", line 288, in handle_auth
return self._prepare_flow(
^^^^^^^^^^^^^^^^^^^
File "/authentik/core/sources/flow_manager.py", line 269, in _prepare_flow
plan = planner.plan(self.request, kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/authentik/flows/planner.py", line 206, in plan
cache.set(cache_key(self.flow, user), plan, CACHE_TIMEOUT)
File "/ak-root/venv/lib/python3.12/site-packages/django_redis/cache.py", line 29, in _decorator
return method(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django_redis/cache.py", line 81, in set
return self.client.set(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django_redis/client/default.py", line 143, in set
nvalue = self.encode(value)
^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django_redis/client/default.py", line 461, in encode
value = self._serializer.dumps(value)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/ak-root/venv/lib/python3.12/site-packages/django_redis/serializers/pickle.py", line 29, in dumps
return pickle.dumps(value, self._pickle_version)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
builtins.TypeError: cannot pickle 'RestrictedElement' object
Version and Deployment (please complete the following information):
- authentik version: 2024.4.2
- Deployment: [e.g. docker-compose, helm]
Additional context
Add any other context about the problem here.