You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "joltcan (via GitHub)" <gi...@apache.org> on 2026/05/17 10:32:57 UTC
[I] NPE in ApiServlet.skip2FAcheckForUser on SAML login when 2FA is disabled (4.22.0.0) [cloudstack]
joltcan opened a new issue, #13172:
URL: https://github.com/apache/cloudstack/issues/13172
### problem
##### COMPONENT NAME
API, SAML
##### SUMMARY
Every API request issued after a successful `samlSso` callback throws a `NullPointerException` in `ApiServlet.skip2FAcheckForUser`, because `session.getAttribute("2FAuthenticated")` returns `null` and is unboxed directly to `boolean`. The SAML login flow does not set this session attribute, and the 2FA-disabled global settings are not consulted before the unboxing.
Local username/password login is unaffected — only the SAML path triggers the NPE.
##### STEPS TO REPRODUCE
1. Enable SAML2 plugin and configure an IdP (Keycloak in our case).
2. Ensure `enable.user.2fa=false` and `mandate.user.2fa=false`.
3. Authorize a CloudStack user for SAML via `authorizeSamlSso`.
4. Click "Login with SSO" → authenticate at IdP → redirected back to `/client/api?command=samlSso`.
5. Browser immediately fires follow-up API call (e.g. `listIdps`, `login`, etc.).
##### EXPECTED RESULTS
The follow-up API request completes; user lands on the dashboard. A `null` value for the `2FAuthenticated` session attribute should be treated as "2FA not required / not completed" rather than dereferenced as a `boolean`.
##### ACTUAL RESULTS
Use cannot login via SAML:
```java
2026-05-17 10:22:39,650 ERROR [c.c.a.ApiServlet] (qtp1047478056-364:[ctx-50e47dca]) (logid:59e6408b) unknown exception writing api response java.lang.NullPointerException: Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "javax.servlet.http.HttpSession.getAttribute(String)" is null
at com.cloud.api.ApiServlet.skip2FAcheckForUser(ApiServlet.java:512)
at com.cloud.api.ApiServlet.processRequestInContext(ApiServlet.java:361)
at com.cloud.api.ApiServlet$1.run(ApiServlet.java:193)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext$1.call(DefaultManagedContext.java:56)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.callWithContext(DefaultManagedContext.java:103)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.runWithContext(DefaultManagedContext.java:53)
at com.cloud.api.ApiServlet.processRequest(ApiServlet.java:190)
at com.cloud.api.ApiServlet.doPost(ApiServlet.java:149)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:665)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:750)
... (Jetty frames truncated)
```
Client receives the auth failure / error response, lands back on the login screen.
This is my first ticket here, so be gentle please!
### versions
4.22.0 on Debian 13.4
ii default-jdk-headless 2:1.21-76 amd64 Standard Java or Java compatible Development Kit (headless)
ii openjdk-21-jdk-headless:amd64 21.0.11+10-1~deb13u2 amd64 OpenJDK Development Kit (JDK) (headless)
ii openjdk-21-jre-headless:amd64 21.0.11+10-1~deb13u2 amd64 OpenJDK Java runtime, using Hotspot JIT (headless)
##### CONFIGURATION
- SAML2 plugin enabled (`saml2.enabled=true`)
- IdP: Keycloak 26.x, realm `lluw`, SAML client with dedicated `uid` mapper (User Property: `email`)
- 2FA disabled globally: `enable.user.2fa=false`, `mandate.user.2fa=false`
- Single management server, MySQL backend
### The steps to reproduce the bug
1. Enable SAML2 plugin and configure an IdP (Keycloak in our case).
2. Ensure `enable.user.2fa=false` and `mandate.user.2fa=false`.
3. Authorize a CloudStack user for SAML via `authorizeSamlSso`.
4. Click "Login with SSO" → authenticate at IdP → redirected back to `/client/api?command=samlSso`.
5 browser response:
```xml
<loginresponse>
<errorcode>531</errorcode>
<errortext>
Your authenticated user is not authorized for SAML Single Sign-On, please contact your administrator
</errortext>
</loginresponse>
```
##### LOG response
```java
2026-05-17 10:22:39,650 ERROR [c.c.a.ApiServlet] (qtp1047478056-364:[ctx-50e47dca]) (logid:59e6408b) unknown exception writing api response java.lang.NullPointerException: Cannot invoke "java.lang.Boolean.booleanValue()" because the return value of "javax.servlet.http.HttpSession.getAttribute(String)" is null
at com.cloud.api.ApiServlet.skip2FAcheckForUser(ApiServlet.java:512)
at com.cloud.api.ApiServlet.processRequestInContext(ApiServlet.java:361)
at com.cloud.api.ApiServlet$1.run(ApiServlet.java:193)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext$1.call(DefaultManagedContext.java:56)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.callWithContext(DefaultManagedContext.java:103)
at org.apache.cloudstack.managed.context.impl.DefaultManagedContext.runWithContext(DefaultManagedContext.java:53)
at com.cloud.api.ApiServlet.processRequest(ApiServlet.java:190)
at com.cloud.api.ApiServlet.doPost(ApiServlet.java:149)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:665)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:750)
... (Jetty frames truncated)
```
### What to do about it?
### Expected result
The follow-up API request completes; user lands on the dashboard. A `null` value for the `2FAuthenticated` session attribute should be treated as "2FA not required / not completed" rather than dereferenced as a `boolean`.
- `ApiServlet.java:512` reads the `2FAuthenticated` attribute and unboxes without a null check.
- The SAML auth command (`SAML2LoginAPIAuthenticatorCmd`) creates the session but does not set `2FAuthenticated`.
- Suggested fix: replace direct unboxing with `Boolean.TRUE.equals(session.getAttribute("2FAuthenticated"))`, or short-circuit when both `enable.user.2fa` and `mandate.user.2fa` are false.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] NPE in ApiServlet.skip2FAcheckForUser on SAML login when 2FA is disabled (4.22.0.0) [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #13172:
URL: https://github.com/apache/cloudstack/issues/13172#issuecomment-4497830159
@joltcan , I will try to replay your scenario on debian 12 (not that debian 13 is not tested yet, but that might not matter)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] NPE in ApiServlet.skip2FAcheckForUser on SAML login when 2FA is disabled (4.22.0.0) [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on issue #13172:
URL: https://github.com/apache/cloudstack/issues/13172#issuecomment-4656940804
@joltcan , I seem to not be able to make time. Do you see opprtunity to test this on debian12?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] NPE in ApiServlet.skip2FAcheckForUser on SAML login when 2FA is disabled (4.22.0.0) [cloudstack]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on issue #13172:
URL: https://github.com/apache/cloudstack/issues/13172#issuecomment-4470308949
Thanks for opening your first issue here! Be sure to follow the issue template!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] NPE in ApiServlet.skip2FAcheckForUser on SAML login when 2FA is disabled (4.22.0.0) [cloudstack]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on issue #13172:
URL: https://github.com/apache/cloudstack/issues/13172#issuecomment-5330091825
## 🎯 Triage report
Every API request after a successful SAML `samlSso` callback throws an NPE in `ApiServlet.skip2FAcheckForUser`, because `session.getAttribute("2FAuthenticated")` returns null and is unboxed directly to a primitive `boolean`. The SAML login flow never sets that session attribute and 2FA-disabled settings aren't checked first, so SAML users can't use the API/UI at all after login while local username/password login is unaffected.
### 📊 Assessment
| Dimension | Value | Reasoning |
|---|---|---|
| **Type** | type:bug | Clear NPE with full stack trace and precise root-cause analysis (unboxing a null Boolean) |
| **Component** | component:saml | Only the SAML SSO login path is affected; local auth is unaffected |
| **Severity** | Severity:Critical | Breaks all API/UI access for SAML-authenticated users when 2FA is disabled — a full login-flow blocker for that auth method |
| **Labels** | type:bug, component:saml | |
| **Coding agent** | Suitable | Root cause and fix are clearly identified (use `Boolean.TRUE.equals(...)` or short-circuit when 2FA is disabled); narrow, well-scoped change in `ApiServlet.skip2FAcheckForUser` |
### 🔗 Similar issues
- https://github.com/apache/cloudstack/issues/13815 (open, duplicate) — reports the identical NullPointerException in `ApiServlet.skip2FAcheckForUser` for SAML SSO sessions when 2FA is not enabled; same root cause and code path.
<details><summary>💡 Notes and suggestions</summary>
Since #13815 appears to be a duplicate filed later describing the same NPE, maintainers may want to consolidate discussion into one issue (likely this earlier one, #13172) and link/close the duplicate per standard process. This is a good, self-contained coding-agent candidate: fix the null-unboxing in `ApiServlet.skip2FAcheckForUser` and add a regression test for SAML sessions with 2FA disabled.
</details>
> Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/32143747223) · sonnet50 259.3K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues)
>
<details>
<summary>Add this agentic workflows to your repo</summary>
To install this agentic workflow, run
```
gh aw add githubnext/agentics/workflows/daily-issue-triage.md@d7c1dc4b72b00607a67caaffdcc216cb64379cf9
```
</details>
<!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, version: 1.0.52, model: claude-sonnet-5, id: 32143747223, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/32143747223 -->
<!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org