Skip to content

fix: install libxml2 and libxslt so the saml-auth plugin loads#627

Open
shreemaan-abhishek wants to merge 1 commit into
apache:masterfrom
shreemaan-abhishek:fix/saml-auth-libxml2-deps
Open

fix: install libxml2 and libxslt so the saml-auth plugin loads#627
shreemaan-abhishek wants to merge 1 commit into
apache:masterfrom
shreemaan-abhishek:fix/saml-auth-libxml2-deps

Conversation

@shreemaan-abhishek

Copy link
Copy Markdown
Contributor

What this fixes

The saml-auth plugin added in APISIX 3.17.0 (apache/apisix#13346) pulls in the lua-resty-saml rock. Its native saml.so dynamically links libxml2.so.2 and libxslt.so.1, which are not installed in the runtime images. As a result every worker logs this on startup and the plugin cannot be used:

[error] load_plugin(): failed to load plugin [saml-auth] err: error loading module 'saml'
from file '/usr/local/apisix/deps/lib/lua/5.1/saml.so':
	libxml2.so.2: cannot open shared object file: No such file or directory

Reproduce on the published image:

docker run --rm --entrypoint sh apache/apisix:3.17.0-debian \
  -c "ldd /usr/local/apisix/deps/lib/lua/5.1/saml.so"
# libxml2.so.2 => not found
# libxslt.so.1 => not found

Fix

Install libxml2 + libxslt1.1 (debian/ubuntu) and libxml2 + libxslt (redhat) as runtime dependencies. After the fix, ldd resolves both libraries and APISIX boots with no saml-auth load errors.

Why CI didn't catch it

The Test route step checked compose/apisix_log/error.log, but that file never exists (the container's error.log is symlinked to stderr), so grep ... && exit 1 always short-circuited and startup errors slipped through green. This PR makes the step grep the container logs instead, so a failing plugin load now fails the build.

Verification

Built the patched debian image locally and booted it against etcd:

ldd .../saml.so   # libxml2.so.2 and libxslt.so.1 both resolved
docker logs <apisix>  # 0 "failed to load plugin [saml-auth]" lines

The saml-auth plugin added in APISIX 3.17.0 (apache/apisix#13346) pulls in
the lua-resty-saml rock, whose native saml.so links libxml2.so.2 and
libxslt.so.1. Those libraries are not present in the runtime images, so
every worker logs "failed to load plugin [saml-auth] ... libxml2.so.2:
cannot open shared object file" on startup and the plugin is unusable.

Install libxml2 + libxslt on debian, ubuntu and redhat images.

Also fix the route test: it grepped compose/apisix_log/error.log, which
never exists (error.log is symlinked to stderr), so the && exit 1 never
fired and startup errors slipped through CI. Grep the container logs
instead.
@shreemaan-abhishek

Copy link
Copy Markdown
Contributor Author

Upstream packaging fix (the proper long-term fix declaring these as package deps): api7/apisix-build-tools#469. This PR is the docker-image-side mitigation so the published 3.17.0 images work now.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants