Shibboleth SSO failure after 3.3.9 upgrade

We’ve been running indico for several years with an SSO integration via a shibboleth SP on the same system. After upgrading from 3.3.8 to 3.3.9 I’m now getting this error after a successful auth:

2025-12-18 13:29:18,048  01ddda8aca8545ef  -       indico.flask - ERROR errors.py:113 -- 'uwsgi._Input' object has no attribute 'encode'

Traceback (most recent call last):
  File "/opt/indico/.venv/lib/python3.12/site-packages/flask/app.py", line 917, in full_dispatch_request
    rv = self.dispatch_request()
         ^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/flask/app.py", line 902, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/indico/web/rh.py", line 366, in wrapper
    return rh.process()
           ^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/indico/web/rh.py", line 312, in process
    res = self._do_process()
          ^^^^^^^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/indico/web/rh.py", line 280, in _do_process
    rv = self._process()
         ^^^^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/indico/web/rh.py", line 356, in _process
    return self.func()
           ^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/flask_multipass/util.py", line 120, in decorator
    return func(*args, **kwargs)
           ^^^^^^^^^^^^^^^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/flask_multipass/providers/shibboleth.py", line 66, in _shibboleth_callback
    attributes = {k: v for k, v in mapping if k.startswith(self.attrs_prefix)}
                                   ^^^^^^^
  File "/opt/indico/.venv/lib/python3.12/site-packages/flask_multipass/providers/shibboleth.py", line 23, in _fix_data
    v = v.encode('latin1').decode('utf-8')
        ^^^^^^^^
AttributeError: 'uwsgi._Input' object has no attribute 'encode'

{'data': {'get': {},
          'headers': {'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
                      'Accept-Encoding': 'gzip, deflate, br, zstd',
                      'Accept-Language': 'en-US,en;q=0.9',
                      'Cache-Control': 'max-age=0',
                      'Connection': 'keep-alive',
                      'Cookie': '_ga_80LEENNF41=GS1.1.1744146044.2.0.1744146048.0.0.0; '
                                '_ga_57RY46P9ME=GS2.1.s1755798148$o1$g0$t1755798153$j55$l0$h0; '
                                '_ga_YTCBNVFYWX=GS2.1.s1755798154$o1$g0$t1755798159$j55$l0$h0; '
                                '_ga_TWNELFG28Y=GS2.1.s1755798159$o1$g0$t1755798168$j51$l0$h0; '
                                '_ga_VTG41K7QVZ=GS2.1.s1755801438$o2$g0$t1755801438$j60$l0$h0; '
                                '_ga=GA1.2.630243099.1708992298; '
                                '_ga_PMP6DZHDPB=GS2.2.s1760981591$o1$g0$t1760981591$j60$l0$h0; '
                                'indico_session=<redacted>; '
                                '_shibsession_64656661756c7468747470733a2f2f696e6469636f2e746573742e6b752e656475=_112cc2a8de4448a816af46acc1d6a30c',
                      'Host': 'indico.test.ku.edu',
                      'Referer': 'https://login.qa.ku.edu/',
                      'Sec-Ch-Ua': '"Google Chrome";v="143", '
                                   '"Chromium";v="143", "Not A(Brand";v="24"',
                      'Sec-Ch-Ua-Mobile': '?0',
                      'Sec-Ch-Ua-Platform': '"macOS"',
                      'Sec-Fetch-Dest': 'document',
                      'Sec-Fetch-Mode': 'navigate',
                      'Sec-Fetch-Site': 'same-site',
                      'Upgrade-Insecure-Requests': '1',
                      'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X '
                                    '10_15_7) AppleWebKit/537.36 (KHTML, like '
                                    'Gecko) Chrome/143.0.0.0 Safari/537.36'},
          'json': None,
          'post': {},
          'url': {}},
 'endpoint': '_flaskmultipass_shibboleth_shib-sso',
 'id': '01ddda8aca8545ef',
 'ip': '10.125.240.59',
 'method': 'GET',
 'referrer': 'https://login.qa.ku.edu/',
 'rh': 'RHSimple',
 'time': '2025-12-18T13:29:18.071191',
 'url': 'https://indico.test.ku.edu/login/shib-sso/shibboleth',
 'user': None,
 'user_agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) '
               'AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 '
               'Safari/537.36'}

It looks like /opt/indico/.venv/lib/python3.12/site-packages/flask_multipass/providers/shibboleth.py did change between 3.3.8 and 3.3.9

Yep, known bug, as a workaround you can run pip install 'flask-multipass==0.11.1' to install the fixed version of flask-multipass.

1 Like

awesome, works great!