[JIRA] (IDP-1938) c14n for PrincipalName differs in behaviour for saml proxying between v4.1.6 and v4.2.0-20220404.011450-293

Fri Apr 8 03:19:28 UTC 2022

Chris.Phillips at canarie.ca ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ad9c5b0aa-4ee5-45bd-b913-57fd7ee7e854 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1938?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 ) IDP-1938 ( https://shibboleth.atlassian.net/browse/IDP-1938?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 ) c14n for PrincipalName differs in behaviour for saml proxying between v4.1.6 and v4.2.0-20220404.011450-293 ( https://shibboleth.atlassian.net/browse/IDP-1938?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.2.0 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Subject Canonicalization Created: 07/Apr/22 11:19 PM Environment:

Tested platforms: ubuntu20.04LTS, system openjdk

reproduced on Centos7 as well:

openjdk version "11.0.14.1" 2022-02-08 LTS

OpenJDK Runtime Environment 18.9 (build 11.0.14.1+1-LTS)

OpenJDK 64-Bit Server VM 18.9 (build 11.0.14.1+1-LTS, mixed mode, sharing)

Priority: Trivial Reporter: Chris.Phillips at canarie.ca ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3Ad9c5b0aa-4ee5-45bd-b913-57fd7ee7e854 )

Hi.

Upgrading to v4.2.0 highlights a difference in PrincipalName calculation, which was surprising and would like to know a course of action for upgrading.

My thinking is that v4.x is not canonicalizing ‘right’ as compared to v4.2.0. – this newest is likely more accurate since it’s scoped. Notable is that it is already defined in the attribute registry as scoped since the beginning:

> 
> 
> 
> <bean parent="shibboleth.TranscodingProperties">
> 
> 
> 
> <property name="properties">
> 
> 
> 
> <props merge="true">
> 
> 
> 
> <prop key="id">azureName</prop>
> 
> 
> 
> <prop key="transcoder">SAML2ScopedStringTranscoder</prop>
> 
> 
> 
> <prop key=" saml2.name ( http://saml2.name ) "> http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
> </prop>
> 
> 
> 
> <prop
> key="saml2.nameFormat">urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified</prop>
> 
> 
> 
> 
> <prop key="displayName.en">Name</prop>
> 
> 
> 
> <prop key="description.en">Azure UPN of an account expected to be scoped
> thus transcoded that way</prop>
> 
> 
> 
> </props>
> 
> 
> 
> </property>
> 
> 
> 
> </bean>
> 
> 

My request:

* what should be done on upgrades to v4.2.0 for continuity purposes?

* User adjustment on the ldap filter?

* adapt the way the Principal is assigned given the scoping is now more visible in 4.2.0?

Thoughts welcome and recommendations on adaptation on what to apply on the current principle string in the ldap search to remove the scoping in the mean time.

Preconditions:

-working and current v4.1.6 IdP doing SAML proxying against Azure AD and creates canonical principalname as ‘name’ (e.g. ‘cphillips’) and then is used in attribute resolution with LDAP connector for ( *sAMAccountName* =$requestContext.principalName)

Actions taken to:

Performed the in-place upgrade from v4.1.6 to v4.2.0-20220404.011450-293, no errors during update (as expect)

Repeated same login test and SAML proxying resulted in a different c14n with a different principalname output.

* In v4.1.6 the canonicalization of the azureName attribute is ‘cphillips’
* In v4.2.0 it results in azureName as ‘cphillips at canarie.ca’

> 
> 
> 
> V4.1.6 output of canonicalization ‘working’
> 
> 
> 
> DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
> Profile Action SelectSubjectCanonicalizationFlow: Checking
> canonicalization flow c14n/attribute for applicability...
> 2022-04-07 21:48:47,705 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
> Profile Action SelectSubjectCanonicalizationFlow: Selecting
> canonicalization flow c14n/attribute
> 2022-04-07 21:48:47,707 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.authn.impl.AttributeSourcedSubjectCanonicalization:239]
> - Profile Action AttributeSourcedSubjectCanonicalization: Using attribute
> azureName string value cphillips as input to transforms
> 2022-04-07 21:48:47,707 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:221] -
> Profile Action AttributeSourcedSubjectCanonicalization: trimming
> whitespace of input string 'cphillips'
> 2022-04-07 21:48:47,708 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile
> Action DetectIdentitySwitch: No previous session found, nothing to do
> 2022-04-07 21:48:47,708 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:116] - Profile
> Action FinalizeAuthentication: Canonical principal name was established as
> 'cphillips'
> 2022-04-07 21:48:47,708 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:173] - Profile
> Action FinalizeAuthentication: Request did not have explicit
> authentication requirements, result is accepted
> 2022-04-07 21:48:47,708 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:222]
> - Profile Action UpdateSessionWithAuthenticationResult: Creating new
> session for principal cphillips
> 2022-04-07 21:48:47,709 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.session.impl.StorageBackedSessionManager:551] -
> Created new session
> aca66e22de0dc3e94413296fba29755b8019c120b07c4789f032ef8cb140a87d for
> principal cphillips
> 2022-04-07 21:48:47,709 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.session.impl.StorageBackedIdPSession:577] - Saving
> AuthenticationResult for flow authn/SAML in session
> aca66e22de0dc3e94413296fba29755b8019c120b07c4789f032ef8cb140a87d
> 2022-04-07 21:48:47,710 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:223] -
> Attribute Resolver 'ShibbolethAttributeResolver': Initiating attribute
> resolution with label: SAML2/Redirect/SSO
> 2022-04-07 21:48:47,710 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:441] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
> for 'myLDAP'
> 2022-04-07 21:48:47,710 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:450] -
> Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
> dependencies for 'myLDAP'
> 2022-04-07 21:48:47,710 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:396] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector
> myLDAP
> 2022-04-07 21:48:47,712 - 192.168.200.41 - DEBUG
> [net.shibboleth.idp.attribute.resolver.dc.ldap.TemplatedExecutableSearchFilterBuilder:214]
> - Template text (sAMAccountName=$requestContext.principalName) yields
> (sAMAccountName=cphillips)
> 
> 

Post upgrade, this canonicalization occurs:

> 
> 
> 
> V4.2.0 output of canonicalization but not working similarly:
> 
> 
> 
> (suppressed some data fields, but not ‘azureName’
> 
> 
> 
> 2022-04-07 19:20:03,502 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:465] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
> for 'passthroughAttributes'
> 2022-04-07 19:20:03,502 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:474] -
> Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
> dependencies for 'passthroughAttributes'
> 2022-04-07 19:20:03,503 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:420] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector
> passthroughAttributes
> 2022-04-07 19:20:03,503 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.dc.impl.SubjectDataConnector:206] -
> Data Connector 'passthroughAttributes': Extracted 9 IdPAttribute(s)
> 2022-04-07 19:20:03,503 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:225] - Data
> Connector 'passthroughAttributes': produced the following 9 attributes
> during resolution [azureObjectidentifier, azureIdentityprovider,
> azureGivenname, azureAuthnmethodsreferences, azureDisplayname, azureName,
> azureTenantid, azureEmailaddress, azureSurname]
> 2022-04-07 19:20:03,504 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureObjectidentifier':
> Values '[StringAttributeValue{value=SUPPRESED}]'
> 2022-04-07 19:20:03,504 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureIdentityprovider':
> Values '[StringAttributeValue{value= [SUPPRESED}] '|https://sts.windows.net/1cf546ed-f2c8-46ea-b122-2340e67b37a0/%7D%5D']
> 
> 2022-04-07 19:20:03,504 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureGivenname': Values
> '[StringAttributeValue{value=Chris}]'
> 2022-04-07 19:20:03,505 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute
> 'azureAuthnmethodsreferences': Values '[StringAttributeValue{value= http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/unspecified}
> '|http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/unspecified%7D%5D']
> 
> 2022-04-07 19:20:03,505 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureDisplayname': Values
> '[StringAttributeValue{value=Chris Phillips}]'
> 2022-04-07 19:20:03,505 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureName': Values
> '[ScopedStringAttributeValue{value=cphillips, scope=canarie.ca (
> http://scope=canarie.ca ) }]'
> 2022-04-07 19:20:03,506 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureTenantid': Values
> '[StringAttributeValue{value=SUPPRESSED}]'
> 2022-04-07 19:20:03,506 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureEmailaddress': Values
> '[StringAttributeValue{value=Chris.Phillips at canarie.ca}]'
> 2022-04-07 19:20:03,506 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.AbstractDataConnector:229] - Data
> Connector 'passthroughAttributes': Attribute 'azureSurname': Values
> '[StringAttributeValue{value=Phillips}]'
> 2022-04-07 19:20:03,507 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:443] -
> Attribute Resolver 'ShibbolethAttributeResolver': Data connector
> 'passthroughAttributes' resolved the following attributes:
> [azureObjectidentifier, azureIdentityprovider, azureGivenname,
> azureAuthnmethodsreferences, azureDisplayname, azureName, azureTenantid,
> azureEmailaddress, azureSurname]
> 2022-04-07 19:20:03,507 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:465] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving dependencies
> for 'myLDAP'
> 2022-04-07 19:20:03,508 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:474] -
> Attribute Resolver 'ShibbolethAttributeResolver': Finished resolving
> dependencies for 'myLDAP'
> 2022-04-07 19:20:03,508 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:420] -
> Attribute Resolver 'ShibbolethAttributeResolver': Resolving data connector
> myLDAP
> 2022-04-07 19:20:03,511 - 192.168.56.1 - DEBUG
> [net.shibboleth.idp.attribute.resolver.dc.ldap.TemplatedExecutableSearchFilterBuilder:214]
> - Template text (sAMAccountName=$requestContext.principalName) yields ( sAMAccountName=cphillips at canarie.ca
> )
> 
> 

thanks in advance as always.

( https://shibboleth.atlassian.net/browse/IDP-1938#add-comment?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1938#add-comment?atlOrigin=eyJpIjoiMGMwNDgxNzAzOTNhNDIyNjk0MmIxZWNjYWZmY2U2YjMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:943baf4 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/3c530c58/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-ac087e7c-94e2-4ba5-9baf-d73178eec171
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/3c530c58/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-7d864d27-2472-42ab-949e-a9c7181d6f4c
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/3c530c58/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c5857674-a982-4490-aac0-c59b2bd45bed
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/3c530c58/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-ea66c6ef-ee7d-46b9-a81d-db3dab81a232
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220408/3c530c58/attachment-0007.png>