[JIRA] (IDP-2109) Incorrect top-level status code for NoAuthnContext response

[Vlad Mencl (Jira)]

Vlad Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-2109?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 ) IDP-2109 ( https://shibboleth.atlassian.net/browse/IDP-2109?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 ) Incorrect top-level status code for NoAuthnContext response ( https://shibboleth.atlassian.net/browse/IDP-2109?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.3.0 Assignee: Unassigned Created: 14/May/23 10:03 PM Priority: Trivial Reporter: Vlad Mencl ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A9e33c654-fa34-43c9-a1c1-fcc1c32d3528 )

Hi,

I stumbled upon this when configuring REFEDS MFA on our IdPs.

According to SAML Version 2.0 Errata 05 ( https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html ) E65: Second-level StatusCode:
{noformat}

If none of the specified classes or declarations can be satisfied in accordance with the rules below, then the responder MUST return a <Response> message with a *top-level <StatusCode> value of urn:oasis:names:tc:SAML:2.0:status:Responder and MAY return a* second-level <StatusCode> of urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext.

{noformat}

However, I can see that the IdP responds with:

{code}
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" />
</saml2p:StatusCode>
<saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
</saml2p:Status>
{code}

I.e., it uses a Requester top-level code, even though the specification asks for Responder.

I can see an entry matching the observed behaviour in idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/saml-utilities.xml.

This is not causing anything else to break (not something I’d know of) … but since I spotted the implementation does not follow the spec, I thought I should at least raise it to have it recorded somewhere.

Hope this report is useful.

Cheers,
Vlad

( https://shibboleth.atlassian.net/browse/IDP-2109#add-comment?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-2109#add-comment?atlOrigin=eyJpIjoiMDBlNzBhNWZkZGI1NDY4ZGI3ODg4NDI5MmFjYWIyYzgiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:a5851ae )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230515/59e37ecf/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-8549e86a-34f8-4e83-9bd8-36218d4cae38
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230515/59e37ecf/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-13c639b3-883b-4983-b578-bdeeb8984cfb
Type: image/png
Size: 446 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230515/59e37ecf/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-2fcf8ec6-68fe-4cbf-9796-bdbc550ff3fb
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230515/59e37ecf/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-665c3256-828f-4fb6-9868-1cb50cd90178
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230515/59e37ecf/attachment-0007.png>