Help with a new OpenSAML SP

[Brent Putman]

On 3/30/20 5:35 PM, Cris Rockwell wrote:
> Hello Shibboleth Developers
>
> Here is a project under way using OpenSAML to build a service 
> provider module for Apache Sling within Felix OSGI. 
> https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler After 
> a few weeks of effort, my SP is working, but still needs a lot of 
> work. It would be my honor if any of you experienced in Java 
> development would review some of my OpenSAML code.


I don't know anything about Sling or OSGi.  But building a SAML SP is a 
ton of work.  There's lots of stuff to know.  The consequences of 
getting it wrong is that you application will be vulnerable.  If you're 
going  to do this, you really need to do an in-depth read of the SAML 
specifications. And understand it all. There's no shortcut around that.

I don't know that environment, but if I were you, I would investigate 
and consider whether there is an existing known-good SAML SP 
implementation that could be used instead of developing your own.


>
> 1. While the /Guide to OpenSAML V3/ was a very useful primer, and I 
> referenced the example project pretty heavily.


Just FYI, v4 was released recently, and you'd definitely want to use 
that.  It has new SP-centric components that are essential to what you 
are trying to do.


> That demo project uses a hard-coded Java Keystore 
> (/resources/SPKeystore.jks) Can you make any recommendation or refer 
> me to reference projects that would make this configurable?


I don't know what kind of configurability you mean.  In Shibboleth, we 
don't generally use Java keystores.  We have component support to use 
certs and keys directly stored in the filesystem and loaded via various 
types of CredentialResolvers and Spring support code.  For peer 
credentials (e.g. validating a signature you receive), we pretty much 
use SAML Metadata exclusively, which has its own set of support components.


>
> 2. The OpenSAML calls in AuthenticationHandlerSAML2.java could use 
> your expertise… 
> https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java
>

Well, just glancing at the main part that you really, really, really 
have to get right... In activate(), where you seem to be processing the 
Response that has been submitted to the ACS endpoint, it seems the only 
SAML processing you are doing is decrypting the Assertion and 
validating its signature.  That's about 5 % of what you need worry about.

Screwing that up will lead to your app being completely vulnerable to 
compromise.  You really have to fully understand the processing 
requirements of SAML, and then implement them.  For the former you 
really need to read and understand all the relevant parts of the SAML 
specs.

For the latter, as of v4, OpenSAML has most or all of the SP-centric 
components you would need to do that.  But you have to put them 
together in the right ways, and configure them appropriately, etc. That 
is likely way more than I or any of the Shib team can describe in an 
email exchange.

What I could point you to is the new SAML authentication flow support 
in the IdP that uses those components.  It's not quite exactly what you 
are doing here, because of the IdP-acting-as-SP aspect, but the SP 
parts are essentially the same as what you'd need to do.

Understanding it all means at the very least Spring Framework and 
Spring Webflow. The SAML authn flow is here:

http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master 


and the direct beans it references are here:

http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master

There's lots of other beans referenced from those and that live across 
many files in the IdP project, but that's where to start.

What you need to know about for the SP side of things is mostly in the 
ProcessResponse action.  Pay particular attention to the HandleResponse 
and ValidateAssertions steps.

That's the pointers I can provide.  If/when you get to the point of 
having specific questions, you can post them to the list.

--Brent

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200402/0132132c/attachment.html>