Help with a new OpenSAML SP

Sat Apr 4 11:44:15 EDT 2020

Hi Brent

Thank you so much for taking the time to provide your thoughts in these trying times. I hope you all are well. 

I heard about V4 and see the release notes, but the new version is not in the Maven Central repository. My project is a Maven Reactor module for Apache Sling, and the Slings devs asked me not to add the shib artifact repositories <https://wiki.shibboleth.net/confluence/display/IDP30/GettingStarted#GettingStarted-AddShibbolethrepositoriestoyourPOM> for OpenSAML. Because there is precedent <https://mvnrepository.com/artifact/org.opensaml/opensaml-core> of them being in Maven Central, this is where they wanted to get it. If you pushed V4 to Central, then I would upgrade to that version.

OSGI offers some advantages over traditional Java runtime environments. Major players are building on platforms like these. Others might prefer Spring or commercial products. Those is not interesting to me right now. I am doing this for the sake of the open-source projects that I believe in. Apache Sling, Oak and Felix OSGI are excellent Java frameworks. The support I am get from those developer communities is great. They know Sling and OSGI very well. OpenSAML is the best SAML2 library for Java. Bringing these together could be very powerful! And I hear your words of caution. It was stated repeatedly in the ‘readme,' but let say it again... This is not a production assignment. I am doing it because it is interesting and potentially useful work. As you know, open-source is a team effort to ensure security, quality and advancement are maintained. Developing in the open with as many eyes and brains as possible helps ensure these goals.

Thanks agin!
Cris 

> On Apr 2, 2020, at 3:58 PM, Brent Putman <putmanb at georgetown.edu> wrote:
> 
> 
> On 3/30/20 5:35 PM, Cris Rockwell wrote:
>> Hello Shibboleth Developers
>> 
>> Here is a project under way using OpenSAML to build a service provider module for Apache Sling within Felix OSGI. https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler <https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler> After a few weeks of effort, my SP is working, but still needs a lot of work. It would be my honor if any of you experienced in Java development would review some of my OpenSAML code. 
> 
> I don't know anything about Sling or OSGi.  But building a SAML SP is a ton of work.  There's lots of stuff to know.  The consequences of getting it wrong is that you application will be vulnerable.  If you're going  to do this, you really need to do an in-depth read of the SAML specifications. And understand it all. There's no shortcut around that.
> 
> I don't know that environment, but if I were you, I would investigate and consider whether there is an existing known-good SAML SP implementation that could be used instead of developing your own.
> 
>> 
>> 1. While the Guide to OpenSAML V3 was a very useful primer, and I referenced the example project pretty heavily.
> 
> Just FYI, v4 was released recently, and you'd definitely want to use that.  It has new SP-centric components that are essential to what you are trying to do.  
> 
>> That demo project uses a hard-coded Java Keystore (/resources/SPKeystore.jks) Can you make any recommendation or refer me to reference projects that would make this configurable? 
> 
> I don't know what kind of configurability you mean.  In Shibboleth, we don't generally use Java keystores.  We have component support to use certs and keys directly stored in the filesystem and loaded via various types of CredentialResolvers and Spring support code.  For peer credentials (e.g. validating a signature you receive), we pretty much use SAML Metadata exclusively, which has its own set of support components.
> 
>> 
>> 2. The OpenSAML calls in AuthenticationHandlerSAML2.java could use your expertise…  https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java <https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java>
> 
> Well, just glancing at the main part that you really, really, really have to get right... In activate(), where you seem to be processing the Response that has been submitted to the ACS endpoint, it seems the only SAML processing you are doing is decrypting the Assertion and validating its signature.  That's about 5 % of what you need worry about.
> 
> Screwing that up will lead to your app being completely vulnerable to compromise.  You really have to fully understand the processing requirements of SAML, and then implement them.  For the former you really need to read and understand all the relevant parts of the SAML specs.
> 
> For the latter, as of v4, OpenSAML has most or all of the SP-centric components you would need to do that.  But you have to put them together in the right ways, and configure them appropriately, etc. That is likely way more than I or any of the Shib team can describe in an email exchange.
> 
> What I could point you to is the new SAML authentication flow support in the IdP that uses those components.  It's not quite exactly what you are doing here, because of the IdP-acting-as-SP aspect, but the SP parts are essentially the same as what you'd need to do.
> 
> Understanding it all means at the very least Spring Framework and Spring Webflow. The SAML authn flow is here:
> 
> http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master <http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master> 
> and the direct beans it references are here:
> 
> http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master <http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master>
> There's lots of other beans referenced from those and that live across many files in the IdP project, but that's where to start.
> What you need to know about for the SP side of things is mostly in the ProcessResponse action.  Pay particular attention to the HandleResponse and ValidateAssertions steps.
> 
> That's the pointers I can provide.  If/when you get to the point of having specific questions, you can post them to the list.
> --Brent
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200404/a420b763/attachment.html>