<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 2/17/19 9:13 PM, o haya wrote:<br>
</div>
<blockquote type="cite"
cite="mid:1035741925.766408.1550456007115@mail.yahoo.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;"><br>
</div>
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;">What I have been able to do thus far
is implement a Java app that can produce a SAML response message
that includes an signed assertion and that looks like it matches
some SAML response messages that I have captured from previous
testing with OAM federation. <br>
</div>
</blockquote>
<p><br>
</p>
<p>Well, if you're implementing an Identity Provider, as it sounds
like you're doing, there's no substitute for reading the SAML 2
specification. Otherwise you're probably going to make mistakes
that you don't even know you're making. OpenSAML is just a
toolkit library, it doesn't auto-magically do everything you need
to know.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:1035741925.766408.1550456007115@mail.yahoo.com"><br>
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;"><br>
</div>
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;">...<br>
</div>
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;"><span> Base64.Encoder encoder
= Base64.getUrlEncoder(); <br>
</span></div>
</blockquote>
<br>
<p>The correct Base64 variant to use with SAML is not that one,
which is the newer URL- and filename- safe version (used in JOSE,
JWT and friends). SAML specifies the use of just the old
"standard" Base64 encoding. (Which you may find in the SAML
specs...) Read on, however.<br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:1035741925.766408.1550456007115@mail.yahoo.com">
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;"><span> String str =
encoder.encodeToString(samlResponse.getBytes()); <br>
String str2 = "SAMLResponse=" + str +
"&RelayState=https%3A%2F%2Fsandboxdtm01.xxx.dev%3A38443%2Ftest.html";<br>
System.out.println("\n\n========================================\nBASE64-Encoded
string:\n");<br>
System.out.println(str2);<br>
</span>
<div><span>
System.out.println("\n============================================\n");
</span></div>
<div><span></span><br>
</div>
<div>....<br>
</div>
<span> <br>
</span>
<div>The resulting 'str2' value looks like (following is a
snippet of an example):</div>
<div><br>
</div>
<div><span>SAMLResponse=PD94.....cDpSZXNwb25zZT4=&RelayState=https%3A%2F%2Fsandboxdtm01.gxaws.dev%3A38443%2Ftest.html</span></div>
<div><span><br>
</span></div>
<div><span></span>and I send that 'str2' value as the content
body in a POST to the OAM SP endpoint, which results in the
'system error'.</div>
</div>
</blockquote>
<p><br>
</p>
<p>If you're implementing a standard SAML 2 IdP doing the Browser
SSO Profile, that's not correct. SAML 2 protocol messages are
conveyed by what are called bindings. What you are doing above
doesn't conform to any standard SAML 2 binding. From your
description it sounds like you are probably trying to implement
the SAML 2 HTTP POST binding, but that's not at all how you do
it. See the SAML 2 Bindings specification.<br>
</p>
<p><br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:1035741925.766408.1550456007115@mail.yahoo.com">
<div class="ydpff0e4a34yahoo-style-wrap"
style="font-family:Helvetica Neue, Helvetica, Arial,
sans-serif;font-size:16px;">
<div><br>
</div>
<br>
<div>Also, part of the reason I am asking the above (besides the
error stacktraces mentioning Base64) is that, from the logging
of the "good" captures that I did with OAM previously, it
looks like the SAMLResponse that is being sent in the "good"
tests end with TWO equal signs ('==') whereas the Base64
strings I am seeing from my code seem to have only one equal
('=') at the end, which is making me wondering if I should be
doing different for the Base64 encoding?</div>
</div>
<br>
</blockquote>
<p><br>
</p>
<p>That's not really significant. The number of '=' padding chars
on the end of Base64-encoded data is determined indirectly by the
number of bytes that were encoded. So it will vary depending on
the actual data. That's not a problem.</p>
<p>You really ought to go back and consult the specs so you
fundamentally understand the requirements of SAML, including the
profile you're trying to implement. Trying to "reverse engineer"
this by looking at wire traces, etc is likely to lead you astray,
and lead to at best an incorrect implementation, and at worst to
an insecure one. This is security middleware, after all.<br>
</p>
<p>You might also consider why you're trying to write a SAML IdP in
the first place, given that there are a number of good
implementations already available, including free open-source ones
like Shibboleth (our project) and SimpleSAMLphp, as well as
others.</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
</body>
</html>