<html><head></head><body><div class="ydpe6fd707cyahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div></div>
<div>Hi,</div><div><br></div><div>It's hard to explain "Why?" I am doing what I am trying to do, but your guesses were somewhat close. I do understand what you are saying, and I had suggested that if "they" wanted to do this, they should just go ahead and help our partner stand up an IDP on their end instead, but I was over-ridden and so, naturally, I got stuck with it :)...</div><div><br></div><div>You are also correct that, protocol- (or binding-) wise, what I am trying to get working is something that acts like the HTTP POST binding, but that is compatible with our OAM SP-side, at least to the point of getting the SP to process the SAML Response that we send to it. <br></div><div><br></div><div>To be frank, I am not 100% sure that this is going to be possible yet, because I think that there is other "stuff" (headers, cookies, etc.) that the Oracle SP requires, but, for now, I am just trying to get the SP to not throw a fit when it sees the message that I am sending to it (and I'm not even 100% sure if THAT is possible, yet).</div><div><br></div><div>Thanks for your comments.</div><div><br></div><div>Jim<br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div>
</div><div id="ydp77ae2c15yahoo_quoted_1043988062" class="ydp77ae2c15yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Monday, February 18, 2019, 5:41:46 PM EST, Brent Putman <putmanb@georgetown.edu> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div id="ydp77ae2c15yiv4622011301"><div>
<p><br clear="none">
</p>
<div class="ydp77ae2c15yiv4622011301moz-cite-prefix">On 2/17/19 9:13 PM, o haya wrote:<br clear="none">
</div>
<blockquote type="cite">
</blockquote></div><div><div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><br clear="none">
</div>
<div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">What I have been able to do thus far
is implement a Java app that can produce a SAML response message
that includes an signed assertion and that looks like it matches
some SAML response messages that I have captured from previous
testing with OAM federation. <br clear="none">
</div>
<p><br clear="none">
</p>
<p>Well, if you're implementing an Identity Provider, as it sounds
like you're doing, there's no substitute for reading the SAML 2
specification. Otherwise you're probably going to make mistakes
that you don't even know you're making. OpenSAML is just a
toolkit library, it doesn't auto-magically do everything you need
to know.<br clear="none">
</p>
<p><br clear="none">
</p>
<blockquote type="cite"><br clear="none">
<div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><br clear="none">
</div>
<div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;">...<br clear="none">
</div>
<div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><span> Base64.Encoder encoder
= Base64.getUrlEncoder(); <br clear="none">
</span></div>
</blockquote>
<br clear="none">
<p>The correct Base64 variant to use with SAML is not that one,
which is the newer URL- and filename- safe version (used in JOSE,
JWT and friends). SAML specifies the use of just the old
"standard" Base64 encoding. (Which you may find in the SAML
specs...) Read on, however.<br clear="none">
</p>
<p><br clear="none">
</p>
<p><br clear="none">
</p>
<blockquote type="cite">
<div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><span> String str =
encoder.encodeToString(samlResponse.getBytes()); <br clear="none">
String str2 = "SAMLResponse=" + str +
"&RelayState=https%3A%2F%2Fsandboxdtm01.xxx.dev%3A38443%2Ftest.html";<br clear="none">
System.out.println("\n\n========================================\nBASE64-Encoded
string:\n");<br clear="none">
System.out.println(str2);<br clear="none">
</span>
<div><span>
System.out.println("\n============================================\n");
</span></div>
<div><span></span><br clear="none">
</div>
<div>....<br clear="none">
</div>
<span> <br clear="none">
</span>
<div>The resulting 'str2' value looks like (following is a
snippet of an example):</div>
<div><br clear="none">
</div>
<div><span>SAMLResponse=PD94.....cDpSZXNwb25zZT4=&RelayState=https%3A%2F%2Fsandboxdtm01.gxaws.dev%3A38443%2Ftest.html</span></div>
<div><span><br clear="none">
</span></div>
<div><span></span>and I send that 'str2' value as the content
body in a POST to the OAM SP endpoint, which results in the
'system error'.</div>
</div>
</blockquote>
<p><br clear="none">
</p>
<p>If you're implementing a standard SAML 2 IdP doing the Browser
SSO Profile, that's not correct. SAML 2 protocol messages are
conveyed by what are called bindings. What you are doing above
doesn't conform to any standard SAML 2 binding. From your
description it sounds like you are probably trying to implement
the SAML 2 HTTP POST binding, but that's not at all how you do
it. See the SAML 2 Bindings specification.</p><div class="ydp77ae2c15yiv4622011301yqt3956630241" id="ydp77ae2c15yiv4622011301yqtfd16094"><br clear="none">
</div><div class="ydp77ae2c15yiv4622011301yqt3956630241" id="ydp77ae2c15yiv4622011301yqtfd20035">
<p><br clear="none">
</p>
<p><br clear="none">
</p>
</div><blockquote type="cite"><div class="ydp77ae2c15yiv4622011301yqt3956630241" id="ydp77ae2c15yiv4622011301yqtfd01574">
</div><div class="ydp77ae2c15yiv4622011301ydpff0e4a34yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div class="ydp77ae2c15yiv4622011301yqt3956630241" id="ydp77ae2c15yiv4622011301yqtfd72479">
<div><br clear="none">
</div>
<br clear="none">
<div>Also, part of the reason I am asking the above (besides the
error stacktraces mentioning Base64) is that, from the logging
of the "good" captures that I did with OAM previously, it
looks like the SAMLResponse that is being sent in the "good"
tests end with TWO equal signs ('==') whereas the Base64
strings I am seeing from my code seem to have only one equal
('=') at the end, which is making me wondering if I should be
doing different for the Base64 encoding?</div></div>
</div>
<br clear="none">
</blockquote>
<p><br clear="none">
</p>
<p>That's not really significant. The number of '=' padding chars
on the end of Base64-encoded data is determined indirectly by the
number of bytes that were encoded. So it will vary depending on
the actual data. That's not a problem.</p>
<p>You really ought to go back and consult the specs so you
fundamentally understand the requirements of SAML, including the
profile you're trying to implement. Trying to "reverse engineer"
this by looking at wire traces, etc is likely to lead you astray,
and lead to at best an incorrect implementation, and at worst to
an insecure one. This is security middleware, after all.<br clear="none">
</p>
<p>You might also consider why you're trying to write a SAML IdP in
the first place, given that there are a number of good
implementations already available, including free open-source ones
like Shibboleth (our project) and SimpleSAMLphp, as well as
others.</p><div class="ydp77ae2c15yiv4622011301yqt3956630241" id="ydp77ae2c15yiv4622011301yqtfd27876">
<p><br clear="none">
</p>
<p><br clear="none">
</p>
<p><br clear="none">
</p>
</div></div></div>-- <br clear="none">To unsubscribe from this list send an email to <a shape="rect" href="mailto:dev-unsubscribe@shibboleth.net" rel="nofollow" target="_blank">dev-unsubscribe@shibboleth.net</a></div>
</div>
</div></body></html>