<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p><br>
</p>
<div class="moz-cite-prefix">On 3/30/20 5:35 PM, Cris Rockwell
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div class="">Hello Shibboleth Developers</div>
<div class=""><br class="">
</div>
<div class="">Here is a project under way using OpenSAML to build
a service provider module for Apache Sling within Felix OSGI. <a
href="https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler"
class="" moz-do-not-send="true">https://github.com/cmrockwell/sling-whiteboard-saml/tree/sling-saml2-service-provider/saml-handler</a> After
a few weeks of effort, my SP is working, but still needs a lot
of work. It would be my honor if any of you experienced in Java
development would review some of my OpenSAML code. <br>
</div>
</blockquote>
<p><br>
</p>
<p>I don't know anything about Sling or OSGi. But building a SAML
SP is a ton of work. There's lots of stuff to know. The
consequences of getting it wrong is that you application will be
vulnerable. If you're going to do this, you really need to do an
in-depth read of the SAML specifications. And understand it all.
There's no shortcut around that.</p>
<p>I don't know that environment, but if I were you, I would
investigate and consider whether there is an existing known-good
SAML SP implementation that could be used instead of developing
your own.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu">
<div class=""><br class="">
</div>
<div class="">1. While the <i class="">Guide to OpenSAML V3</i> was
a very useful primer, and I referenced the example project
pretty heavily.</div>
</blockquote>
<p><br>
</p>
<p>Just FYI, v4 was released recently, and you'd definitely want to
use that. It has new SP-centric components that are essential to
what you are trying to do. <br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu">
<div class=""> That demo project uses a hard-coded Java Keystore
(/resources/SPKeystore.jks) Can you make any recommendation or
refer me to reference projects that would make this
configurable? <br>
</div>
</blockquote>
<p><br>
</p>
<p>I don't know what kind of configurability you mean. In
Shibboleth, we don't generally use Java keystores. We have
component support to use certs and keys directly stored in the
filesystem and loaded via various types of CredentialResolvers and
Spring support code. For peer credentials (e.g. validating a
signature you receive), we pretty much use SAML Metadata
exclusively, which has its own set of support components.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:B3A2930C-2CB8-4598-82DE-03DEAC691E78@umich.edu">
<div class=""><br class="">
</div>
<div class="">2. The OpenSAML calls in
AuthenticationHandlerSAML2.java could use your expertise… <a
href="https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java"
class="" moz-do-not-send="true">https://github.com/cmrockwell/sling-whiteboard-saml/blob/sling-saml2-service-provider/saml-handler/src/main/java/org/apache/sling/auth/saml2/AuthenticationHandlerSAML2.java</a></div>
<br>
</blockquote>
<p><br>
</p>
<p>Well, just glancing at the main part that you really, really,
really have to get right... In activate(), where you seem to be
processing the Response that has been submitted to the ACS
endpoint, it seems the only SAML processing you are doing is
decrypting the Assertion and validating its signature. That's
about 5 % of what you need worry about.</p>
<p>Screwing that up will lead to your app being completely
vulnerable to compromise. You really have to fully understand the
processing requirements of SAML, and then implement them. For the
former you really need to read and understand all the relevant
parts of the SAML specs.</p>
<p>For the latter, as of v4, OpenSAML has most or all of the
SP-centric components you would need to do that. But you have to
put them together in the right ways, and configure them
appropriately, etc. That is likely way more than I or any of the
Shib team can describe in an email exchange.</p>
<p>What I could point you to is the new SAML authentication flow
support in the IdP that uses those components. It's not quite
exactly what you are doing here, because of the IdP-acting-as-SP
aspect, but the SP parts are essentially the same as what you'd
need to do.</p>
<p>Understanding it all means at the very least Spring Framework and
Spring Webflow. The SAML authn flow is here:</p>
<p><a class="moz-txt-link-freetext" href="http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master">http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-flow.xml;hb=refs/heads/master</a>
<br>
</p>
<p>and the direct beans it references are here:</p>
<p><a class="moz-txt-link-freetext" href="http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master">http://git.shibboleth.net/view/?p=java-identity-provider.git;a=blob;f=idp-conf/src/main/resources/system/flows/authn/saml-authn-beans.xml;hb=refs/heads/master</a></p>
<p>There's lots of other beans referenced from those and that live
across many files in the IdP project, but that's where to start.<br>
</p>
<p>What you need to know about for the SP side of things is mostly
in the ProcessResponse action. Pay particular attention to the
HandleResponse and ValidateAssertions steps.</p>
<p>That's the pointers I can provide. If/when you get to the point
of having specific questions, you can post them to the list.<br>
</p>
<p>--Brent<br>
</p>
</body>
</html>