Unnecessary AuthnRequest?
kripp
kripp at compsych.com
Mon Dec 22 13:13:19 EST 2014
Hello, we are implementing IDP initiated POST SSO with a vendor. We are the
SP. I believe they are also using Shibboleth and they are getting a page
that says, "Shibboleth Authentication Request". It is my understanding that
since we are doing IDP initiated that authentication should be taking place
prior to the assertion. We have never had this problem with any other
vendor. If you look at the below logs you will see that we are redirecting
to the RelayState URL and then sending back the "AuthnRequest" which I
believe is the problem. What is causing Shibboleth SP to send back this
tag? "WantAuthnRequestsSigned" property in the IDP metadata which is set to
true? Also please note that I have removed some personal information.
Thanks!
Kyle
2014-12-22 10:22:56 DEBUG Shibboleth.Listener [5513]: dispatching message
(**Removed**/SAML2/POST)
2014-12-22 10:22:56 DEBUG OpenSAML.MessageDecoder.SAML2POST [5513]:
validating input
2014-12-22 10:22:56 DEBUG OpenSAML.MessageDecoder.SAML2POST [5513]: decoded
SAML message:
<samlp:Response ID="_3898d579-ef68-45d3-9fea-2c430db39d08" Version="2.0"
IssueInstant="2014-12-22T16:22:36.422Z"
Destination="https://www.**Removed**.com/saml/**Removed**/Shibboleth.sso/SAML2/POST"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">**Removed**</saml:Issuer><Signature
xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference
URI="#_3898d579-ef68-45d3-9fea-2c430db39d08"><Transforms><Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"
/><Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces
PrefixList="#default samlp saml ds xs xsi"
xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"
/></Transform></Transforms><DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
/><DigestValue></DigestValue></Reference></SignedInfo><SignatureValue>**Removed</SignatureValue><KeyInfo><X509Data><X509Certificate>**Removed**</X509Certificate></X509Data></KeyInfo></Signature><samlp:Status><samlp:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success"
/></samlp:Status><saml:Assertion Version="2.0"
ID="_18c09081-0e01-4cb2-88f1-9b8949d850be"
IssueInstant="2014-12-22T16:22:36.422Z"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><saml:Issuer>**Removed**</saml:Issuer><Signature
xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /><SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /><Reference
URI="#_18c09081-0e01-4cb2-88f1-9b8949d850be"><Transforms><Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"
/><Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><InclusiveNamespaces
PrefixList="#default saml ds xs xsi"
xmlns="http://www.w3.org/2001/10/xml-exc-c14n#"
/></Transform></Transforms><DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"
/><DigestValue>OCEmGmIwe95wPxrs0L83l7Zc2d8=</DigestValue></Reference></SignedInfo><SignatureValue>**Removed**</X509Certificate></X509Data></KeyInfo></Signature><saml:Subject><saml:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">One</saml:NameID><saml:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData
NotOnOrAfter="2014-12-22T16:25:36.422Z"
Recipient="https://www.**Removed**.com//saml/**Removed**/Shibboleth.sso/SAML2/POST"
/></saml:SubjectConfirmation></saml:Subject><saml:Conditions
NotBefore="2014-12-22T16:19:36.422Z"
NotOnOrAfter="2014-12-22T16:25:36.422Z"><saml:AudienceRestriction><saml:Audience>www.**Removed**.com</saml:Audience></saml:AudienceRestriction></saml:Conditions><saml:AuthnStatement
AuthnInstant="2014-12-22T16:22:36.422Z"
SessionIndex="_18c09081-0e01-4cb2-88f1-9b8949d850be"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute
Name="FirstName"><saml:AttributeValue xsi:type="xs:string"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">One</saml:AttributeValue></saml:Attribute><saml:Attribute
Name="LastName"><saml:AttributeValue xsi:type="xs:string"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">Two</saml:AttributeValue></saml:Attribute><saml:Attribute
Name="Email"><saml:AttributeValue xsi:type="xs:string"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">email at email.com</saml:AttributeValue></saml:Attribute><saml:Attribute
Name="EmployeeId"><saml:AttributeValue xsi:type="xs:string"
xmlns:xs="http://www.w3.org/2001/XMLSchema"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">12345</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>
2014-12-22 10:22:56 DEBUG OpenSAML.MessageDecoder.SAML2 [5513]: extracting
issuer from SAML 2.0 protocol message
2014-12-22 10:22:56 DEBUG OpenSAML.MessageDecoder.SAML2 [5513]: message from
(**Removed**)
2014-12-22 10:22:56 DEBUG OpenSAML.MessageDecoder.SAML2 [5513]: searching
metadata for message issuer...
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [5513]:
evaluating message flow policy (replay checking on, expiration 60)
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5513]: inserted record
(_3898d579-ef68-45d3-9fea-2c430db39d08) in context (MessageFlow) with
expiration (1419265596)
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [5513]:
validating signature profile
2014-12-22 10:22:56 DEBUG XMLTooling.TrustEngine.ExplicitKey [5513]:
attempting to validate signature with the peer's credentials
2014-12-22 10:22:56 DEBUG XMLTooling.TrustEngine.ExplicitKey [5513]:
signature validated with credential
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [5513]:
signature verified against message issuer
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: processing message
against SAML 2.0 SSO profile
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: extracting issuer
from SAML 2.0 assertion
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [5513]:
evaluating message flow policy (replay checking on, expiration 60)
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5513]: inserted record
(_18c09081-0e01-4cb2-88f1-9b8949d850be) in context (MessageFlow) with
expiration (1419265596)
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [5513]:
validating signature profile
2014-12-22 10:22:56 DEBUG XMLTooling.TrustEngine.ExplicitKey [5513]:
attempting to validate signature with the peer's credentials
2014-12-22 10:22:56 DEBUG XMLTooling.TrustEngine.ExplicitKey [5513]:
signature validated with credential
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [5513]:
signature verified against message issuer
2014-12-22 10:22:56 DEBUG OpenSAML.SecurityPolicyRule.BearerConfirmation
[5513]: assertion satisfied bearer confirmation requirements
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: SSO profile
processing completed successfully
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: extracting pushed
attributes...
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeExtractor.XML [5513]: unable
to extract attributes, unknown XML object type: samlp:Response
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeExtractor.XML [5513]: skipping
unmapped NameID with format
(urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeExtractor.XML [5513]: unable
to extract attributes, unknown XML object type: saml:AuthnStatement
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeDecoder.String [5513]:
decoding SimpleAttribute (FirstName) from SAML 2 Attribute (FirstName) with
1 value(s)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeDecoder.String [5513]:
decoding SimpleAttribute (LastName) from SAML 2 Attribute (LastName) with 1
value(s)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeDecoder.String [5513]:
decoding SimpleAttribute (Email) from SAML 2 Attribute (Email) with 1
value(s)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeDecoder.String [5513]:
decoding SimpleAttribute (EmployeeId) from SAML 2 Attribute (EmployeeId)
with 1 value(s)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeFilter [5513]: filtering 4
attribute(s) from (**Removed**)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeFilter [5513]: applying
filtering rule(s) for attribute (EmployeeId) from (**Removed**)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeFilter [5513]: applying
filtering rule(s) for attribute (Email) from (**Removed**)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeFilter [5513]: applying
filtering rule(s) for attribute (LastName) from (**Removed**)
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeFilter [5513]: applying
filtering rule(s) for attribute (FirstName) from (**Removed**)
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: resolving
attributes...
2014-12-22 10:22:56 DEBUG Shibboleth.AttributeResolver.Query [5513]: found
AttributeStatement in input to new session, skipping query
2014-12-22 10:22:56 DEBUG Shibboleth.SessionCache [5513]: creating new
session
2014-12-22 10:22:56 DEBUG Shibboleth.SessionCache [5513]: storing new
session...
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5513]: inserted record
(session) in context (_82f01b32887afc6bd7b9a49c3f3403b9) with expiration
(1419266216)
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5513]: updated record
(One) in context (NameID) with expiration (1419294176)
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5513]: inserted record
(_18c09081-0e01-4cb2-88f1-9b8949d850be) in context
(_82f01b32887afc6bd7b9a49c3f3403b9) with expiration (1419266216)
2014-12-22 10:22:56 INFO Shibboleth.SessionCache [5513]: new session
created: ID (_82f01b32887afc6bd7b9a49c3f3403b9) IdP (**Removed**)
Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (50.84.200.226)
2014-12-22 10:22:56 DEBUG Shibboleth.SSO.SAML2 [5513]: ACS returning via
redirect to: https://**Removed**.com/saml/**Removed**/s/home.xhtml
2014-12-22 10:22:56 DEBUG Shibboleth.Listener [5550]: dispatching message
(**Removed**::getHeaders::Application)
2014-12-22 10:22:56 DEBUG Shibboleth.Listener [5550]: dispatching message
(**Removed**/Login::run::SAML2SI)
2014-12-22 10:22:56 DEBUG XMLTooling.StorageService [5550]: inserted record
(890e299b76c2cc59fa8484d0cd819067eec54bf54de13d91f14b0708da166b74) in
context (RelayState) with expiration (1419265976)
2014-12-22 10:22:56 DEBUG OpenSAML.MessageEncoder.SAML2POST [5550]:
validating input
2014-12-22 10:22:56 DEBUG OpenSAML.MessageEncoder.SAML2POST [5550]: signing
and marshalling the message
2014-12-22 10:22:56 DEBUG XMLTooling.Signature [5550]: applying signature
2014-12-22 10:22:56 DEBUG XMLTooling.Signature [5550]: creating signature
reference(s)
2014-12-22 10:22:56 DEBUG XMLTooling.Signature [5550]: computing signature
2014-12-22 10:22:56 DEBUG OpenSAML.MessageEncoder.SAML2POST [5550]:
marshalled message:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
AssertionConsumerServiceURL="https://www.**Removed**.com//saml/**Removed**/Shibboleth.sso/SAML2/POST"
Destination="**Removed**" ID="_0bd81bcf3732b8f872592d0d8f931d1f"
IssueInstant="2014-12-22T16:22:56Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Version="2.0"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">www.**Removed**.com</saml:Issuer><ds:Signature
xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_0bd81bcf3732b8f872592d0d8f931d1f">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>DFdhNwcV1ljfYuH+Hcn9rHouGow=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>**Removed**</ds:SignatureValue>
<ds:KeyInfo><ds:KeyName>*.**Removed**.com</ds:KeyName><ds:KeyName>Active</ds:KeyName><ds:KeyName>**Removed**.com</ds:KeyName><ds:X509Data><ds:X509SubjectName>CN=*.**Removed**.com,**Removed**</ds:X509SubjectName><ds:X509Certificate>
**Removed**
</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><samlp:NameIDPolicy
AllowCreate="1"/></samlp:AuthnRequest>
2014-12-22 10:22:56 DEBUG OpenSAML.MessageEncoder.SAML2POST [5550]: message
encoded, sending HTML form template to client
--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Unnecessary-AuthnRequest-tp7610340.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
More information about the users
mailing list