PasswordProtectedTransport Authentication with MCB
IAM David Bantz
dabantz at alaska.edu
Mon Jul 6 20:43:28 EDT 2015
To recap, vendor's SAML request was triggering the IdP to report back that
authentication failed (even though the the user-submitted credentials bound
to LDAP).
Brent Putman correcty divined that the vendor's SAML request sent a POST
message to the Redirect end point.
BUT the vendor insists they have configured "40 plus" institutions this way
and cannot readily change either the destination to POST/SSO or change the
binding to Redirect.
In discussion, they invoked the name "Scott Cantor" as having worked with
them on their first Shibboleth integration that set up this configuration.
I'm just reporting!
In any case, SOME change was made at the vendor end and my IdP is now
provides a SAML response to their request (at least it responds for my
account using MCB/Duo MFA). Yet, as I can verify directly, the SAML POST
request is still sent to the IdP's Redirect end point. Surprisingly (to me)
the IdP doesn't trigger any warnings about this, and provides an
affirmative SAML response confirming authentication and including
attributes.
If it doesn't matter where the request is sent, why do we bother with the
different end points? If it matters, will this fail under some
as-yet-untested circumstances?
David Bantz
Here's the latest SAML request I captured in SAML Tracer:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="s26c8d71ee6f9c431b5472159becb07099bee19e8b"
Version="2.0"
IssueInstant="2015-07-06T23:43:47Z"
Destination="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"
ForceAuthn="true"
IsPassive="false"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
AssertionConsumerServiceURL="https://sso.uat.firstmarblehead.com/openam/Consumer/metaAlias/fmdrealm001/uaaalaska_sso_sp"
>
<saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">sso.uat.firstmarblehead.com/uaaalaska_sso</saml:Issuer>
<samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
SPNameQualifier="sso.uat.firstmarblehead.com/uaaalaska_sso"
AllowCreate="true"
/>
<samlp:RequestedAuthnContext
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
Comparison="exact"
>
<saml:AuthnContextClassRef
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
</samlp:AuthnRequest>
and the SAML response from the IdP logs (minus the signature):
<?xml version="1.0" encoding="UTF-8"?><saml2:Assertion
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_f9ce79b9284aa8f5af748967b30c7bd0"
IssueInstant="2015-07-06T23:44:07.385Z" Version="2.0"
xmlns:xs="http://www.w3.org/2001/XMLSchema">
<saml2:Issuer
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">urn:mace:incommon:alaska.edu</saml2:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#_f9ce79b9284aa8f5af748967b30c7bd0">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform
Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
<ec:InclusiveNamespaces
xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/>
</ds:Transform>
</ds:Transforms>
<ds:DigestMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>i86bF26dCP7Tq4dRn0v43q0NtFI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
…
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
NameQualifier="urn:mace:incommon:alaska.edu"
SPNameQualifier="sso.uat.firstmarblehead.com/uaaalaska_sso">dabantz at alaska.edu</saml2:NameID>
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="137.229.112.75"
InResponseTo="s26c8d71ee6f9c431b5472159becb07099bee19e8b"
NotOnOrAfter="2015-07-06T23:49:07.385Z"
Recipient="https://sso.uat.firstmarblehead.com/openam/Consumer/metaAlias/fmdrealm001/uaaalaska_sso_sp"/>
</saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2015-07-06T23:44:07.385Z"
NotOnOrAfter="2015-07-06T23:49:07.385Z">
<saml2:AudienceRestriction>
<saml2:Audience>sso.uat.firstmarblehead.com/uaaalaska_sso</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2015-07-06T23:44:07.048Z"
SessionIndex="_2438c11c5b07018ba88e1e3d19232c33">
<saml2:SubjectLocality Address="137.229.112.75"/>
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
<saml2:AttributeStatement>
<saml2:Attribute FriendlyName="LastName" Name="urn:oid:2.5.4.4"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">Bantz</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="bannerID"
Name="https://iam.alaska.edu/trac/wiki/IamUaArp#bannerID"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">30459959</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="mail"
Name="urn:oid:0.9.2342.19200300.100.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">db at alaska.edu</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="FirstName"
Name="urn:oid:2.5.4.42"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">David</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="uaUsername"
Name="https://iam.alaska.edu/trac/wiki/IamUaArp#uaUsername"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">dabantz</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="eduPersonTargetedID"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
NameQualifier="urn:mace:incommon:alaska.edu"
SPNameQualifier="sso.uat.firstmarblehead.com/uaaalaska_sso">w2t6APTZ8vM0zKQ3okPodI3pX4c=</saml2:NameID>
</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="username"
Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">dabantz at alaska.edu</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="employeeNumber"
Name="urn:oid:2.16.840.1.113730.3.1.3"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">30459959</saml2:AttributeValue>
</saml2:Attribute>
<saml2:Attribute FriendlyName="displayname"
Name="urn:oid:2.16.840.1.113730.3.1.241"
NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
<saml2:AttributeValue
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:type="xs:string">David Bantz</saml2:AttributeValue>
</saml2:Attribute>
</saml2:AttributeStatement>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150706/d4a2cf47/attachment.html>
More information about the users
mailing list