idp v3 - unsolicited sso failing

[Marc Boorshtein]

>
>
>
> >Since an unsolicited/idp initiated sso shouldn't allow you to override
> whats in the metadata requiring a signature from the originator doesn't
> provide any security benefit.
>
> That essentially argues that the metadata flag has no value, which is
> perfectly fine, but it's a separate question from what to do if it's set.
>
>
No, I'm saying the metadata flag from wanting authnrequests signed is not
applicable to unsolicited sso because unsolicited sso is not the same thing
as an authnrequest thats part of an sp initiated sso.


> >Second, in this case this is a purely academic discussion because SP
> initiated SSO doesn't sign the authnrequest and it completes just fine.  So
> either there's a bug that is allowing an authnrequest to not signed or
> there's a bug where the unsolicited SSO is being too restrictive regardless
> of settings.
>
> I have tested the setting and verified the behavior, and I guess I can
> test it again.
>
> OK, but this is a verifiable and repeatable issue.  This is how I got
these results:

1.  Took an existing shib 3 idp
2.  Changed the idp.entityID in idp.properties
3.  Replaced the metadata for my SP to include :

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"

        ID="fbf6521d9dbbdd0ae14a2bb1a3c642876e86a3435" entityID="
http://spenc.autoidm.com:9090/auth/SAML2Auth">

        <md:SPSSODescriptor AuthnRequestsSigned="true"

                WantAssertionsSigned="true" protocolSupportEnumeration=
"urn:oasis:names:tc:SAML:2.0:protocol">

                <md:KeyDescriptor use="encryption">

                        <ds:KeyInfo xmlns:ds="
http://www.w3.org/2000/09/xmldsig#">

                                <ds:X509Data>

                                        <ds:X509Certificate>


MIICOzCCAaSgAwIBAgIETmvMNTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJ1czENMAsGA1UE

CBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDENMAsGA1UECxMEdGVzdDEXMBUG

A1UEAxMOdHJlbW9sby1zcC1lbmMwHhcNMTEwOTEwMjA0NDM3WhcNMTExMjA5MjA0NDM3WjBiMQsw

CQYDVQQGEwJ1czENMAsGA1UECBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDEN

MAsGA1UECxMEdGVzdDEXMBUGA1UEAxMOdHJlbW9sby1zcC1lbmMwgZ8wDQYJKoZIhvcNAQEBBQAD

gY0AMIGJAoGBAMCPvwDY8F9d0ftJ7NfNUx1KR+ZJeOiFn+P/0gj8REjuHiFITr2qjpYvSZDItj/d

F79ggZTIUYBX02Nl+xqBBbZGYsJFdkyzq4kGbuxaCXagCXpyz6uOfOLQ5GjB/YKbMwcTtTZLUPSM

X8CczyWtuinGMzTz524wPZLMO6ahtlaxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAaJhCLZ9UVx4v

iIvECXB9HbHJMOEzZw37c0+xJ2NbOfGEYTlyZuSHfUOigBDUP9dSHoWKTLdNcWZ4CkcS66M4ROG8

ZHdDJFMo3WVtfbjFMSSMKPc4Qh2wS+qS51cxfiZTrv8AfFxJcxoyef0OxO9BpND4t0BrYw6HXyNj

W1nmaX8=

                                        </ds:X509Certificate>

                                </ds:X509Data>

                        </ds:KeyInfo>

                </md:KeyDescriptor>

                <md:KeyDescriptor use="signing">

                        <ds:KeyInfo xmlns:ds="
http://www.w3.org/2000/09/xmldsig#">

                                <ds:X509Data>

                                        <ds:X509Certificate>


MIICOzCCAaSgAwIBAgIETmvMNTANBgkqhkiG9w0BAQUFADBiMQswCQYDVQQGEwJ1czENMAsGA1UE

CBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDENMAsGA1UECxMEdGVzdDEXMBUG

A1UEAxMOdHJlbW9sby1zcC1lbmMwHhcNMTEwOTEwMjA0NDM3WhcNMTExMjA5MjA0NDM3WjBiMQsw

CQYDVQQGEwJ1czENMAsGA1UECBMEdGVzdDENMAsGA1UEBxMEdGVzdDENMAsGA1UEChMEdGVzdDEN

MAsGA1UECxMEdGVzdDEXMBUGA1UEAxMOdHJlbW9sby1zcC1lbmMwgZ8wDQYJKoZIhvcNAQEBBQAD

gY0AMIGJAoGBAMCPvwDY8F9d0ftJ7NfNUx1KR+ZJeOiFn+P/0gj8REjuHiFITr2qjpYvSZDItj/d

F79ggZTIUYBX02Nl+xqBBbZGYsJFdkyzq4kGbuxaCXagCXpyz6uOfOLQ5GjB/YKbMwcTtTZLUPSM

X8CczyWtuinGMzTz524wPZLMO6ahtlaxAgMBAAEwDQYJKoZIhvcNAQEFBQADgYEAaJhCLZ9UVx4v

iIvECXB9HbHJMOEzZw37c0+xJ2NbOfGEYTlyZuSHfUOigBDUP9dSHoWKTLdNcWZ4CkcS66M4ROG8

ZHdDJFMo3WVtfbjFMSSMKPc4Qh2wS+qS51cxfiZTrv8AfFxJcxoyef0OxO9BpND4t0BrYw6HXyNj

W1nmaX8=

                                        </ds:X509Certificate>

                                </ds:X509Data>

                        </ds:KeyInfo>

                </md:KeyDescriptor>

                <md:SingleLogoutService

                        Binding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

                        Location="
http://spenc.autoidm.com:9090/auth/SAML2Auth" />

                <md:NameIDFormat>
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified

                </md:NameIDFormat>

                <md:AssertionConsumerService

                        Binding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
http://spenc.autoidm.com:9090/auth/SAML2Auth"

                        index="0" isDefault="true" />

                <md:AssertionConsumerService

                        Binding=
"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"

                        Location="
http://spenc.autoidm.com:9090/auth/SAML2Auth" index="1"

                        isDefault="false" />

        </md:SPSSODescriptor>

</md:EntityDescriptor>


4.  Changed dp.encryption.optional to false

5.  Updated my SP's configuration

SP initiated SSO generates an AuthnRequest that is NOT signed which shib
accepts but an unsolicited SSO fails.


Thanks

Marc
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150315/1c9e06ee/attachment-0001.html