Working with Service Now

Thu Jun 2 16:33:44 EDT 2016

On 6/2/16 4:13 PM, Cantor, Scott wrote:
>> The login dies on my IdP, after logging in and before redirecting back. This is
>> all I get in my logs with normal logging levels:
>>
>> 2016-06-02 19:24:07,102 - WARN
>> [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred
>> while processing the request: ContextCheckDenied
> 
> That's your context-check intercept running and blocking access. You configured the relying-party override to run that flow.
> 
> -- Scott
> 

Scott,

Thanks. That should teach me to copy/paste things from the Internet.... Removing that did get things further, but not
completely there. The response I'm sending back doesn't appear to have any NameID in it.

Request:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
    AssertionConsumerServiceURL="https://dev25187.service-now.com/navpage.do"
    Destination="https://idp.grnoc.iu.edu/idp/profile/SAML2/Redirect/SSO"
    ForceAuthn="false" ID="SNCc744dada7aba8f9881533cf2e05a83c7"
    IsPassive="false" IssueInstant="2016-06-02T20:24:31.879Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    ProviderName="https://dev25187.service-now.com/navpage.do"
    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://dev25187.service-now.com</saml2:Issuer>
    <saml2p:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
    <saml2p:RequestedAuthnContext Comparison="exact">
        <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
    </saml2p:RequestedAuthnContext>
</saml2p:AuthnRequest>

Reply:

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response
    Destination="https://dev25187.service-now.com/navpage.do"
    ID="_74f37df19eeccabd690d6dab98b67cc2"
    InResponseTo="SNCc744dada7aba8f9881533cf2e05a83c7"
    IssueInstant="2016-06-02T20:24:41.849Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://idp.grnoc.iu.edu/idp/shibboleth</saml2:Issuer>
    <ds:Signature
                xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
                Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference
                        URI="#_74f37df19eeccabd690d6dab98b67cc2">
<ds:Transforms>
<ds:Transform
                        Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform
                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>tHu4oGhxhE1yR73TzmBD407lqmhLtrJjervOA0UMBW8=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
c2ngl/OpggHB/rjDHR+oWkt7cQClNMFVE91vOe8Tob4fUL4Mvizdj7lcmvm53puLkasWFt1QjZSG
Z1yFt+yMERctwWVl7a2LhBPnCGjWSrsH4WCoRo1LEEHVJTvoqGCL8dfL7YlYCuKih2wR8ZSonDKx
CcE2+vYkxmqO//6YRCAmr6Ngo3wn1kwfoDneXiBeE2sHRO+Gh9LfojfP7cNp0ZknEVfm4k2jMh8Z
4JI0N5Pg+kGNcHfFHD/tJh2IL/ofo7C6zrFvwQUm/naP8KT0DSXbVAD7cAzCJFQTsiaR30/jqWb3
q7Y60o+6UzxYgeTKdcMcSYvUWvv3Y95Lxb57Xg==
</ds:SignatureValue>
<ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDKzCCAhOgAwIBAgIUXlFU96Gv+h6tWwtwJYxttywRb0AwDQYJKoZIhvcNAQEFBQAwGzEZMBcG
A1UEAxMQaWRwLmdybm9jLml1LmVkdTAeFw0xMjAyMDIxNDI1NDNaFw0zMjAyMDIxNDI1NDNaMBsx
GTAXBgNVBAMTEGlkcC5ncm5vYy5pdS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCY3HoBe91uZUjlOWETj/AJ0EXqsbaoBrnKfbjohcdhbLhjj/r5tmXrWmAt2pIwDcvWJniyGh5P
cK6ABAX1Bi+hs+pbccqBZZNyYstzwook7oAaydGh8ZVKE+6Y8ldYSrdF1MSbOTlrWRHCeko1BDqL
k3PRPta92OD9wus8mBpJhqp5x8WA06kTN5EqaoIYGyqvfUFUj6AuQ3H9DcuQDhym4hzgVXU1NxVP
VCbiac19I4oIX0CwcaFBoopChC9BVp5rDSrhKYDSf8f4ueutxH/56o76ZpnbGSOum7AlJmyv9ZAV
9z61xIWVuyuzfy24sBhfhz4p40ABc94fsUUwxQvBAgMBAAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC5n
cm5vYy5pdS5lZHWGJ2h0dHBzOi8vaWRwLmdybm9jLml1LmVkdS9pZHAvc2hpYmJvbGV0aDAdBgNV
HQ4EFgQUdTOr0TRPEoqroyu/Rcqb20Op/gMwDQYJKoZIhvcNAQEFBQADggEBAGouQ8bXVBigXFUp
RCtTz3/HD+B3YrZX8yHYQcjQzI7J/xeuHpMDmETmid1/ztLkXULCWot4hkiLIkZWql8nMdu2Lckn
shq0FAeUyUFF1doG7u+bhs96VrnbV+pB+DgbIMmXspgKnKCCgoq1l/k0dR1YvvydZjZ22EdB2+E7
C1D5hKSeFqxeZJKz6SKqPnSJMtgUudqiIYuW0FagAjNdvnSknTNjbRbCIvfTuT24hkJ+pet41nKY
JcLbp4C44Pohoouf2JDxb4sFnvhFP7Irn89MeYxs/hXGMEKSs97qNzoIgD6+GIQl2Vhgk1rnGufv
TqxJ5CAA3R6cGfNma1a3FHA=</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </saml2p:Status>
    <saml2:Assertion ID="_0449c212c6f247c5665f889b0c3cf355"
        IssueInstant="2016-06-02T20:24:41.849Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
        <saml2:Issuer>https://idp.grnoc.iu.edu/idp/shibboleth</saml2:Issuer>
        <ds:Signature
                    xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod
                    Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod
                    Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference
                            URI="#_0449c212c6f247c5665f889b0c3cf355">
<ds:Transforms>
<ds:Transform
                            Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform
                        Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>qp9wS+3DHFVCHvI7r/Rll3QuT4yYX+M0UpexyKaCCJQ=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>
EMlJs57LlrJXNp/3oo3VQB7TpKKFH29CKBisWjYO4tF/ibq/pM1WOJx1q9eDoWIkHOjgPC07ima+
ZBtDo2iP7FkmSc9QcFn8nTbzm/QMN+x2rF3jGknK6qj2PSjLJeQGfne51bNX433BfH417hT23ML7
CBvsPE4jeabo5hafKAFAIOA/Z1nj245+4rDcj5FwagbQCtFIhATEyKrrTGRVpD6Y71N73C3qTQ2J
QkQ5IAC2fAgbd2z/NMGXSGlQX5qaxUgfXQDFhkQCnFuiUdt5jP8aNBImHBHuuuxv/hyilOz4zoWM
ey+hlffXe5Upiot7s92fpybHHHO4mKhQp1aauw==
</ds:SignatureValue>
<ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIDKzCCAhOgAwIBAgIUXlFU96Gv+h6tWwtwJYxttywRb0AwDQYJKoZIhvcNAQEFBQAwGzEZMBcG
A1UEAxMQaWRwLmdybm9jLml1LmVkdTAeFw0xMjAyMDIxNDI1NDNaFw0zMjAyMDIxNDI1NDNaMBsx
GTAXBgNVBAMTEGlkcC5ncm5vYy5pdS5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
AQCY3HoBe91uZUjlOWETj/AJ0EXqsbaoBrnKfbjohcdhbLhjj/r5tmXrWmAt2pIwDcvWJniyGh5P
cK6ABAX1Bi+hs+pbccqBZZNyYstzwook7oAaydGh8ZVKE+6Y8ldYSrdF1MSbOTlrWRHCeko1BDqL
k3PRPta92OD9wus8mBpJhqp5x8WA06kTN5EqaoIYGyqvfUFUj6AuQ3H9DcuQDhym4hzgVXU1NxVP
VCbiac19I4oIX0CwcaFBoopChC9BVp5rDSrhKYDSf8f4ueutxH/56o76ZpnbGSOum7AlJmyv9ZAV
9z61xIWVuyuzfy24sBhfhz4p40ABc94fsUUwxQvBAgMBAAGjZzBlMEQGA1UdEQQ9MDuCEGlkcC5n
cm5vYy5pdS5lZHWGJ2h0dHBzOi8vaWRwLmdybm9jLml1LmVkdS9pZHAvc2hpYmJvbGV0aDAdBgNV
HQ4EFgQUdTOr0TRPEoqroyu/Rcqb20Op/gMwDQYJKoZIhvcNAQEFBQADggEBAGouQ8bXVBigXFUp
RCtTz3/HD+B3YrZX8yHYQcjQzI7J/xeuHpMDmETmid1/ztLkXULCWot4hkiLIkZWql8nMdu2Lckn
shq0FAeUyUFF1doG7u+bhs96VrnbV+pB+DgbIMmXspgKnKCCgoq1l/k0dR1YvvydZjZ22EdB2+E7
C1D5hKSeFqxeZJKz6SKqPnSJMtgUudqiIYuW0FagAjNdvnSknTNjbRbCIvfTuT24hkJ+pet41nKY
JcLbp4C44Pohoouf2JDxb4sFnvhFP7Irn89MeYxs/hXGMEKSs97qNzoIgD6+GIQl2Vhgk1rnGufv
TqxJ5CAA3R6cGfNma1a3FHA=</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml2:Subject>
            <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml2:SubjectConfirmationData
                    Address="2001:18e8:2:1009::52"
                    InResponseTo="SNCc744dada7aba8f9881533cf2e05a83c7"
                    NotOnOrAfter="2016-06-02T20:29:41.995Z" Recipient="https://dev25187.service-now.com/navpage.do"/>
            </saml2:SubjectConfirmation>
        </saml2:Subject>
        <saml2:Conditions NotBefore="2016-06-02T20:24:41.849Z" NotOnOrAfter="2016-06-02T20:29:41.849Z">
            <saml2:AudienceRestriction>
                <saml2:Audience>https://dev25187.service-now.com</saml2:Audience>
            </saml2:AudienceRestriction>
        </saml2:Conditions>
        <saml2:AuthnStatement AuthnInstant="2016-06-02T20:24:41.589Z" SessionIndex="_84b31e938ad2deb74b62046e433ae3b1">
            <saml2:SubjectLocality Address="2001:18e8:2:1009::52"/>
            <saml2:AuthnContext>

<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
            </saml2:AuthnContext>
        </saml2:AuthnStatement>
    </saml2:Assertion>
</saml2p:Response>

Ian