Questions About SAML2.ArtifactResolution Configuration

[Drew Zebrowski]

Hi,

I'm working with on moving an SP that uses SAML2.ArtifactResolution configuration from IDP2 to our new IDP 3. The integration works fine on IDP2 but when moving over to IDP 3, we're seeing errors in the SAML which is causing the AuthN to fail.

Below find my relying party.xml configuration from the new IDP:

<property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO" p:postAuthenticationFlows="attribute-release" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="Liberty.SSOS" />
                <ref bean="CAS.LoginConfiguration" />
                <ref bean="CAS.ProxyConfiguration" />
                <ref bean="CAS.ValidateConfiguration" />
            </list>
        </property>


<bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://temr.regenstrief.org?instid=9003'}}">
            <property name="profileConfigurations">
                <list>
                        <bean parent="SAML2.ArtifactResolution" p:encryptAssertions="false" p:encryptNameIDs="false" />
                        <bean parent="SAML2.SSO" p:encryptAssertions="false" />
                </list>
            </property>
        </bean>



What the vendor has indicated is that the appropriate query string is missing when calling the SAML artifact from the SP. The query string should exist as indicated in the entity id (https://temr.regenstrief.org?instid=9003)The response returns an internal server error as indicated below. The first response below is from my actual SAML trace. The second is the exact same response, which includes the missing query string. The second response is what

---------- 1 ----------

GET https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D HTTP/1.1
Host: temr.regenstrief.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul
Cookie: institutionIdParam=9003; institutionIdParam=9003; JSESSIONID=EABAAF6FF3B4A1BBCBF66CBD2B20978C.webapp171

HTTP/?.? 500 Internal Server Error
Date: Wed, 26 Apr 2017 15:18:53 GMT
Expires: -1
X-Frame-Options: SAMEORIGIN
Pragma: no-cache
Cache-Control: private, no-cache, no-store
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Content-Length: 4347
Connection: close


---------- 2 ----------


GET https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul?instid=9003&SAMLart=AAQAAtMyr%2FtHTOLrFFy7YH71vdkMC3e8TM21pehJu4Km%2FDvtlNTNpKRZBkU%3D HTTP/1.1

Host: temr.regenstrief.org

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Referer: https://temr.regenstrief.org/tEMR/zkau/web/org/regenstrief/ui/component/login/temr-login.zul

Cookie: institutionIdParam=9003; institutionIdParam=9003; JSESSIONID=EABAAF6FF3B4A1BBCBF66CBD2B20978C.webapp171





How can I get the IDP to include that detail in the URL? Is that even possible. Is my setup misconfigured? Could this be an issue with the vendor metadata? Also, looking at the response, it looks like the value I need is being stored in a cookie (institutionIdParam=9003). Could this be where I have misconfigured this?

Any assistance would be appreciated.

Drew Zebrowski




The information contained in this transmission contains privileged and confidential information. It is intended only for the use of the person named above. If you are not the intended recipient, you are hereby notified that any review, dissemination, distribution or duplication of this communication is strictly prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message.

CAUTION: Intended recipients should NOT use email communication for emergent or urgent health care matters.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170426/2632440c/attachment-0001.html>