authentication flow howto/tutorial
Daniel McDonald
daniel.mcdonald at umb.edu
Thu Jul 13 12:18:21 EDT 2017
On 07/12/2017 03:57 PM, Cantor, Scott wrote:
> On 7/12/17, 3:53 PM, "users on behalf of Daniel McDonald" <users-bounces at shibboleth.net on behalf of daniel.mcdonald at umb.edu> wrote:
>
>> I can see I need to create an authentication flow for it, but im having
>> a really hard time wrapping my head around how you write them. Ive
>> reread the relevant shibboleth page a dozen times but its just not
>> sinking in.
> I suspect that's not true. Most mobile apps either rely on things the IdP doesn't support or rely on a web-based login process that should work fine out of the box. It is not a typical expectation that you would have to do anything, or that if you did need to that it would be a tractable project to take on.
>
> I have not seen their app, but we have a contract with them. Nobody has asked me about it, but I can certainly download a copy and take a peek at it.
>
>> Has anyone seen a tutorial or howto that explains how to do a simple
>> authentication flow, other than the official shibboleth wiki?
> The code and the wiki are all that exist, and any examples you found elsewhere would be as likely to be wrong as anything else.
>
> I don't know what your requirements are so it's impossible to assess how off track you might be.
>
> -- Scott
Thanks for your reply Scott...its definitely possible im way off track :)
I have the regular web-based SSO login for syncplicity working with
shibboleth. Their desktop client then worked with no shibboleth changes
needed. The way their login works is when it sees user at umb.edu it sends
them to our shibboleth login page where you enter your username/pass and
authenticate.
However when you try the mobile client, you never see our shibboleth
login page. Their server sends a few requests to our shibboleth server,
but then our shibboleth server seems to drop it.
This is a log of a mobile client trying to connect with idp set to INFO
then another login attempt with it set to DEBUG. If theres something
else I should log let me know. Any help or insights anyone could give me
would be great...
Thanks!
Dan
idp logging set to INFO:
2017-07-05 17:54:10,206 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:428] - Profile
Action SelectAuthenticationFlow: None of the potential authentication
flows can satisfy the request
2017-07-05 17:54:10,210 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: RequestUnsupported
2017-07-05 17:54:10,249 - INFO [Shibboleth-Audit.SSO:241] -
20170705T215410Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_8a3d88ad-643e-45f7-8aa0-08d857e4239a|https://umb.syncplicity.com/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://vm-shibsync.umb.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_0c72fedf7eccb567abee3962f22a9089||||||
idp loggin set to DEBUG:
2017-07-06 12:51:39,143 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.saml.common.binding.impl.CheckMessageVersionHandler'
on INBOUND message context
2017-07-06 12:51:39,144 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,148 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.saml1.binding.impl.SAML1ArtifactRequestIssuerHandler'
on INBOUND message context
2017-07-06 12:51:39,148 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,149 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.saml.common.binding.impl.SAMLProtocolAndRoleHandler'
on INBOUND message context
2017-07-06 12:51:39,150 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,153 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler'
on INBOUND message context
2017-07-06 12:51:39,153 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,155 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler'
on INBOUND message context
2017-07-06 12:51:39,156 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,157 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:132]
- Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching
RelyingPartyContext based on SAML peer https://umb.syncplicity.com/sp
2017-07-06 12:51:39,158 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:293]
- Resolving relying party configuration
2017-07-06 12:51:39,159 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:305]
- Checking if relying party configuration
EntityNames[https://umb.syncplicity.com/sp,] is applicable
2017-07-06 12:51:39,159 - DEBUG
[net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:307]
- Relying party configuration
EntityNames[https://umb.syncplicity.com/sp,] is applicable
2017-07-06 12:51:39,159 - DEBUG
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] -
Profile Action SelectRelyingPartyConfiguration: Found relying party
configuration EntityNames[https://umb.syncplicity.com/sp,] for request
2017-07-06 12:51:39,163 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:126]
- Profile Action PopulateProfileInterceptorContext: Installing flow
intercept/security-policy/saml2-sso into interceptor context
2017-07-06 12:51:39,166 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52]
- Profile Action FilterFlowsByNonBrowserSupport: Request does not have
non-browser requirement, nothing to do
2017-07-06 12:51:39,166 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:101]
- Profile Action SelectProfileInterceptorFlow: Checking flow
intercept/security-policy/saml2-sso for applicability...
2017-07-06 12:51:39,167 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:84]
- Profile Action SelectProfileInterceptorFlow: Selecting flow
intercept/security-policy/saml2-sso
2017-07-06 12:51:39,169 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,170 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,171 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,172 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,173 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,174 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,176 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.saml2.binding.security.impl.SAML2AuthnRequestsSignedSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,176 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,177 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,178 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,179 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPRedirectDeflateSignatureSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,180 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,184 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type
'org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler'
on INBOUND message context
2017-07-06 12:51:39,184 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,186 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:174] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.CheckMandatoryIssuer' on
INBOUND message context
2017-07-06 12:51:39,187 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.AuthnRequestImpl'
2017-07-06 12:51:39,187 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.WriteProfileInterceptorResultToStorage:68]
- Profile Action WriteProfileInterceptorResultToStorage: No results
available from interceptor context, nothing to store
2017-07-06 12:51:39,188 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.FilterFlowsByNonBrowserSupport:52]
- Profile Action FilterFlowsByNonBrowserSupport: Request does not have
non-browser requirement, nothing to do
2017-07-06 12:51:39,189 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:65]
- Profile Action SelectProfileInterceptorFlow: Moving completed flow
intercept/security-policy/saml2-sso to completed set, selecting next one
2017-07-06 12:51:39,190 - DEBUG
[net.shibboleth.idp.profile.interceptor.impl.SelectProfileInterceptorFlow:80]
- Profile Action SelectProfileInterceptorFlow: No flows available to
choose from
2017-07-06 12:51:39,191 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeOutboundMessageContext:149]
- Profile Action InitializeOutboundMessageContext: Initialized outbound
message context
2017-07-06 12:51:39,192 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:375]
- Profile Action PopulateBindingAndEndpointContexts: Attempting to
resolve endpoint of type
{urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService for
outbound message
2017-07-06 12:51:39,193 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:516]
- Profile Action PopulateBindingAndEndpointContexts: Populating template
endpoint for resolution from SAML AuthnRequest
2017-07-06 12:51:39,194 - DEBUG
[net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:418]
- Profile Action PopulateBindingAndEndpointContexts: Resolved endpoint
at location
https://umb.syncplicity.com/Auth/AssertionConsumerService.aspx using
binding urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2017-07-06 12:51:39,195 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:387]
- No AttributeConsumingService was resolved, won't be able to determine
delegation requested status via metadata
2017-07-06 12:51:39,196 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:520]
- No AttributeConsumingService was available
2017-07-06 12:51:39,196 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:505]
- Delegation request was not explicitly indicated, using default value:
NOT_REQUESTED
2017-07-06 12:51:39,197 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.delegation.impl.PopulateDelegationContext:294]
- Issuance of a delegated Assertion is not in effect, skipping further
processing
2017-07-06 12:51:39,202 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.PopulateEncryptionParameters:299]
- Profile Action PopulateEncryptionParameters: No encryption requested,
nothing to do
2017-07-06 12:51:39,209 - DEBUG
[net.shibboleth.idp.saml.profile.impl.ExtractSubjectFromRequest:144] -
Profile Action ExtractSubjectFromRequest: No Subject
NameID/NameIdentifier in message needs inbound processing
2017-07-06 12:51:39,406 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115]
- Profile Action InitializeAuthenticationContext: Created authentication
context:
AuthenticationContext{initiationInstant=2017-07-06T12:51:39.405-04:00,
isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[],
activeResults=[], attemptedFlow=null, signaledFlowId=null,
authenticationStateMap={}, resultCacheable=true,
initialAuthenticationResult=null, authenticationResult=null,
completionInstant=1969-12-31T19:00:00.000-05:00}
2017-07-06 12:51:39,408 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:228]
- Profile Action ProcessRequestedAuthnContext: RequestedPrincipalContext
created with operator maximum and 1 custom principal(s)
2017-07-06 12:51:39,410 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] -
Profile Action PopulateAuthenticationContext: Installed 1 potential
authentication flows into AuthenticationContext
2017-07-06 12:51:39,411 - DEBUG
[net.shibboleth.idp.session.impl.PopulateSessionContext:133] - Profile
Action PopulateSessionContext: No session found for client
2017-07-06 12:51:39,418 - DEBUG
[net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:117]
- Profile Action InitializeRequestedPrincipalContext: Leaving existing
RequestedPrincipalContext in place
2017-07-06 12:51:39,419 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile
Action FilterFlowsByForcedAuthn: Request does not have forced
authentication requirement, nothing to do
2017-07-06 12:51:39,420 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] -
Profile Action FilterFlowsByNonBrowserSupport: Request does not have
non-browser requirement, nothing to do
2017-07-06 12:51:39,421 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:370] - Profile
Action SelectAuthenticationFlow: Specific principals requested with
'maximum' operator:
[AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient}]
2017-07-06 12:51:39,422 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:386] - Profile
Action SelectAuthenticationFlow: No active results available, selecting
an inactive flow
2017-07-06 12:51:39,422 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:407] - Profile
Action SelectAuthenticationFlow: Checking for an inactive flow
compatible with operator 'maximum' and principal
'urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient'
2017-07-06 12:51:39,423 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
- Registry located predicate factory of type
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal'
and operator 'maximum'
2017-07-06 12:51:39,425 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:428] - Profile
Action SelectAuthenticationFlow: None of the potential authentication
flows can satisfy the request
2017-07-06 12:51:39,450 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: RequestUnsupported
2017-07-06 12:51:39,500 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on
OUTBOUND message context
2017-07-06 12:51:39,503 - DEBUG
[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] -
Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
message context containing a message of type
'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2017-07-06 12:51:39,540 - DEBUG
[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100]
- Looking up message encoder based on binding URI:
urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2017-07-06 12:51:39,559 - DEBUG
[net.shibboleth.idp.profile.impl.RecordResponseComplete:89] - Profile
Action RecordResponseComplete: Record response complete
2017-07-06 12:51:39,561 - INFO [Shibboleth-Audit.SSO:241] -
20170706T165139Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_b9a39b02-021e-49b4-8363-9ebee56e0032|https://umb.syncplicity.com/sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://vm-shibsync.umb.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_4f0b5a384357b35c775a6b6abd62f030||||||
More information about the users
mailing list