SAML rocket.chat and testshib.org

[Marcus Schopen]

Hi Tim,

thanks for your time!

Am Freitag, den 10.03.2017, 14:04 -0500 schrieb Tom Scavo:
> On Fri, Mar 10, 2017 at 1:55 PM, Marcus Schopen <lists at localguru.de> wrote:
> >
> > I'm testing rocket.chat SAML with testshib.org as IDP, but get an error:
> > "Error: Unable to validate response url: Error: Missing SAML assertion".
> >
> > I've installed SAML trace in firefox and see "Required NameID format not
> > supported" in the response...
> 
> Are you able to obtain a copy of the AuthnRequest from the SP? What is
> the value of samlp:NameIDPolicy/@Format? That is almost certainly the
> source of your problem.

I've never worked before with shibboleth, so sorry if my questions or
needed information are a little bit imprecise.

I've attached SP request and IDP response and the metadata of my SP I've
uploaded to the testshib.org IDP. The metadata are automatically
generated by Rocket.Chat depending on the SAML configuration.

Ciao
Marcus

-------------- next part --------------
Request:
########

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    ID="cirzocom8zwCE2Q64"
                    Version="2.0"
                    IssueInstant="2017-03-11T09:03:02.596Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    AssertionConsumerServiceURL="https://rocketchat.mydomain.de/_saml/validate/schoppa-rocketchat"
                    Destination="https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://rocketchat.mydomain.de/_saml/metadata/schoppa-rocketchat</saml:Issuer>
    <samlp:NameIDPolicy xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                        Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
                        AllowCreate="true"
                        />
    <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                                 Comparison="exact"
                                 >
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>


Response:
#########

<saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"
                 Destination="https://rocketchat.mydomain.de/_saml/validate/schoppa-rocketchat"
                 ID="_5426cd62ed2290208beb7e7294111194"
                 InResponseTo="cirzocom8zwCE2Q64"
                 IssueInstant="2017-03-11T09:03:22.729Z"
                 Version="2.0"
                 >
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
                  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
                  >https://idp.testshib.org/idp/shibboleth</saml2:Issuer>
    <saml2p:Status>
        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
            <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy" />
        </saml2p:StatusCode>
        <saml2p:StatusMessage>Required NameID format not supported</saml2p:StatusMessage>
    </saml2p:Status>
</saml2p:Response>


-------------- next part --------------
<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://rocketchat.mydomain.de/_saml/metadata/schoppa-rocketchat">
  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
    <KeyDescriptor>
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>[snip]</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc"/>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/>
      <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#tripledes-cbc"/>
    </KeyDescriptor>
    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://rocketchat.mydomain.de/_saml/logout/schoppa-rocketchat/" ResponseLocation="https://rocketchat.mydomain.de/_saml/logout/schoppa-rocketchat/"/>
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://rocketchat.mydomain.de/_saml/validate/schoppa-rocketchat"/>
  </SPSSODescriptor>
</EntityDescriptor>