SAManage with Shibboleth 3?
Mark Cairney
Mark.Cairney at ed.ac.uk
Tue Apr 17 04:54:09 EDT 2018
Hi,
I've added that to the SPSSODescriptor field in the metadata as suggested.
That's changed the output of the response a bit but I still don't see
any signatures or certificates in the SAML trace. I've also adjusted the
relying-party.xml config to have "SignAssertions=always" and
"SignResponses=always":
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:Response Destination="https://desk.ei.ed.ac.uk/saml/edin"
ID="_f456f2fc58e72ca305eb162eec083b02"
InResponseTo="_cf0a80f0-be0f-480d-b17a-1e0d01d72011"
IssueInstant="2018-04-17T08:41:41.957Z"
Version="2.0"
xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
<saml2:Issuer
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://idp-test.ucs.ed.ac.uk/idp/shibboleth</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></saml2p:Status>
<saml2:Assertion ID="_e22ca0786d7ebda42275360461680a98"
IssueInstant="2018-04-17T08:41:41.957Z"
Version="2.0"
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">
<saml2:Issuer>https://idp-test.ucs.ed.ac.uk/idp/shibboleth</saml2:Issuer>
<saml2:Subject>
<saml2:NameID
Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">Mark.Cairney at ed.ac.uk</saml2:NameID>
<saml2:SubjectConfirmation
Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml2:SubjectConfirmationData Address="129.215.243.72"
InResponseTo="_cf0a80f0-be0f-480d-b17a-1e0d01d72011"
NotOnOrAfter="2018-04-17T08:46:42.382Z"
Recipient="https://desk.ei.ed.ac.uk/saml/edin"
/></saml2:SubjectConfirmation>
</saml2:Subject>
<saml2:Conditions NotBefore="2018-04-17T08:41:41.957Z"
NotOnOrAfter="2018-04-17T08:46:41.957Z">
<saml2:AudienceRestriction>
<saml2:Audience>SAManage.com</saml2:Audience>
</saml2:AudienceRestriction>
</saml2:Conditions>
<saml2:AuthnStatement AuthnInstant="2018-04-17T08:26:25.291Z"
SessionIndex="_ec61999a903f8bf3be52d24c76626785">
<saml2:SubjectLocality Address="129.215.243.72" />
<saml2:AuthnContext>
<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
</saml2:AuthnContext>
</saml2:AuthnStatement>
</saml2:Assertion>
</saml2p:Response>
In the IdP logs I still see the following although I'm not sure if this
is relevant or not (I'm just looking for lines that mention signing):
2018-04-17 09:45:50,894 - DEBUG
[org.opensaml.saml.common.binding.security.impl.EndpointURLSchemeSecurityHandler:52]
- [129.215.243.72]|Message Handler: Checking outbound endpoint for
allowed URL scheme: https://desk.ei.ed.ac.uk/saml/edin
2018-04-17 09:45:50,896 - DEBUG
[org.opensaml.saml.common.binding.security.impl.SAMLOutboundProtocolMessageSigningHandler:85]
- [129.215.243.72]|Message Handler: Message context did not contain
signing parameters, outbound message will not be signed
2018-04-17 09:45:50,714 - DEBUG
[org.opensaml.saml.common.profile.impl.SignAsser
tions:146] - [129.215.243.72]|Profile Action SignAssertions: Will not
sign asser
tions because no security parameters context is available
On 16/04/18 22:39, Losen, Stephen C. (scl) wrote:
> Hi,
>
> Maybe you need to add WantAssertionsSigned="true" to the SPSSODescriptor element in the SAManage SP metadata file.
>
> The response from the IDP has a Response XML element that encloses the Assertion element. By default the IDP signs the Response (which includes the Assertion) and does not sign the Assertion. However some SPs expect the Assertion to be signed, so that might explain the error you see.
>
> Stephen C. Losen
> ITS - Systems and Storage
> University of Virginia
> scl at virginia.edu 434-924-0640
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Scavo
> Sent: Monday, April 16, 2018 4:04 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: SAManage with Shibboleth 3?
>
> On Mon, Apr 16, 2018 at 2:49 PM, Mark Cairney <Mark.Cairney at ed.ac.uk> wrote:
>>
>> From the information I've received from the user:
>>
>> "
>> Hello,
>> This link would show what visible in your instance's metada:
>> https://edin.samanage.com/saml/metadata. However, as mentioned previously
>> we are looking for the token signing certificate to be included in the saml
>> request as it would be compared with the certificate you have pasted under
>> Setup -> SSO for validity.
>> "
>>
>> Does this make sense to you given they themselves don't provide any
>> certificates for signing/encryption (the metadata file they provided is
>> literally 4 lines of XML!) and the only certificates I'm aware of that are
>> routinely transferred during a SAML conversation are one or more of these?
>
> No, that doesn't make much sense but let me take a stab at it. Did you
> in fact paste your IdP signing certificate into their web interface as
> they claim? If so, then that's all they should need to verify the
> signature on the response but apparently they want/need more. I
> suppose you'll need to get to the bottom of that. Why do they need
> more than the certificate you pasted into their UI?
>
>> Also at least one piece of the few bits of documentation say to disable
>> encryption and signing?
>
> XML security goes both ways and you're getting confused (which is
> contributing to the overall confusion). The SP does not have a
> certificate in its metadata so the SP does not support outbound
> signing nor inbound encryption. You OTOH MUST support outbound signing
> so I assume you have a signing certificate in your metadata, right?
> That's the same certificate you apparently pasted into their UI. Okay
> then, case closed :-)
>
>> I was under the impression that signing/encryption had to be mutually
>> declared between both parties?
>
> No, I don't know what you mean. The only thing that's absolutely for
> sure is that the IdP signs the response, so you have to provide them
> with your trusted signing certificate. That's it. Nothing else is
> strictly required in either direction.
>
> Hope this helps,
>
> Tom
>
>> On 16/04/18 17:01, Peter Schober wrote:
>>
>> * Mark Cairney <Mark.Cairney at ed.ac.uk> [2018-04-16 15:47]:
>>
>> The docs I've been following are:
>> https://community.samanage.com/message/6116
>> and
>> https://wiki.shibboleth.net/confluence/display/SHIB2/SAManage
>>
>> From those two I gather that your question actually is:
>> How do I release the subject's email address as an emailAddress-format
>> NameID in Shibboleth IDPv3?
>>
>> relying-party.xml:
>> <bean parent="RelyingPartyByName" c:relyingPartyIds="SAManage.com">
>> <property name="profileConfigurations">
>> <list>
>> <bean parent="SAML2.SSO" p:encryptAssertions="never"
>> p:signAssertions="always" p:encryptNameIDs="never"
>> p:signResponses="always"
>> p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"/>
>> </list>
>> </property>
>> </bean>
>>
>> FYI, you can drop p:nameIDFormatPrecedence from there and instead
>> simply add that format as the first (or only) NameIDFormat element to
>> the locally-managed SAML metadata you load from
>> %{idp.home}/metadata/samanage-metadata.xml
>>
>> attribute-resolver.xml:
>>
>> No need to touch the resolver for IDPv3. Instead just add this to your
>> conf/saml-nameid.xml (and remove your previous attempts while you#re
>> there) to the util:list with id="shibboleth.SAML2NameIDGenerators":
>>
>> <!-- email as NameID -->
>> <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
>> p:omitQualifiers="true"
>> p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
>> p:attributeSourceIds="#{ {'mail'} }" />
>>
>> and release the 'mail' attribute to the SP in your
>> attribute-filter.xml, as usual.
>>
>> Done.
>>
>> -peter
>>
>>
>>
>> The University of Edinburgh is a charitable body, registered in
>> Scotland, with registration number SC005336.
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
--
/****************************
Mark Cairney
ITI Enterprise Services
Information Services
University of Edinburgh
Tel: 0131 650 6565
Email: Mark.Cairney at ed.ac.uk
PGP: 0x435A9621
*******************************/
The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.
More information about the users
mailing list