Post saml reponse from one shib idp to other shib idp

Tue May 15 08:48:44 EDT 2018

For Point : Can you explain in terms of the Shibboleth configuration changes
for adding an IDP as a trust 
provider to another IDP" ?

*Step 1*: Download secondary IDP metadata from HTTP://{}/idp/shibboleth
*Step 2*: Add this downloaded metadata reference in local IDP's
metadata-providers file at location {idp.home}/conf/metadata-providers.xml
as below:
  <MetadataProvider id="LocalMetadata1" 
xsi:type="FilesystemMetadataProvider" metadataFile="C:\Program Files
(x86)\Shibboleth\IdP\metadata\mp2012-idp-metadata.xml"/>

*Step 3*: In step 2 we have done with adding secondary IDP as trust provider
in primary IDP.
*Step 4* : Add primary IDP as relying party in secondary IDP using below
process. Metadata of primary IDP to behave as relying party as below: 
<http://shibboleth.1660669.n2.nabble.com/file/t398613/Capture13.jpg> 
*Step 5*: XML file from step4 added as reference in secondary IDP's
Metadata-providers.xml.
*Step 6*: So from step 4, 5 we can say that secondary IDP have primary IDP's
metadata and primary idp have secondary idp's metadata.

*Step7 *: Added custom sp metadata in primary IDP's metadata-providers.xml
file. as below:
<http://shibboleth.1660669.n2.nabble.com/file/t398613/Capture14.jpg> 
*Step 8*: All relying party configuration remains  unchanged.

*Step 9*: Secondary IDP's metadata file :

  <?xml version="1.0" encoding="UTF-8"?>

<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml="http://www.w3.org/XML/1998/namespace" 
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
entityID="http://mp2012r2-roja2.sotiindia.edu:8080/idp/shibboleth">
    <IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
        <Extensions>
            <shibmd:Scope regexp="false">example.org</shibmd:Scope>
        </Extensions>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://mp2012r2-roja2.sotiindia.edu:8443/idp/profile/SAML1/SOAP/ArtifactResolution"
index="1"/>
        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="http://mp2012r2-roja2.sotiindia.edu:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2"/>    

        <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/Shibboleth/SSO"/>
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/POST/SSO"/>
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/POST-SimpleSign/SSO"/>
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/Redirect/SSO"/>

    </IDPSSODescriptor>
    <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">example.org</shibmd:Scope>
        </Extensions>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>
        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <AttributeService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://mp2012r2-roja2.sotiindia.edu:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>

    </AttributeAuthorityDescriptor>

</EntityDescriptor>

Step 10: Primary IDP metadata for adding this as RP in secondary IDP:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
ID="_8523ab8065a69338d5006c34310dc8d2c0179ebb"
entityID="http://ind107.corp.soti.net:8080/idp/shibboleth">

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
    <alg:DigestMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <alg:DigestMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha512"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha384"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha224"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <alg:SigningMethod
Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
  </md:Extensions>

  <md:SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">
    <md:Extensions>

    </md:Extensions>
    <md:KeyDescriptor>
      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:KeyName>ind107.corp.soti.net</ds:KeyName>
        <ds:X509Data>
          <ds:X509SubjectName>CN=ind107.corp.soti.net</ds:X509SubjectName>
          <ds:X509Certificate>-- certificate --</ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>

    </md:KeyDescriptor>

    <md:AssertionConsumerService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://ind107.corp.soti.net:8080/idp/profile/SAML2/POST/SSO"
index="0" />

  </md:SPSSODescriptor>

</md:EntityDescriptor>

*Step 11*: Normal metadata of primary IDP : 
<?xml version="1.0" encoding="UTF-8"?>

<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
xmlns:xml="http://www.w3.org/XML/1998/namespace"
xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
entityID="http://ind107.corp.soti.net:8080/idp/shibboleth">

    <IDPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol
urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">

        <Extensions>
            <shibmd:Scope regexp="false">example.org</shibmd:Scope>

        </Extensions>

        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>--certificate--
</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>
                        <ds:X509Certificate>--certificate--
</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://ind107.corp.soti.net:8443/idp/profile/SAML1/SOAP/ArtifactResolution"
index="1"/>
        <ArtifactResolutionService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"
Location="http://ind107.corp.soti.net:8443/idp/profile/SAML2/SOAP/ArtifactResolution"
index="2"/>

        <SingleSignOnService
Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest"
Location="http://ind107.corp.soti.net:8080/idp/profile/Shibboleth/SSO" />
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="http://ind107.corp.soti.net:8080/idp/profile/SAML2/POST/SSO"  />
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"
Location="http://ind107.corp.soti.net:8080/idp/profile/SAML2/POST-SimpleSign/SSO"
/>
        <SingleSignOnService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
Location="http://ind107.corp.soti.net:8080/idp/profile/SAML2/Redirect/SSO" 
/>

    </IDPSSODescriptor>

    <AttributeAuthorityDescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">

        <Extensions>
            <shibmd:Scope regexp="false">example.org</shibmd:Scope>
        </Extensions>

        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="signing">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>
        <KeyDescriptor use="encryption">
            <ds:KeyInfo>
                    <ds:X509Data>

<ds:X509Certificate>--certificate--</ds:X509Certificate>
                    </ds:X509Data>
            </ds:KeyInfo>

        </KeyDescriptor>

        <AttributeService
Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding"
Location="http://ind107.corp.soti.net:8443/idp/profile/SAML1/SOAP/AttributeQuery"
index="0"/>

    </AttributeAuthorityDescriptor>

</EntityDescriptor>

Step 15: Now user open custom app and click on login button. On login
primary IDP's login page comes, here user enter user name and we have handle
a on-blur event on user name field. On blur event we call an api to get
details of IDP, which will authenticate this user based on domain name for
entered email.
*Step 16*: After getting IDP details from back end we create a saml authn
request seems as below: 

http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/Redirect/SSO?SAMLRequest=
<samlp:AuthnRequest ID="_f8a16c8b-845f-4342-a37c-7f643da05a46" Version="2.0"
IssueInstant="2018-05-15T11:01:28Z"
ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
AssertionConsumerServiceURL="http://ind107.corp.soti.net:8080/idp/profile/SAML2/POST/SSO"
Destination="http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/Redirect/SSO"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><saml:Issuer
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://localhost:8000</saml:Issuer><samlp:NameIDPolicy
AllowCreate="true" /></samlp:AuthnRequest>

*Here http://ind107.corp.soti.net:8080/idp/profile/SAML2/POST/SSO is primary
IDP.
and http://mp2012r2-roja2.sotiindia.edu:8080/idp/profile/SAML2/Redirect/SSO
secondary IDP.*

So My requirement is that" if user enter this email then user should
authenticate from A IDP else B IDP."
How can we achieve this ?

For u this is my flow diagram :
  <http://shibboleth.1660669.n2.nabble.com/file/t398613/Capture15.jpg> 

Please suggest me how can i achieve this. is there is any other options to
achieve this ?
Looking for your valuable response.

--
Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html