Error encountered when implementing SP SAMLRequest signing="conditional"

[Pruvost, Christian (ELS-OXF)]

Hi Nate,

Thank you for flagging this. The IDP in question is certainly configured for this already. They were the one telling us that this is in their configuration, and is used by other Providers they work with. So we know that they will not accept our requests until these are signed. Since then we have attempted to conditionally turn this on for them, but that was so far not successful. (since it should be a simple config change, it is a little frustrating).

We did some upgrade in the last year or so from shib 2.4 to 2.6.0 so I have also asked our operation / dev team to check that no older file was eventually being picked up by accident and being responsible for this issue. (Thanks Peter for your earlier comment about this)

Hopefully we will get to the bottom of this.


Cheers,
Christian.
________________________________________________________
Christian Pruvost
•: c.pruvost at elsevier.com<mailto:c.pruvost at elsevier.com>


From: users <users-bounces at shibboleth.net> On Behalf Of Nate Klingenstein
Sent: 08 October 2018 13:55
To: Shib Users <users at shibboleth.net>
Subject: RE: Error encountered when implementing SP SAMLRequest signing="conditional"


*** External email: use caution ***



Christian,

You might consider asking the IdP to add wantAuthnRequestsSigned to their metadata directly.  Their provider's metadata needs to reflect their provider's requirements, and it sounds like in this case it doesn't.  This is for 2.6.0:

The caveat with SAML 2.0 authentication is that omitting the setting defaults to a softer false that really means "don't sign unless the IdP's metadata includes the WantAuthnRequestsSigned flag and the SP can do so".

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSigningEncryption

In case Peter's hunch is right, I believe the same default behavior existed in 2.5.x, but I may be recalling wrong.

Take care,
Nate.

-----Original message-----
From: Pruvost, Christian (ELS-OXF)
Sent: Monday, October 8 2018, 4:27 am
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Error encountered when implementing SP SAMLRequest signing="conditional"


Dear User community,

We are running a Service Provider with Shibboleth 2.6.0 (I know that we should be upgrading to 3.x, but that is not the topic – we are not doing this right now)

We have a need to turn on Conditionally for a specific IDP the generation of a signature with the SAML Request (i.e. populating ‘SigAlg=…’ and ‘Signature=…’ together with the SAMLRequest sent to the IDP.

Our operations team is experiencing the following issue when:

  1.  Changing signing=… value from signing="false” to signing="conditional"
<ApplicationDefaults attributePrefix="ELS_" connectTimeout="10" encryption="conditional" entityID="https://sdauth.sciencedirect.com/" homeURL="https://auth.elsevier.com/ShibAuth/deliverInstCredentials" id="default" policyId="default" signing="conditional" timeout="20">


  1.  On restart to pick up the new configuration we get this error:
[root at ip-10-169-71-47 cloud]# /l-n/app/scidir/bin/start_shib_shar
Using
usage: /l-n/app/scidir/etc/scripts/rollLog.sh <days of logs> <logdir> <log1> [log2] ... [logN]
Executing /l-n/app/scidir/bin/shibd -c /l-n/app/scidir/etc/shib/shibboleth_cloud.xml -d /l-n/app/scidir/etc/shib
configuration is invalid, check console for specific problems


  1.  Logs showing:
22:58:38.879(08/29) ERROR XMLTooling.ParserPool : error on line 25, column 273, message: value 'conditional' not in enumeration
22:58:38.879(08/29) ERROR XMLTooling.ParserPool : error on line 25, column 273, message: value 'conditional' not in enumeration

This is really odd. We are able to turn on the digital signature for all or noone, but not conditionally when the IDP Requests it ?!??

Has anyone encountered this issue, or who would be able to help with this?

Thank you,
Christian.
________________________________________________________
Christian Pruvost
•: c.pruvost at elsevier.com<mailto:c.pruvost at elsevier.com>


________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.

--



For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg



To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

________________________________

Elsevier Limited. Registered Office: The Boulevard, Langford Lane, Kidlington, Oxford, OX5 1GB, United Kingdom, Registration No. 1982084, Registered in England and Wales.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181008/c61fadbc/attachment.html>