Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

[Mitch Chang]

Hello,


We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting is for SAML2.SSO (which I believe was <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.


I am following the following documents:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration


In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML Assertion is signed. Setting different values for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted.


For instance,

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="true" />


results in a SAML response that is signed, for instance,


<saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"

IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"

xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<saml2:Issuer>...</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

...

</ds:Signature>

    <saml2:Subject>

...


on the other hand, setting signAssertions="false",

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="false" />


results in a SAML response that is not signed as intended, for instance,

<saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"

IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer>

<saml2:Subject>

...


However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed:

<saml2p:Response

    Destination="..."

    ID="_b2fd92278ee69708aeeed53011d02a2f"

    InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"

    IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer>

    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

        <ds:SignedInfo>

            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

            <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f">

                <ds:Transforms>

                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

                </ds:Transforms>

                <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

                <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue>

            </ds:Reference>

        </ds:SignedInfo>

        <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue>

        <ds:KeyInfo>

            <ds:X509Data>

...


Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:

<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"

Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<xenc:EncryptedKey

Id="_a0cd4ccff10277a60f2be39cf5ba2869"

Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<ds:DigestMethod

Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>

</xenc:EncryptionMethod>

<ds:KeyInfo>

<ds:X509Data>

<ds:X509Certificate>


Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations?


Thank you in advance,

Mitch

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190821/80806153/attachment.html>