Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

Wed Aug 21 07:16:10 EDT 2019

Try adding p:signResponses="false" to the relying party override you created.

From: users <users-bounces at shibboleth.net> on behalf of Mitch Chang <mitch at sfu.ca>
Reply-To: Shib Users <users at shibboleth.net>
Date: Wednesday, August 21, 2019 at 12:36 AM
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

Hello,

We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting is for SAML2.SSO (which I believe was <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.

I am following the following documents:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration

In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML Assertion is signed. Setting different values for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted.

For instance,

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="true" />

results in a SAML response that is signed, for instance,

<saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"

IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"

xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<saml2:Issuer>...</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

...

</ds:Signature>

    <saml2:Subject>

...

on the other hand, setting signAssertions="false",

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="false" />

results in a SAML response that is not signed as intended, for instance,

<saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"

IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer>

<saml2:Subject>

...

However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed:

<saml2p:Response

    Destination="..."

    ID="_b2fd92278ee69708aeeed53011d02a2f"

    InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"

    IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer>

    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

        <ds:SignedInfo>

            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

            <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f">

                <ds:Transforms>

                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

                </ds:Transforms>

                <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

                <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue>

            </ds:Reference>

        </ds:SignedInfo>

        <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue>

        <ds:KeyInfo>

            <ds:X509Data>

...

Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:

<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"

Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<xenc:EncryptedKey

Id="_a0cd4ccff10277a60f2be39cf5ba2869"

Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<ds:DigestMethod

Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>

</xenc:EncryptionMethod>

<ds:KeyInfo>

<ds:X509Data>

<ds:X509Certificate>

Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations?

Thank you in advance,

Mitch

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190821/3c904a6e/attachment.html>