Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

Wed Aug 21 12:15:38 EDT 2019

There are many reasons why your relying party override isn't working.

The SP metadata could have WantResponseSigned or WantAssertionsSigned declared.  Your relying party match could be incorrect.  You may not have encryption set to optional.

You could set logging to debug and check your logs.

I have many SSO profiles declared for relying parties and I have many combinations of p:signResponses="true" or "false" and p:signAssertions="true" or "false".  You can set many properties on the same profile in case you believe you are limited to one.

It's not uncommon to see

<bean parent="SAML2.SSO" p:signAssertions="false" p:signResponses="true" p:encryptAssertions="false" />

Good luck in your search.

From: users <users-bounces at shibboleth.net> on behalf of Mitch Chang <mitch at sfu.ca>
Reply-To: Shib Users <users at shibboleth.net>
Date: Wednesday, August 21, 2019 at 12:01 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

As you can see in my posted question, I've actually already tried that and it seems to make no difference.
Thanks,
Mitch

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Mak, Steve <makst at upenn.edu>
Sent: August 21, 2019 4:16 AM
To: Shib Users
Subject: Re: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

Try adding p:signResponses="false" to the relying party override you created.

From: users <users-bounces at shibboleth.net> on behalf of Mitch Chang <mitch at sfu.ca>
Reply-To: Shib Users <users at shibboleth.net>
Date: Wednesday, August 21, 2019 at 12:36 AM
To: "users at shibboleth.net" <users at shibboleth.net>
Subject: Shibboleth IdP 3x SAML2.SSO profileConfigurations in relying-party.xml

Hello,

We are running Shibboleth IdP 3.4.3. I have been trying to figure out how to instruct our IdP NOT to sign its SAML response for a particular Service Provider without success. The profileConfigurations I am setting is for SAML2.SSO (which I believe was <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile" in IdP v2) in relying-party.xml.

I am following the following documents:

https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/SecurityConfiguration

In relying-party.xml, I have tried tweaking three related attributes, namely, signResponses, signAssertions, and encryptAssertions. But from my testing, it seems only signAssertions can dictate whether the SAML Assertion is signed. Setting different values for signResponses or encryptAssertions don't seem to matter, and I am seeing that the SAML Response is alway signed and the SAML Assertion is always encrypted.

For instance,

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="true" />

results in a SAML response that is signed, for instance,

<saml2:Assertion ID="_7af6a7dbd722f915a84bbfca9e7886b9"

IssueInstant="2019-08-15T21:12:11.963Z" Version="2.0"

xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema">

<saml2:Issuer>...</saml2:Issuer>

<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<ds:SignedInfo>

...

</ds:Signature>

    <saml2:Subject>

...

on the other hand, setting signAssertions="false",

<bean parent="RelyingPartyByName" c:relyingPartyIds="...">

<property name="profileConfigurations">

<list>

<bean parent="SAML2.SSO" p:signAssertions="false" />

results in a SAML response that is not signed as intended, for instance,

<saml2:Assertion ID="_2ea79ddefceff70c4a91cdfdf96f6473"

IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<saml2:Issuer>https://idp-stage.its.sfu.ca/idp/shibboleth</saml2:Issuer>

<saml2:Subject>

...

However, setting either p:signResponses="false" or p:signResponses="true" makes no difference. From what I see in the log, the Response is always signed:

<saml2p:Response

    Destination="..."

    ID="_b2fd92278ee69708aeeed53011d02a2f"

    InResponseTo="_8665e38e-f039-44ed-b979-336233cee513"

    IssueInstant="2019-08-14T21:48:06.324Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">...</saml2:Issuer>

    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

        <ds:SignedInfo>

            <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

            <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

            <ds:Reference URI="#_b2fd92278ee69708aeeed53011d02a2f">

                <ds:Transforms>

                    <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

                    <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

                </ds:Transforms>

                <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

                <ds:DigestValue>AEF8NeGHHB5VurMK2rnDx+Jte7h8kxtCgy/Yk+Y8NPE=</ds:DigestValue>

            </ds:Reference>

        </ds:SignedInfo>

        <ds:SignatureValue>JkyoZV2ddpLJUvAZwZUL3M2jjqRHiiEHTsYhWXJIbs1rk0Zya1872Nz3hVrU7de8dIBkU6IOMaebrl8kS6epkcXJ/iyZ+Dh/uKXl+Di8/2Rrr9y4jE3oWEQkcOJkQlovVfQkZt1LVvllpkazvN0dZxJZyeyh3ntWBUQmj6P/KjLYZxEo9tZqKTQHEWYaujykd5B3TYarhOnG9Ig5NMg6JDz5gFx9JVLuexKcCDBB9uOUiHXf0D2bNN77WWCPCOFp7wUHlsm7/9E67o7FNbuwISpw8hQN3WW+sgaBOqAyrKjZCxidpPc6zYbs9Q6bTGwZjLUJaGkTF9oEuIWiepnlBA==</ds:SignatureValue>

        <ds:KeyInfo>

            <ds:X509Data>

...

Setting either p:encryptAssertions="false" or p:encryptAssertions="true" also makes no difference. From what I see in the log, the Assertion is always encrypted:

<saml2:EncryptedAssertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">

<xenc:EncryptedData Id="_3f47ed5793fa660f598c99c782f928db"

Type="http://www.w3.org/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"/>

<ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

<xenc:EncryptedKey

Id="_a0cd4ccff10277a60f2be39cf5ba2869"

Recipient="..." xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<xenc:EncryptionMethod

Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">

<ds:DigestMethod

Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"/>

</xenc:EncryptionMethod>

<ds:KeyInfo>

<ds:X509Data>

<ds:X509Certificate>

Did I misconfigure or misread something? How can one instruct the IdP not to sign the SAML Response or not to encrypt the SAML Assertion for SAML2.SSO profileConfigurations?

Thank you in advance,

Mitch

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190821/ace55dd8/attachment.html>