Encryption-less SP to auth against encryption-mandating IdP?

Thu Jan 24 12:22:15 EST 2019

Hi all, thanks for the quick replies.

I realize I must sound quite confused - I'm not a system owner either on
the IdP nor the application side, I've just been tasked to come up with
some way to break a stalemate where:

   1. the application must use the IdP for authentication
   2. the application does not support signing requests nor decrypting SAML
   responses, vendor appears to have no intention to add functionality after
   multiple queries
   3. the application currently has an unsupported version-specific hack in
   place that is facilitating IdP auth - there is no way to repurpose this to
   newer app versions
   4. the application's current version is missing critical features which
   the business requires, however upgrade is impossible due to points 2./3.

As there is already Apache running in front of the app, I was working on
quite the hack as a proof-of-concept that would use Apache to look for
authn request redirects, and send them to a helper application to add a
signature before eventually getting to the IdP. Apache would also watch for
incoming assertions and have the helper app decrypt them and send them on
to the application, allowing session creation. Very ugly to do from scratch.

Perhaps mod_shib can already handle this use case, I just couldn't tell
from this morning's reading session. I definitely appreciate the need for
signing and encryption and wish the application was just doing the right
thing, however as things stand the old version of the application is a
security risk just due to lack of updates, and things are unlikely to
change unless I can find a supportable way forward.

Cheers,

On Thu, Jan 24, 2019 at 12:12 PM Curry, Warren <whcurry at ufl.edu> wrote:

> Some  non technical aspects added to this.
>
>
>
> Encryption and signing are /should not be optional.    IT is the right
> thing to do in all cases.
>
>
>
> Vendors or campus developers should be “strongly encouraged”  to the point
> of extreme exception .  Support the encryption and signing you are trying
> to avoid.
>
>
>
> We have a very few exceptions.   But it is difficult for any SP in our
> base to be approved to not encrypt the assertion , etc.
>
>
>
> This is not technical but  rather standard, practice and risk based
> practice that we live by.   I know many others who are essentially very
> similar.       Vendors will and have aligned when pushed on or other
> vendors exist.  Institutionally developed applications are simply expected
> to accommodate the standard practice of requiring SP to encrypt /sign
> etc..  .
>
>
>
> Of 2000+ SPs running at our institution, we can count on my fingers SPs
> with exceptions and some of those are startup exceptions while
> adjustments/fixes are made to the service provider to align with the
> institutional practice and standard of encryption… .
>
>
>
> -whc
>
>
>
> Warren Curry
>
> Identity Architect
>
> UF Information Technology – Indentity Services
>
> 720 SW 2nd Street – Ayers Bldg
>
> 352-273-1383
>
> http://identity.it.ufl.edu/
>
>
>
> *From:* users <users-bounces at shibboleth.net> *On Behalf Of *Domingues,
> Michael D
> *Sent:* Thursday, January 24, 2019 11:53 AM
> *To:* users at shibboleth.net
> *Subject:* Re: Encryption-less SP to auth against encryption-mandating
> IdP?
>
>
>
> Hi Daniel,
>
>
>
> What portions of the proposed system are under your control? Are you
> responsible for the web application that wants to receive user data (the
> service provider), the system that authenticate your users (the identity
> provider), or both?
>
>
>
> Fundamentally, Shibboleth isn't just one product --- it's a suite of
> products developed to fulfill the two (primary) roles in a SAML login flow.
> One piece of software, the Shibboleth Service Provider (SP) works as an
> authentication middleware in conjunction with your web server, through
> something like mod_shib. mod_shib isn't the SP, it just bridges the SP
> software to your web application. The Shibboleth SP handles the generation
> of AuthN requests, comes with metadata (that you'll need to customize), and
> parses the SAML assertions that get sent to it, exposing identity data to
> your web application via server variables (or headers).
>
>
>
> The other primary piece of software Shibboleth Identity Provider. It
> handles responding to AuthN requests, authenticating your users, then
> resolving identity data from underlying data connectors (LDAP, SQL, your
> person registry, etc) and sending SAML assertions to the SPs that sent the
> AuthN request in the first place.
>
>
>
> Typically, you're only concerned with one of these things --- you're an
> application developer (or server admin) looking to get the Service Provider
> installed, or an identity team, looking to maintain the Identity Provider
> infrastructure for your institution.
>
>
>
> If you control the SP, you absolutely can support encryption, metadata
> generation, etc. If you control the IdP, you can configure it on a per-SP
> basis (see the documentation for relying-party.xml [1]) to change its
> requirements depending on what an SP supports. In this scenario, if you
> control the IdP but not the SP, you could configure the IdP to permit
> non-signed AuthN requests, and send unencrypted assertions to the SP in
> question.
>
>
>
> I hope this helps,
>
>
>
> Michael
>
>
>
> [1]
> https://wiki.shibboleth.net/confluence/display/IDP30/RelyingPartyConfiguration
> <https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_display_IDP30_RelyingPartyConfiguration&d=DwMFAg&c=pZJPUDQ3SB9JplYbifm4nt2lEVG5pWx2KikqINpWlZM&r=UBkKx63rTinSBj-2DQ-E7g&m=RDSS14TKNDX7wgCXGQtKRRZINvo0NxkDusbs5Lb-3pY&s=PI2_MXR_TqSIVvQT7KT2Fq2Wsljd_-hcUKyNTnZMFSw&e=>
> ------------------------------
>
> *From:* users <users-bounces at shibboleth.net> on behalf of Daniel Smith <
> danielesmith at gmail.com>
> *Sent:* Thursday, January 24, 2019 10:40:42 AM
> *To:* users at shibboleth.net
> *Subject:* Encryption-less SP to auth against encryption-mandating IdP?
>
>
>
> I'm new to Shibboleth as of today, and the documentation is a little
> overwhelming. I was wondering if the following scenario is possible:
>
>
>
> 1. SP requires SAML 2.0 assertion for user groups to assign roles, but
> does not support assertion decryption, nor metadata generation, nor authn
> request signing
>
> 2. IdP mandates assertion encryption and authn request signing
>
> 3. Shibboleth hopefully sits in the middle, sending signed authn requests
> to IdP and decrypted SAML assertions to SP
>
>
>
> Ideally I'd like to use mod_shib as the SP already has Apache running. Is
> there a walkthrough for this kind of scenario or do I just have to keep
> reading? Or, is this kind of encryption-one-way-but-not-the-other not
> supported?
>
>
>
> Thanks,
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190124/ed12cf57/attachment.html>