IDP proxing for vendors non-DS/Wayf capabilities

Tue Feb 2 21:25:35 UTC 2021

Jehan,

> 1) No metadata returned for https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth> in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol

Exactly.  Of course, the proxy will need to load and trust the upstream IdP's metadata.  You can do that as part of the federation aggregation or just load it as a separate file, but it must be trusted.

> 2) Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser <http://shibboleth.net/ns/profiles/saml2/sso/browser> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth>)

This is just saying that you're not running a totally open proxy that will accept assertions from anyone and is a relic from error #1.

It's good that you manage the federation metadata that way.  InCommon has(had?  Haven't been following patch notes) a confining interface that wouldn't permit this easily, requiring you to register either an IdP or an SP using a GUI.

Your discoveryFunction bean is fine, but it will of course need to be modified when it actually does discovery.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Jehan PROCACCIA
Sent: Tuesday, February 2 2021, 2:19 pm
To: users
Subject: Re: IDP proxing for vendors non-DS/Wayf capabilities

I manage my federation Metadata myself with those tools : xmlsectool and aggregator-cli

So I published in our schools Federation the entityID of my IDPproxy with only the elements <SPSSODescriptor...  (no IDP elements) 
and loaded on a test SP (representing the Vendor SP) only the  <IDPSSODescriptor of my IDPproxy
so that SP metadata and the IDP metadata of the same entityID (IDPproxy) appears in different files and not cross loaded on Vendor SP and upstream IDPs
Then everything seems clear now regarding metadata
unfortunatly while connecting to Vendor SP , I am redirected to IDPproxy and there it fails with  :

opensaml::FatalProfileException
The system encountered an error at Tue Feb 2 21:43:14 2021

opensaml::FatalProfileException at (https://vendorSP.domain.fr/Shibboleth.sso/SAML2/POST <https://vendorSP.domain.fr/Shibboleth.sso/SAML2/POST>)

SAML response reported an IdP error.

Error from identity provider:

Status: urn:oasis:names:tc:SAML:2.0:status:Requester
Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
Message: An error occurred.

IDPproxy logs shows :

2021-02-02 21:43:14,439 - - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:167] - Message Handler:  No metadata returned for https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth> in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2021-02-02 21:43:14,440 -- DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:131] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth>
2021-02-02 21:43:14,440 - - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:249] - Resolving relying party configuration
2021-02-02 21:43:14,441 - - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:255] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2021-02-02 21:43:14,441 - - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2021-02-02 21:43:14,442 -  - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:118] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser <http://shibboleth.net/ns/profiles/saml2/sso/browser> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth>)
2021-02-02 21:43:14,444 -  - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2021-02-02 21:43:14,444 -  - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:274] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2021-02-02 21:43:14,445 -  - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:312] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2021-02-02 21:43:14,445 -  - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed

I guess the problem is related to those 2 messages

1) No metadata returned for https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth> in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2) Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser <http://shibboleth.net/ns/profiles/saml2/sso/browser> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth>)

Do you have an idea of what could be wrong here ?

I did followed https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+to+another+IdP <https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+to+another+IdP>
specifically adding in conf/authn/saml-authn-config.xml

  <bean id="shibboleth.authn.SAML.discoveryFunction" parent="shibboleth.Functions.Constant"
        c:target="https://upstreamIDP.domain.fr/idp/shibboleth <https://upstreamIDP.domain.fr/idp/shibboleth>" />

thanks .