Shibboleth IdP 4, SAML proxying and SimpleSAMLphp proxy breakage?

[Robert Bradley]

While this is technically not a Shibboleth bug, the following issue may 
be causing problems for other people, so I'm raising it here for reference.

Recently, I have come across a SimpleSAMLphp SP 
(https://monitor.eduroam.org/sp/module.php/saml/sp/metadata.php/default-sp) 
that is used by GÉANT to SAML-proxy requests to various sites, including 
the eduroam CAT administration pages.  If the Shibboleth IdP performs 
authentication via a non-proxying route, the IdP sends a SAML aeesertion 
with itself as issuer.  The assertion contains an <AuthnContext> with no 
<AuthenticatingAuthority> elements, and the proxy IdP generates a 
basic-format attribute "eptid" of the form 
"eduPersonTargetedID:${eduPersonTargetedID}!${IdPEntityID}" and a SAML 
<AuthnContext> element with a single <AuthenticatingAuthority> entry for 
"${IdPEntityID}".  The eduPersonTargetedID attribute in this case is an 
XML attribute:

<saml2:NameID
  Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
  NameQualifier="${IdPEntityID}"
  SPNameQualifier="${SPEntityID}">
${eduPersonTargetedID}
</saml2:NameID>

${IdPEntityID}: Shibboleth IdP
${AzureIdPEntityID}: Azure AD IdP
${SPEntityID}: The remote proxy IdP/SP
${eduPersonTargetedID}: The computed persistent ID value (base64 format)

While we can argue about the use of the non-standard attribute within 
the GÉANT stack as opposed to the real eduPersonTargetedID value, this 
is all compliant SAML as far as I can tell.

If you now use the SAML authentication flow to authenticate to the 
Shiboleth IdP, things now change.  The IdP sends a SAML <AuthnContext> 
with two <AuthenticatingAuthority> elements: ${AzureIdPEntityID}, and 
${IdPEntityID}.  The Issuer and eduPersonTargetedID remain unchanged, 
and the resulting SAML is entirely compliant as you would expect. 
However, the proxy IdP in this case appears to ignore the issuer 
entirely and uses the first <AuthenticatingAuthority> element to 
generate the "eptid" attribute, i.e. 
"eduPersonTargetedID:${eduPersonTargetedID}!${AzureIdPEntityID}".  This 
looks like broken behaviour to me.

I'm not sure if this is a bug in upstream SimpleSAMLphp or simply an 
issue with the GÉANT SAML proxy, but I thought it would be worth noting 
here in case anyone else running Shibboleth IdPs with Azure AD for 
authentication runs into similar issues.

-- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20210223/ce5f5671/attachment.sig>