Shibboleth as SAML Proxy

Tue Jul 6 19:04:37 UTC 2021

I am working on configuring Shibboleth IDP to proxy to a CAS server acting as a SAML IDP and running into an issue with Shibboleth IDP (acting as a SP) not signing the SAML request.  

The error I see on the CAS server UI is: 
org.opensaml.saml.common.SAMLException: Request is not signed but should be

Backend log messages say:
Jul  6 14:50:33 HOST104w user Resolved  metadata chain from [file:/etc/cas/saml/metadata/metadata.xml]. Filtering the chain by entity ID [https://SPEntityID/idp/shibboleth]
Jul  6 14:50:33 HOST104W user Resolved  metadata chain from [file:/etc/cas/saml/metadata/metadata.xml]. Filtering the chain by entity ID [https://SPEntityID/idp/shibboleth]
Jul  6 14:50:33 HOST104W user Metadata  for [https://SPEntityID/idp/shibboleth] says authentication requests are signed, yet request is not

Am I missing a piece on the Shibboleth as SAML proxy?

Thanks, Jay 

________________________________
Jason Rappaport (he/him)
Identity and Access Management Analyst
Office of Information Technology
Email:  jasonrap at princeton.edu 
Office:  609-258-8464

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Bergmann, Clemens
Sent: Tuesday, July 6, 2021 2:07 AM
To: Shib Users <users at shibboleth.net>
Subject: AW: Shibboleth as SAML Proxy

Hi Nate,

thanks fort he insight. 
I am already in the process of configuring Shibboleth to remove CAS (Software) from the list and using the CAS (protocol) ability of Shibboleth. 
You are right. I Think I will split these two functions and do the (real) IdP part with shibboleth and the proxy part with simplesamlphp or SaToSa. The requrements for the later are still not that clear.

Mit freundlichen Grüßen
Clemens Bergmann
--
Clemens Bergmann
Gruppe Nutzermanagement und Entwicklung
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64289 Darmstadt Tel. +49 6151 16 71184 http://www.hrz.tu-darmstadt.de/

> -----Ursprüngliche Nachricht-----
> Von: users <users-bounces at shibboleth.net> Im Auftrag von Nate
> Klingenstein
> Gesendet: Dienstag, 6. Juli 2021 06:34
> An: Shib Users <users at shibboleth.net>
> Betreff: RE: Shibboleth as SAML Proxy
> 
> Clemens,
> 
> If you're stuck with running CAS and Shibboleth, I don't think needing to
> proxy means that continuing to use Shibboleth is going to feel like much pain
> at all.  It's basically just understanding JavaScript, maybe WebFlow, and the
> objects available to your script.
> 
> Proxying with Shibboleth 4.1+ isn't *that* hard nor limited in what it can do.
> simpleSAMLphp just has a less steep learning curve, and SaToSa even more
> so, but I don't believe they have the CAS support you need, so why not
> become an expert in two critical systems at once?
> 
> Take care,
> Nate.
> 
> --------
> Signet, Inc.
> The Art of Access ®
> 
> https://www.signet.id
> 
> -----Original message-----
> From: Bergmann, Clemens
> Sent: Tuesday, July 6 2021, 4:04 am
> To: Shib Users
> Subject: AW: Shibboleth as SAML Proxy
> 
> Thanks for the answers.
> 
> I am currently also in the process of merging one Shibboleth and one CAS
> Server to one shibboleth server.
> Now I am a little uncertain if I should continue setting up shibboleth or if I
> should investigate replacing our IdPs with a simpleSAMLphp instance which
> could do both things.
> 
> On the other hand these are two different requirements:
> 1. IdP for the users of a university
> 2. SAML-Proxy to support single-idp-software for a group of universities
> 
> It might be that Shibboleth is better for 1 and simpleSAMLphp is better for 2.
> But I don't have much experience with any of them.
> What is your opinion on this?
> 
> Mit freundlichen Grüßen
> Clemens Bergmann
> --
> Clemens Bergmann
> Gruppe Nutzermanagement und Entwicklung
> Technische Universität Darmstadt
> Hochschulrechenzentrum, Alexanderstraße 2, 64289 Darmstadt
> Tel. +49 6151 16 71184
> http://www.hrz.tu-darmstadt.de <http://www.hrz.tu-darmstadt.de>/
> 
> > -----Ursprüngliche Nachricht-----
> > Von: users <users-bounces at shibboleth.net <mailto:users-
> bounces at shibboleth.net>> Im Auftrag von Nate
> > Klingenstein
> > Gesendet: Montag, 5. Juli 2021 17:46
> > An: Shib Users <users at shibboleth.net <mailto:users at shibboleth.net>>
> > Betreff: Re: Shibboleth as SAML Proxy
> >
> >
> > 	I guess you'd find the SAML SP now built into the Shib IDP to be
> > 	insufficient for multi-party federating resources, but I haven't
> > 	looked at that myself.
> >
> >
> >
> > There are various ways to build discovery into the IdP.  We've done this for
> > several services, such as AWS Cognito, including automatically scripting
> > different SP's to route directly to specific IdP's.
> >
> >
> > It isn't too painful, though you lose some options and complicate the
> > deployment by necessity when proxying.  It should meet Clemens' use
> case,
> > but...
> >
> >
> > 	(Also, the Shib IDP is not the most lightweight software in the world
> > 	if all you need is some SAML proxying, IMHO.)
> >
> >
> >
> > I agree with the simpleSAMLphp suggestion.
> 
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> <https://wiki.shibboleth.net/confluence/x/coFAAg>
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
> 
> 
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6666 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/6087c969/attachment.p7s>