saml2aws -- IDPV4

[Max Spicer]

Hi Nathan,

saml2aws logs users in to Shibboleth by "scraping" and automating the
web-based login form. The latest release has not yet been updated to
support login pages that use CSRF tokens. This means that it does not
submit the CSRF token along with the username and password and so
Shibboleth rejects the login. CSRF protection
<https://wiki.shibboleth.net/confluence/display/IDP4/Cross-Site+Request+Forgery+%28CSRF%29+Protection>
is enabled by default for new installs of IdP 4.0 and is an option for
upgrades. If you choose to enable it
<https://wiki.shibboleth.net/confluence/display/IDP4/Cross-Site+Request+Forgery+%28CSRF%29+Protection>when
you upgrade, then your saml2aws users will no longer be able to login via
Shibboleth unless they update their saml2aws client.

See https://github.com/Versent/saml2aws/issues/638 for more details. This
issue has a pull request to fix it by storing the CSRF token and sending it
with the login.

Max

On Fri, 19 Mar 2021 at 21:08, Nathan Dors <dors at uw.edu> wrote:

> Hi Hari, can you say more about the csrf issue?
>
> Does the issue arise due to new constraints introduced by IdPv4?
>
> We have customers here who use saml2aws, but (uh oh) I'm not aware if
> we've accounted for this potential issue in our planning around our IdPv4
> upgrade.
>
> I understand ECP and AWSCLI-login provide a comparable solution, but it'd
> be useful to know more about the csrf with IdPv4.
>
> -Nathan
>
> On Wed, Feb 17, 2021 at 6:53 AM Mailvaganam, Hari <hari.mailvaganam at ubc.ca>
> wrote:
>
>> FYI – confirmed – csrf.
>>
>>
>>
>> *From: *users <users-bounces at shibboleth.net> on behalf of "Mailvaganam,
>> Hari" <hari.mailvaganam at ubc.ca>
>> *Reply-To: *Shib Users <users at shibboleth.net>
>> *Date: *Tuesday, February 16, 2021 at 8:14 PM
>> *To: *Shib Users <users at shibboleth.net>
>> *Subject: *saml2aws -- IDPV4
>>
>>
>>
>> [*CAUTION:* Non-UBC Email]
>>
>> Hi:
>>
>>
>>
>> Has anyone had opportunity w.r.t saml2aws working with IDPV4.0.1?
>>
>>
>>
>>
>> https://github.com/Versent/saml2aws/blob/master/pkg/provider/shibboleth/README.md
>>  - from link tested with IDP v3.3, however can’t quite make out why not
>> working with v4.0.1 (shot in the dark – csrf?)
>>
>>
>>
>> Rreceiving message below ‘missing Assertion element. Issue only with
>> saml2aws – the AWS console via SAML fine. No other changes made.
>>
>>
>>
>>
>>
>> missing Assertion element
>>
>> error parsing aws roles
>>
>> github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole
>>
>>
>> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:190
>>
>> github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
>>
>>
>> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:90
>>
>> main.main
>>
>>
>> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163
>>
>> runtime.main
>>
>>
>> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204
>>
>> runtime.goexit
>>
>>
>> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374
>>
>> Failed to assume role, please check whether you are permitted to assume
>> the given role for the AWS service
>>
>> github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login
>>
>>
>> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:92
>>
>> main.main
>>
>>
>> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163
>>
>> runtime.main
>>
>>
>> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204
>>
>> runtime.goexit
>>
>>
>> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374
>>
>>
>>
>> Best regards,
>>
>>
>>
>> *Hari Mailvaganam*
>> Access Application Architect, Identity & Access Management (IAM)
>>
>> Cybersecurity | CISO Office
>>
>> The University of British Columbia | Musqueam Traditional Territory
>> 420 - 6356 Agricultural Road | Vancouver BC | V6T1Z2 Canada
>> Phone 604 827 5117
>>
>> Privacy Matters @ UBC
>>
>>
>>
>> Upcoming Scheduled Out of Office:
>>
>> -22nd March, 2021 – 26th March, 2021
>>
>> -09th August, 2021 – 20th August, 2021
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210322/514e00ca/attachment.htm>