Shibboleth proxy to Okta IDP issues

Jewett, David d.jewett at tcu.edu
Fri Feb 23 22:54:44 UTC 2024 

Hello all,

I've been tasked with implementing proxying from our Shib IDP to Okta, to provide MFA for specific Shibboleth SPs. I have a test IDP running 4.3.1, and I've followed the SAMLAuthnConfiguration wiki docs for 4.0:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1282539600/SAMLAuthnConfiguration

and the "Using SAML Proxying to another IdP" wiki article as well, with the understanding that some configuration may be out of date for 4.1:

https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP

Per the above article, I created a Shib-sp-metadata.xml file and included the following in Metadata-providers.xml:

                <MetadataProvider id="ShibSPMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/sp-metadata.xml"/>

                <MetadataProvider id="OktaIDPMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/OktaIDPmetadata.xml"/>

After configuration according to the documentation, when accessing an SP authentication at the upstream IDP succeeds, but my Shib IDP responds with "Web Login Service - Unsupported request. The application you have accessed is not registered for use with this service."

My logs show that my upstream IDP's metadata is being loaded, as is the metadata for the Shib SP:

2024-02-23 16:42:47,749 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Releasing cached DOM for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
2024-02-23 16:42:47,749 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Post-processing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
2024-02-23 16:42:47,749 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Computing expiration time for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
2024-02-23 16:42:47,749 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Expiration of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml' will occur at 2024-02-24T02:42:47.749770900Z
2024-02-23 16:42:47,749 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: New metadata successfully loaded for 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml'
2024-02-23 16:42:47,765 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver ShibSPMetadata: Next refresh cycle for metadata provider 'C:\Program Files (x86)\Shibboleth\IdP\metadata\sp-metadata.xml' will occur on '2024-02-24T01:42:47.749770900Z' ('2024-02-23T19:42:47.749770900-06:00[America/Chicago]' local time)
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Beginning refresh of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Processing new metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Unmarshalling metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Preprocessing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Applying metadata filter
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - Applying filter net.shibboleth.idp.saml.metadata.impl.ByReferenceMetadataFilterBridge
2024-02-23 16:42:47,765 -  - DEBUG [net.shibboleth.idp.saml.metadata.impl.ByReferenceMetadataFilterBridge:?] - Bridging to 0 ByReference filters in Spring context
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - No filters configured, nothing to do
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.filter.MetadataFilterChain:?] - Applying filter org.opensaml.saml.metadata.resolver.filter.impl.NodeProcessingMetadataFilter
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Releasing cached DOM for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Post-processing metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Computing expiration time for metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Expiration of metadata from 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml' will occur at 2024-02-24T02:42:47.765395100Z
2024-02-23 16:42:47,765 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: New metadata successfully loaded for 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml'
2024-02-23 16:42:47,765 -  - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Next refresh cycle for metadata provider 'C:\Program Files (x86)\Shibboleth\IdP\metadata\OktaIDPmetadata.xml' will occur on '2024-02-24T01:42:47.765395100Z' ('2024-02-23T19:42:47.765395100-06:00[America/Chicago]' local time)

In my logs I see the incoming assertion, but the logs indicate the upstream IDP's metadata cannot be verified, resulting in a shibboleth.UnverifiedRelyingParty condition.

2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractBatchMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Resolved 1 candidates via EntityIdCriterion: EntityIdCriterion [id=http://www.okta.com/exk137opma7Z4PsLC0x8]
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: Attempting to filter candidate EntityDescriptors via resolved Predicates
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver OktaIDPMetadata: After predicate filtering 1 EntityDescriptors remain
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 1 source EntityDescriptors
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 0 RoleDescriptor candidates via role criteria, performing predicate filtering
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Candidates iteration was empty, nothing to filter via predicates
2024-02-23 16:44:18,318 - 10.20.51.82 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:?] - Message Handler:  No metadata returned for http://www.okta.com/exk137opma7Z4PsLC0x8 in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler' on INBOUND message context
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:?] - Message Handler:  No metadata context found, nothing to do
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:?] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer http://www.okta.com/exk137opma7Z4PsLC0x8
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:?] - Resolving relying party configuration
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.relyingparty.impl.DefaultRelyingPartyConfigurationResolver:?] - Profile request is unverified, returning configuration shibboleth.UnverifiedRelyingParty
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:?] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration shibboleth.UnverifiedRelyingParty for request
2024-02-23 16:44:18,318 - 10.20.51.82 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID http://www.okta.com/exk137opma7Z4PsLC0x8)
2024-02-23 16:44:18,318 - 10.20.51.82 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration
2024-02-23 16:44:18,318 - 10.20.51.82 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:?] - No SAMLBindingContext or binding URI available, error must be handled locally

I feel like I'm missing something obvious, but I'm not sure what. Any guidance would be appreciated.

Thanks

Dave

David Jewett
Client/Server Administrator
Texas Christian University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240223/3623c80f/attachment.htm>

More information about the users mailing list