Shibboleth IdP Proxying
Hall, Gerry
gerry.hall at emory.edu
Wed Jan 24 21:58:27 UTC 2024
We are in the initial phases of a project where we have been asked to investigate the use of our Shibboleth IdP as a proxy.
I found this doc, https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP , and I believe that at this point I have a test IdP that has been configured for proxying (no service available for testing yet). However I have some general questions that I hope someone will be kind enough to answer or point me to doc’s where I can do my own research.
My questions:
1. For the Shibboleth IdP, is proxying an all or none proposition? In other words, with proxying configured, can the Shibboleth IdP still perform normal authentication or do all authentication requests now have to go to the upstream IdP?
1. From the SP perspective, would current SP’s that use the IdP for authentication and that do not require proxying have to make changes with their configurations? I ask this from the perspective that the SAML assertion is typically signed by the Shibboleth IdP and that the SP ‘knows’ the Shibboleth IdP based on the Shibboleth IdP’s SAML metadata which contains the signing cert.
1. One of the steps the docs specifically mentions is that I change the idp.authn.flows to ‘SAML’ (we currently use idp.authn.flows = MFA). As soon as I make this change to ‘idp.authn.flows = SAML’, all auth requests that previously worked break with the error below. The IdP starts up with no errors and the error is displayed during authentication in the browser prior to getting to the IdP login page and in the IdP logs.
The relevant error from the logs seems to be ‘No metadata returned for https://upstream.idp/entity in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol’. This does make sense since I have not added the metadata for the upstream IdP but it makes me think that now all SP requests for authentication will be routed to the upstream IdP which is unwanted behavior.
Is this expected behavior?
As concerns SP’s that I do not want to use the IdP as a proxy, is my understanding of the current behavior correct?
(displayed in browser)
opensaml::FatalProfileException
The system encountered an error at Wed Jan 24 14:46:19 2024
To report this problem, please contact the site administrator at webgroup at emory.edu<mailto:webgroup at emory.edu>.
Please include the following message in any email:
opensaml::FatalProfileException at (https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST)
SAML response reported an IdP error.
Error from identity provider:
Status: urn:oasis:names:tc:SAML:2.0:status:Requester
Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
Message: An error occurred.
(from IdP logs)
2024-01-24 14:50:03,853 - 127.0.0.1 - login.emory.edu - DEBUG [PROTOCOL_MESSAGE:124] -
<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL=https://secure.web.emory.edu/Shibboleth.sso/SAML2/POSTDestination=https://login.emory.edu/idp/profile/SAML2/Redirect/SSOID="_96ad81269e572890e407955190fd4fc4" IssueInstant="2024-01-24T19:50:03Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://secure.web.emory.edu/</saml:Issuer<https://secure.web.emory.edu/%3c/saml:Issuer>>
<samlp:NameIDPolicy AllowCreate="1"/>
</samlp:AuthnRequest>
2024-01-24 14:50:04,050 - 127.0.0.1 - login.emory.edu - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:161] - Message Handler: No metadata returned for https://upstream.idp/entity in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2024-01-24 14:50:04,058 - 127.0.0.1 - login.emory.edu - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://upstream.idp/entity)
2024-01-24 14:50:04,059 - 127.0.0.1 - login.emory.edu - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set
2024-01-24 14:50:04,059 - 127.0.0.1 - login.emory.edu - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
2024-01-24 14:50:04,127 - 127.0.0.1 - login.emory.edu - DEBUG [PROTOCOL_MESSAGE:70] -
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination=https://secure.web.emory.edu/Shibboleth.sso/SAML2/POSTID="_01bd307ec9db399a264379e8a1af69a6" InResponseTo="_96ad81269e572890e407955190fd4fc4" IssueInstant="2024-01-24T19:50:04.062Z" Version="2.0">
<saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://login.emory.edu/idp/shibboleth</saml2:Issuer<https://login.emory.edu/idp/shibboleth%3c/saml2:Issuer>>
<ds:Signature xmlns:ds=http://www.w3.org/2000/09/xmldsig#>
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm=http://www.w3.org/2001/10/xml-exc-c14n#/>
<ds:SignatureMethod Algorithm=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256/>
<ds:Reference URI="#_01bd307ec9db399a264379e8a1af69a6">
<ds:Transforms>
<ds:Transform Algorithm=http://www.w3.org/2000/09/xmldsig#enveloped-signature/>
<ds:Transform Algorithm=http://www.w3.org/2001/10/xml-exc-c14n#/>
</ds:Transforms>
<ds:DigestMethod Algorithm=http://www.w3.org/2001/04/xmlenc#sha256/>
<ds:DigestValue>3f35gnxlyq7pvzLDHXbi0gv+51DCKIa9BCCOKQU7eUI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>HDikBaYNPz++PpScmOF4mNtKOdFWKBg7QOz1k932A461WMgsn1dpCE7RQZG+PacTWrjojOEW64jv1/mCroWteTY8MbXbOSVG8ldYplghkM6qcHNtdjztN25SbkZnTl6c69h8gpTbve06BZ/QGMagnTCXWxbRPrqxz/6QFg6Dc+zuJJoAaLUaVUR0NUHX9xLcSMD5SnksFxtAa71MbiLO+ZT2oRGlMCipAI5soxZ1FWGTk1cQ8l622houPRp9aOing0L9UxwBucZ+jJBkv7GwgAkBssy1AG6KkGQTdgxyXkNIWaX/eAVLjy7uo3lTirD0gz2pq0l2Fhlp5jEmcEUPCA==</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIDJzCCAg+gAwIBAgIUfGsUnIe4ehQbVOK7801PiWLKSX8wDQYJKoZIhvcNAQEFBQAwGjEYMBYG
A1UEAxMPbG9naW4uZW1vcnkuZWR1MB4XDTEwMDMyOTE2MjAwNVoXDTMwMDMyOTE2MjAwNVowGjEY
MBYGA1UEAxMPbG9naW4uZW1vcnkuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
0RQxoj9S3eD6vcGOB39jZiPBRx1fTJf6MV96bHNwD/M+fBCR7t+07VScdH0pffvN0x7g5co0jWJ4
KT/16tPpA/14qzpKd3oHIFz5rgnG1qBSla+kqe9lzls72HMDA5vdaRpPib1ZsaB7JUyTTHMdvVcy
aovLILB/xt2cdy8CCJjIdNt+Uxl5gAwhKfU6DVYspFAWp4uVMJqO774Xn5Sa68ANjrRLTbMO7Bnq
gxCyAAN8ztGlsn+91Z5JnlMPI/q9uLh6xiUffiwo17S9KOQ+hqQx6XDQGI/U7TOanuohkC29qt09
tLYFXjAB3sfy66qsQfS/rXulScfJsSYNaziMaQIDAQABo2UwYzBCBgNVHREEOzA5gg9sb2dpbi5l
bW9yeS5lZHWGJmh0dHBzOi8vbG9naW4uZW1vcnkuZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQW
BBSC4HCY5liG+oEdDcyxnHhEZt8cKjANBgkqhkiG9w0BAQUFAAOCAQEAFdOSL9HrkUxokD0zm07e
gEpnltaHsusrsZvVhayfNqiRlgvhHBpJTa9xUaAyZ45VUsieP4olSdfyiMVMIRkVgo/gF4W//ZlG
xV28CnlalLR10NMzG6Kz03eRf6v5MQtVL+0EBTO7wiZAFIKYOv8nxpZoL7LV9l9x5SIDjsgmwV7w
Publ0X3aoGq6+IHIk1TZAA/xWJm1Z1W9fFRWXSLVS1/eCjPY4rjIktauEsi8Tj6QlhYFuo5WiEaV
tNluIP3MzpBSxCUyEov49a4rxpHNKPxpSZyFGTDS8Zsm6tV8cZfn0eCypcm3lqm/X3HSODuN6n5+
cVrRig01srF/2D9B1A==</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
</saml2p:StatusCode>
<saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
</saml2p:Status>
</saml2p:Response>
2024-01-24 14:50:04,128 - 127.0.0.1 - login.emory.edu - INFO [Shibboleth-Audit.SSO:338] - 2024-01-24T19:50:04.128577Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_96ad81269e572890e407955190fd4fc4|https://secure.web.emory.edu/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.emory.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_01bd307ec9db399a264379e8a1af69a6||||Mozilla/5.0<https://secure.web.emory.edu/%7Chttp:/shibboleth.net/ns/profiles/saml2/sso/browser%7Chttps:/login.emory.edu/idp/shibboleth%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_01bd307ec9db399a264379e8a1af69a6%7C%7C%7C%7CMozilla/5.0> (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0||urn:oasis:names:tc:SAML:2.0:status:Requester|
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240124/ae79b148/attachment.htm>
More information about the users
mailing list