Shibboleth IdP Proxying

Thu Jan 25 14:48:01 UTC 2024

1.     It can be "all or none" if you set idp.authn.flows=SAML.  But you can use the MFA flow like you currently have enabled to control if/when the SAML authn flow is triggered.  So essentially you can enable it for only certain SPs, certain users, etc.

2.     The assertion that the SP receives is always generated by the proxying IdP.  The SP needs no knowledge of the upstream IdP.  The only things that the proxying IdP would typically use from upstream IdP are attributes and/or NameID.  All of that must be configured however.

3.       Again - the SP only interacts with the proxying IdP and needs no knowledge of the upstream IdP.  Once you establish the trust between the proxying IdP and the upstream one, those errors should go away (assuming you can successfully log in on the upstream IdP)
From: users <users-bounces at shibboleth.net> On Behalf Of Hall, Gerry via users
Sent: Wednesday, January 24, 2024 4:58 PM
To: users at shibboleth.net
Cc: Hall, Gerry <gerry.hall at emory.edu>
Subject: [EXTERNAL] Shibboleth IdP Proxying

We are in the initial phases of a project where we have been asked to investigate the use of our Shibboleth IdP as a proxy.

I found this doc, https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1459979597/Using+SAML+Proxying+to+another+IdP<https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_spaces_KB_pages_1459979597_Using-2BSAML-2BProxying-2Bto-2Banother-2BIdP&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=BmQGEb75QSCRmYwxnGyPkpXjmWUQs2Su-k-KZb1g3CE&e=> , and I believe that at this point I have a test IdP that has been configured for proxying (no service available for testing yet).  However I have some general questions that I hope someone will be kind enough to answer or point me to doc's where I can do my own research.

My questions:

  1.  For the Shibboleth IdP, is proxying an all or none proposition?  In other words, with proxying configured, can the Shibboleth IdP still perform normal authentication or do all authentication requests now have to go to the upstream IdP?

  1.  From the SP perspective, would current SP's that use the IdP for authentication and that do not require proxying have to make changes with their configurations?  I ask this from the perspective that the SAML assertion is typically signed by the Shibboleth IdP and that the SP 'knows' the Shibboleth IdP based on the Shibboleth IdP's SAML metadata which contains the signing cert.

  1.  One of the steps the docs specifically mentions is that I change the idp.authn.flows to 'SAML' (we currently use  idp.authn.flows  = MFA).  As soon as I make this change to 'idp.authn.flows = SAML', all auth requests that previously worked break with the error below.  The IdP starts up with no errors and the error is displayed during authentication in the browser prior to getting to the IdP login page and in the IdP logs.

The relevant error from the logs seems to be 'No metadata returned for https://upstream.idp/entity<https://urldefense.proofpoint.com/v2/url?u=https-3A__upstream.idp_entity&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=4v1yhkxxRk0SMZLKiBJZ-7p0K2jKH6u3fIYSm-sEEwY&e=> in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol'.  This does make sense since I have not added the metadata for the upstream IdP but it makes me think that now all SP requests for authentication will be routed to the upstream IdP which is unwanted behavior.

          Is this expected behavior?
          As concerns SP's that I do not want to use the IdP as a proxy,  is my understanding of the current behavior correct?

(displayed in browser)

opensaml::FatalProfileException

The system encountered an error at Wed Jan 24 14:46:19 2024

To report this problem, please contact the site administrator at webgroup at emory.edu<mailto:webgroup at emory.edu>.

Please include the following message in any email:

opensaml::FatalProfileException at (https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST<https://urldefense.proofpoint.com/v2/url?u=https-3A__secure.web.emory.edu_Shibboleth.sso_SAML2_POST&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=IS_3u0Cxt1hx3RtCXjjldKpXEieSASS0ynBxL5Hv0xY&e=>)

SAML response reported an IdP error.

Error from identity provider:

    Status: urn:oasis:names:tc:SAML:2.0:status:Requester

    Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed

    Message: An error occurred.

(from IdP logs)

2024-01-24 14:50:03,853 - 127.0.0.1 - login.emory.edu - DEBUG [PROTOCOL_MESSAGE:124] -

<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL=https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST<https://urldefense.proofpoint.com/v2/url?u=https-3A__secure.web.emory.edu_Shibboleth.sso_SAML2_POST&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=IS_3u0Cxt1hx3RtCXjjldKpXEieSASS0ynBxL5Hv0xY&e=>Destination=https://login.emory.edu/idp/profile/SAML2/Redirect/SSO<https://urldefense.proofpoint.com/v2/url?u=https-3A__login.emory.edu_idp_profile_SAML2_Redirect_SSO&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=DmXijJQHdTVXoOp2PS6uuIDzTJ8vbjrdMrOGpuBC7IY&e=>ID="_96ad81269e572890e407955190fd4fc4" IssueInstant="2024-01-24T19:50:03Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://secure.web.emory.edu/</saml:Issuer<https://urldefense.proofpoint.com/v2/url?u=https-3A__secure.web.emory.edu_-253c_saml-3AIssuer&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=KbrtbFEDiC5dNVhB6lEC2489GJIquHT2EFV_h3FBlHE&e=>>

    <samlp:NameIDPolicy AllowCreate="1"/>

</samlp:AuthnRequest>

2024-01-24 14:50:04,050 - 127.0.0.1 - login.emory.edu - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:161] - Message Handler:  No metadata returned for https://upstream.idp/entity<https://urldefense.proofpoint.com/v2/url?u=https-3A__upstream.idp_entity&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=4v1yhkxxRk0SMZLKiBJZ-7p0K2jKH6u3fIYSm-sEEwY&e=> in role {urn:oasis:names:tc:SAML:2.0:metadata}IDPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol

2024-01-24 14:50:04,058 - 127.0.0.1 - login.emory.edu - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:170] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser<https://urldefense.proofpoint.com/v2/url?u=http-3A__shibboleth.net_ns_profiles_saml2_sso_browser&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=yhjIC2FjDPrpRqZLfJlbNEo8ZrF-xI3DSqtTU0br7Fo&e=> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://upstream.idp/entity<https://urldefense.proofpoint.com/v2/url?u=https-3A__upstream.idp_entity&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=4v1yhkxxRk0SMZLKiBJZ-7p0K2jKH6u3fIYSm-sEEwY&e=>)

2024-01-24 14:50:04,059 - 127.0.0.1 - login.emory.edu - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:142] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/SAML to intermediate set

2024-01-24 14:50:04,059 - 127.0.0.1 - login.emory.edu - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:316] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed

2024-01-24 14:50:04,127 - 127.0.0.1 - login.emory.edu - DEBUG [PROTOCOL_MESSAGE:70] -

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination=https://secure.web.emory.edu/Shibboleth.sso/SAML2/POST<https://urldefense.proofpoint.com/v2/url?u=https-3A__secure.web.emory.edu_Shibboleth.sso_SAML2_POST&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=IS_3u0Cxt1hx3RtCXjjldKpXEieSASS0ynBxL5Hv0xY&e=>ID="_01bd307ec9db399a264379e8a1af69a6" InResponseTo="_96ad81269e572890e407955190fd4fc4" IssueInstant="2024-01-24T19:50:04.062Z" Version="2.0">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://login.emory.edu/idp/shibboleth</saml2:Issuer<https://urldefense.proofpoint.com/v2/url?u=https-3A__login.emory.edu_idp_shibboleth-253c_saml2-3AIssuer&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=9zX0QKzBnBIz2475tTxYSB4V1Zy2Z9oNRC1oeqlOL2M&e=>>

    <ds:Signature xmlns:ds=http://www.w3.org/2000/09/xmldsig#<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2000_09_xmldsig-23&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=bN2n0zZ7Fypg_4JkDBFSsQ-g8CeKPkXUEqOp0RFnV1Y&e=>>

        <ds:SignedInfo>

            <ds:CanonicalizationMethod Algorithm=http://www.w3.org/2001/10/xml-exc-c14n#<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_10_xml-2Dexc-2Dc14n-23&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=Tii7Za6oXdZEZRDqIiWW3-9OxtI3TvJ2XHOHbzS4neA&e=>/>

            <ds:SignatureMethod Algorithm=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_04_xmldsig-2Dmore-23rsa-2Dsha256&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=en6mMHaf1lb0bJdjecMifALyqsWw4eTcfhqdASG-r0I&e=>/>

            <ds:Reference URI="#_01bd307ec9db399a264379e8a1af69a6">

                <ds:Transforms>

                    <ds:Transform Algorithm=http://www.w3.org/2000/09/xmldsig#enveloped-signature<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2000_09_xmldsig-23enveloped-2Dsignature&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=Z3hPCT-wjt9LNm5sgmHcuWh-fWGPi1cyQkSKKSaq3X0&e=>/>

                    <ds:Transform Algorithm=http://www.w3.org/2001/10/xml-exc-c14n#<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_10_xml-2Dexc-2Dc14n-23&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=Tii7Za6oXdZEZRDqIiWW3-9OxtI3TvJ2XHOHbzS4neA&e=>/>

                </ds:Transforms>

                <ds:DigestMethod Algorithm=http://www.w3.org/2001/04/xmlenc#sha256<https://urldefense.proofpoint.com/v2/url?u=http-3A__www.w3.org_2001_04_xmlenc-23sha256&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=szuUqL60Q7cCvKak3y7daOZxvkVxOWbftNEHYzZ4a5A&e=>/>

                <ds:DigestValue>3f35gnxlyq7pvzLDHXbi0gv+51DCKIa9BCCOKQU7eUI=</ds:DigestValue>

            </ds:Reference>

        </ds:SignedInfo>

        <ds:SignatureValue>HDikBaYNPz++PpScmOF4mNtKOdFWKBg7QOz1k932A461WMgsn1dpCE7RQZG+PacTWrjojOEW64jv1/mCroWteTY8MbXbOSVG8ldYplghkM6qcHNtdjztN25SbkZnTl6c69h8gpTbve06BZ/QGMagnTCXWxbRPrqxz/6QFg6Dc+zuJJoAaLUaVUR0NUHX9xLcSMD5SnksFxtAa71MbiLO+ZT2oRGlMCipAI5soxZ1FWGTk1cQ8l622houPRp9aOing0L9UxwBucZ+jJBkv7GwgAkBssy1AG6KkGQTdgxyXkNIWaX/eAVLjy7uo3lTirD0gz2pq0l2Fhlp5jEmcEUPCA==</ds:SignatureValue>

        <ds:KeyInfo>

            <ds:X509Data>

                <ds:X509Certificate>MIIDJzCCAg+gAwIBAgIUfGsUnIe4ehQbVOK7801PiWLKSX8wDQYJKoZIhvcNAQEFBQAwGjEYMBYG

A1UEAxMPbG9naW4uZW1vcnkuZWR1MB4XDTEwMDMyOTE2MjAwNVoXDTMwMDMyOTE2MjAwNVowGjEY

MBYGA1UEAxMPbG9naW4uZW1vcnkuZWR1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA

0RQxoj9S3eD6vcGOB39jZiPBRx1fTJf6MV96bHNwD/M+fBCR7t+07VScdH0pffvN0x7g5co0jWJ4

KT/16tPpA/14qzpKd3oHIFz5rgnG1qBSla+kqe9lzls72HMDA5vdaRpPib1ZsaB7JUyTTHMdvVcy

aovLILB/xt2cdy8CCJjIdNt+Uxl5gAwhKfU6DVYspFAWp4uVMJqO774Xn5Sa68ANjrRLTbMO7Bnq

gxCyAAN8ztGlsn+91Z5JnlMPI/q9uLh6xiUffiwo17S9KOQ+hqQx6XDQGI/U7TOanuohkC29qt09

tLYFXjAB3sfy66qsQfS/rXulScfJsSYNaziMaQIDAQABo2UwYzBCBgNVHREEOzA5gg9sb2dpbi5l

bW9yeS5lZHWGJmh0dHBzOi8vbG9naW4uZW1vcnkuZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQW

BBSC4HCY5liG+oEdDcyxnHhEZt8cKjANBgkqhkiG9w0BAQUFAAOCAQEAFdOSL9HrkUxokD0zm07e

gEpnltaHsusrsZvVhayfNqiRlgvhHBpJTa9xUaAyZ45VUsieP4olSdfyiMVMIRkVgo/gF4W//ZlG

xV28CnlalLR10NMzG6Kz03eRf6v5MQtVL+0EBTO7wiZAFIKYOv8nxpZoL7LV9l9x5SIDjsgmwV7w

Publ0X3aoGq6+IHIk1TZAA/xWJm1Z1W9fFRWXSLVS1/eCjPY4rjIktauEsi8Tj6QlhYFuo5WiEaV

tNluIP3MzpBSxCUyEov49a4rxpHNKPxpSZyFGTDS8Zsm6tV8cZfn0eCypcm3lqm/X3HSODuN6n5+

cVrRig01srF/2D9B1A==</ds:X509Certificate>

            </ds:X509Data>

        </ds:KeyInfo>

    </ds:Signature>

    <saml2p:Status>

        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">

            <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>

        </saml2p:StatusCode>

        <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>

    </saml2p:Status>

</saml2p:Response>

2024-01-24 14:50:04,128 - 127.0.0.1 - login.emory.edu - INFO [Shibboleth-Audit.SSO:338] - 2024-01-24T19:50:04.128577Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_96ad81269e572890e407955190fd4fc4|https://secure.web.emory.edu/|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.emory.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_01bd307ec9db399a264379e8a1af69a6||||Mozilla/5.0<https://urldefense.proofpoint.com/v2/url?u=https-3A__secure.web.emory.edu_-257Chttp-3A_shibboleth.net_ns_profiles_saml2_sso_browser-257Chttps-3A_login.emory.edu_idp_shibboleth-257Curn-3Aoasis-3Anames-3Atc-3ASAML-3A2.0-3Abindings-3AHTTP-2DPOST-257C-5F01bd307ec9db399a264379e8a1af69a6-257C-257C-257C-257CMozilla_5.0&d=DwMF-g&c=CJqEzB1piLOyyvZjb8YUQw&r=YbL7Tj_EqBW9abl6xEy1bs2UfpzD0fSGcxiXJeDGwtg&m=-2wGAA9VxBXg6iwdHElMuyU2sQ2rxofOm6sVZgefqtHpWDFW-cpzRGrORDIiNC5H&s=kKjAJ7gdynaAV97HDdOy3wZHgzNgGSMLZkEzHhKC__0&e=> (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0||urn:oasis:names:tc:SAML:2.0:status:Requester|

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240125/4af74cf5/attachment.htm>