Signature tag in assertion request

[Amit Dongaonkar]

Hi Scott,
Thanks for pointing me to the resources.
I did the checks as per your earlier email.

What is confusing is that the partner whom we are sending an auth request maintains two IdPs.
Both require that the auth requests be signed.  So the 'WantAuthnRequestsSigned="true"' parameter is set in the IdP metadata from both the IdPs.

Now when the Shib SP is sending the request from our end in one case it is not embedding the certificate(case1 below) while in the other case it is(case 2 below). The configurations are identical on our end for both the IdPs. The IdP is not expecting the embedded certificate.

Any pointers would be highly appreciated.


Case 1 auth request:
<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://target.application.domain/Shibboleth.sso/SAML2/POST"
                    Destination="https://partner.idp.endpoint/saml20/login"
                    ID="_f761612e0577dd486d9a63277328b59a"
                    IssueInstant="2024-07-19T15:35:21Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://target.application.domain/</saml:Issuer>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>


Case 2 auth request:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    AssertionConsumerServiceURL="https://target.application.domain/Shibboleth.sso/SAML2/POST"
                    Destination="https://partner.idp.endpoint/saml20/login"
                    ID="_f761612e0577dd486d9a63277328b59a"
                    IssueInstant="2024-07-19T15:35:21Z"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    Version="2.0"
                    >
    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://target.application.domain/</saml:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo>
            <ds:CanonicalizationMethod Algorithm="****algorithm*****" />
            <ds:SignatureMethod Algorithm="****algorithm*****" />
            <ds:Reference URI="resource URI">
                <ds:Transforms>
                    <ds:Transform Algorithm="****algorithm*****" />
                    <ds:Transform Algorithm="****algorithm*****" />
                </ds:Transforms>
                <ds:DigestMethod Algorithm="****algorithm*****" />
                <ds:DigestValue>****digest value****</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>***signature value***</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:KeyName>**key name**</ds:KeyName>
            <ds:KeyName>**key name**</ds:KeyName>
            <ds:X509Data>
                <ds:X509SubjectName>****subject name ******</ds:X509SubjectName>
                <ds:X509Certificate>  **** certificate string*****
</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <samlp:NameIDPolicy AllowCreate="1" />
</samlp:AuthnRequest>

Thanks and Regards,

Amit Dongaonkar

________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Friday, July 19, 2024 12:32 PM
To: Amit Dongaonkar <amitd at nitssolutions.com>; Shib Users <users at shibboleth.net>
Subject: Re: Signature tag in assertion request

CAUTION : EXTERNAL SENDER | Proceed carefully when clicking links or opening attachments.

> Hi Scott, Thats what I suspected too. However, this
> parameter is set to true on other IdP metadata files too .

The SP is only going to sign in two cases:

- that flag
- you tell it to sign

Setting the SP option to false will also forcibly disable the signing regardless.

https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334379/SigningEncryption#Transport-Authentication

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240721/fc57deb0/attachment.htm>