OpenAI SSO integration with Shibboleth IdP

[Mathew, Sunil]

Hi All,

I am integrating OpenAI SSO with Shibboleth IdP 4.2.1 according to the documentation here:
https://help.openai.com/en/articles/8350141-provisioning-sso-and-or-setting-up-domain-verification-for-chatgpt-enterprise

Upon clicking Edit SAML SSO, a modal will appear requesting two essential details: SSO URL and X.509 Certificate. These can be found within your IDP's settings.


Here is my configuration:

SSO URL: https://sso.hbsstg.org/idp/profile/SAML2/Redirect/SSO
X.509 Signing Certificate is idp-signing.crt

I am getting the following error in the browser when I login at chat.openai.com:
HBS Web Login Service - Message Security Error
The request cannot be fulfilled because the message received does not meet the security requirements of the login service.


Here are the logs (see attached for the full logs):
2024-06-10 22:52:27,113 -  - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:  Simple signature validation (with no request-derived credentials) failed
2024-06-10 22:52:27,113 -  - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:275] - Message Handler:  Simple signature validation (with no request-derived credentials) failed
2024-06-10 22:52:27,113 -  - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - Message Handler:  Validation of request simple signature failed for context issuer: urn:auth0:openai:org-UOJCcINQqCsFDYQsuGmdF8OD
2024-06-10 22:52:27,113 -  - WARN [org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler:214] - Message Handler:  Validation of request simple signature failed for context issuer: urn:auth0:openai:org-UOJCcINQqCsFDYQsuGmdF8OD
2024-06-10 22:52:27,116 -  - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer
               at org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler.doEvaluate(BaseSAMLSimpleSignatureSecurityHandler.java:216)
2024-06-10 22:52:27,116 -  - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer
               at org.opensaml.saml.common.binding.security.impl.BaseSAMLSimpleSignatureSecurityHandler.doEvaluate(BaseSAMLSimpleSignatureSecurityHandler.java:216)

Here is the attribute-filter.xml:

    <AttributeFilterPolicy id="OpenAI">

        <PolicyRequirementRule xsi:type="Requester" value="urn:auth0:openai:org-XXXXXX" />



        <AttributeRule attributeID="openai_email" permitAny="true" />

        <AttributeRule attributeID="openai_first_name" permitAny="true" />

        <AttributeRule attributeID="openai_last_name" permitAny="true" />

        <AttributeRule attributeID="openai_role_type_code" permitAny="true" />

        <AttributeRule attributeID="openai_role_type_desc" permitAny="true" />



    </AttributeFilterPolicy>


Here is the attribute-resolver.xml:

    <AttributeDefinition xsi:type="Simple" id="openai_email">

        <InputDataConnector ref="entMainDB" attributeNames="VALUE" />

        <AttributeEncoder xsi:type="SAML1String" name="email" encodeType="false" />

        <AttributeEncoder xsi:type="SAML2String" name="email" friendlyName="email" encodeType="false" />

    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="openai_first_name">

        <InputDataConnector ref="entMainDB" attributeNames="GIVENNAME" />

        <AttributeEncoder xsi:type="SAML1String" name="given_name" encodeType="false" />

        <AttributeEncoder xsi:type="SAML2String" name="given_name" friendlyName="given_name" encodeType="false" />

    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="openai_last_name">

        <InputDataConnector ref="entMainDB" attributeNames="SURNAME" />

        <AttributeEncoder xsi:type="SAML1String" name="family_name" encodeType="false" />

        <AttributeEncoder xsi:type="SAML2String" name="family_name" friendlyName="family_name" encodeType="false" />

    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="openai_role_type_code">

        <InputDataConnector ref="entRDB" attributeNames="ROLE_TYPE_CODE" />

        <AttributeEncoder xsi:type="SAML1String" name="roleTypeCode" encodeType="false" />

        <AttributeEncoder xsi:type="SAML2String" name="roleTypeCode" friendlyName="roleTypeCode" encodeType="false" />

    </AttributeDefinition>

    <AttributeDefinition xsi:type="Simple" id="openai_role_type_desc">

        <InputDataConnector ref="entRDB" attributeNames="ROLE_TYPE_DESC" />

        <AttributeEncoder xsi:type="SAML1String" name="roleTypeDesc" encodeType="false" />

        <AttributeEncoder xsi:type="SAML2String" name="roleTypeDesc" friendlyName="roleTypeDesc" encodeType="false" />

    </AttributeDefinition>


Here is the metadata.xml:

    <MetadataProvider id="OpenaiMD"

                      xsi:type="FilesystemMetadataProvider"

                      metadataFile="%{idp.home}/metadata/openai-metadata.xml"/>


Here is the openai-metadata.xml:

<EntityDescriptor entityID="urn:auth0:openai:org-UOJCcINQqCsFDYQsuGmdF8OD"

                  xmlns="urn:oasis:names:tc:SAML:2.0:metadata">

    <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

        <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

                                  Location=https://auth0.openai.com/login/callback?connection=org-UOJCcINQqCsFDYQsuGmdF8OD

                                  index="1" isDefault="true"/>

    </SPSSODescriptor>

</EntityDescriptor>


Please let me know if I am missing anything.


Regards,
Sunil

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240610/ab5f4e83/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: idp.log
Type: application/octet-stream
Size: 27658 bytes
Desc: idp.log
URL: <http://shibboleth.net/pipermail/users/attachments/20240610/ab5f4e83/attachment.obj>