OpenAI SSO integration with Shibboleth IdP

[Peter Schober]

Mathew, Sunil via users <users at shibboleth.net> [2024-06-11 01:15 CEST]:
> 2024-06-10 22:52:27,116 -  - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
> org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer

Seems the authentication request from that SP is signed but ...

> <EntityDescriptor entityID="urn:auth0:openai:org-UOJCcINQqCsFDYQsuGmdF8OD"
>                   xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
>     <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>         <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>                                   Location=https://auth0.openai.com/login/callback?connection=org-UOJCcINQqCsFDYQsuGmdF8OD
>                                   index="1" isDefault="true"/>
>     </SPSSODescriptor>
> </EntityDescriptor>

... the metadata for that SP does not contain a key descriptor to
verify any signatures with.

I also find it weird that they're signing their requests and still set
AuthnRequestsSigned=false (which would be the default anyway and also
seems incorrect, so why set it?).
But then they also set WantAssertionsSigned=true which (according to
Scott) is usually a sure sign of a buggy implementation (otherwise we
could use signed Responses with the SP, not Assertions).

But then looking at their SAML SSO documentation (thanks, Sunil. for
providing the link):
https://help.openai.com/en/articles/8350141-provisioning-sso-and-or-setting-up-domain-verification-for-chatgpt-enterprise
that whole process is such an involved mess the above issues are
probably the least of your problems.

-peter