OpenAI SSO integration with Shibboleth IdP

[Mathew, Sunil]

Thanks, Peter for the reply.

I adjusted AuthnRequestsSigned and WantAssertionsSigned as per your email.

> the metadata for that SP does not contain a key descriptor to verify any signatures with

Do I get this from OpenAI?

Sunil


From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Date: Tuesday, June 11, 2024 at 5:51 AM
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: OpenAI SSO integration with Shibboleth IdP
Mathew, Sunil via users <users at shibboleth.net> [2024-06-11 01:15 CEST]:
> 2024-06-10 22:52:27,116 -  - WARN [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Exception handling message
> org.opensaml.messaging.handler.MessageHandlerException: Validation of request simple signature failed for context issuer

Seems the authentication request from that SP is signed but ...

> <EntityDescriptor entityID="urn:auth0:openai:org-UOJCcINQqCsFDYQsuGmdF8OD"
>                   xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
>     <SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
>         <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>                                   Location=https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fauth0.openai.com%2Flogin%2Fcallback%3Fconnection%3Dorg-UOJCcINQqCsFDYQsuGmdF8OD&data=05%7C02%7Csmathew%40hbs.edu%7C44e08b22021a496f815408dc89fc0d31%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C638536962855409008%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=aPs2LIMtAJLCvf5mAqWviTElnZlooXWkLgho1DfD%2FJw%3D&reserved=0
>                                   index="1" isDefault="true"/>
>     </SPSSODescriptor>
> </EntityDescriptor>

... the metadata for that SP does not contain a key descriptor to
verify any signatures with.

I also find it weird that they're signing their requests and still set
AuthnRequestsSigned=false (which would be the default anyway and also
seems incorrect, so why set it?).
But then they also set WantAssertionsSigned=true which (according to
Scott) is usually a sure sign of a buggy implementation (otherwise we
could use signed Responses with the SP, not Assertions).

But then looking at their SAML SSO documentation (thanks, Sunil. for
providing the link):
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fhelp.openai.com%2Fen%2Farticles%2F8350141-provisioning-sso-and-or-setting-up-domain-verification-for-chatgpt-enterprise&data=05%7C02%7Csmathew%40hbs.edu%7C44e08b22021a496f815408dc89fc0d31%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C638536962855421119%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=RdP3Gs5ER%2FhJsPJdzYhSuppxxXdoZcKTySUUyq6rksU%3D&reserved=0<https://help.openai.com/en/articles/8350141-provisioning-sso-and-or-setting-up-domain-verification-for-chatgpt-enterprise>
that whole process is such an involved mess the above issues are
probably the least of your problems.

-peter
--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Csmathew%40hbs.edu%7C44e08b22021a496f815408dc89fc0d31%7C09fd564ebf4243218f2db8e482f8635c%7C0%7C0%7C638536962855428475%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=la%2FQ8XwqkJHT8GB1vRjI%2BiPtKXpH4nx63eaAMKEb9LM%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240611/4fbb5f15/attachment.htm>