IdP v5 external authentication error

[Martin Salvadori]

Hello, I'm new to Shibboleth and I'm trying to use Shibboleth IdP v5 as an
Identity Provider, using the External authentication method, authenticating
in a custom JSP page, similar to the example provided in the documentation
at
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505369/ExternalAuthnConfiguration
.
I'm trying to configure everything so that the IdP serves authentication
requests sent from Google Workspace (i.e., Google acting as the Service
Provider), but I'm not getting it to work.

For a proof of concept, I installed Shiboleth IdP v5.1.3 with Jetty 12.0.13
using the packaged Windows Installation installer.
I'm using a tunnel with ngrok to publish the IdP+Jetty host (ngrok http
443).

In Google Workspace (Google Admin console > Security > Authentication > SSO
with third-party IdP), I configured the IdP name and uploaded the signing
certificate generated during the IdP installation.
The URL of the sign-in page points to the JSP page that implements external
authentication: https://<MY_NGROK_HOST>/idp/external.jsp

When receiving the authentication request, it throws the following
exception:
2025-03-17 12:52:46,330 - - ERROR
[net.shibboleth.shared.spring.error.ErrorRaisingController:63] -
Propagating exception thrown by request to /idp/external.jsp
2025-03-17 12:52:46,331 - - ERROR
[net.shibboleth.idp.authn.ExternalAuthenticationException:144] -
net.shibboleth.idp.authn.ExternalAuthenticationException: No conversation
key found in request
at
net.shibboleth.idp.authn.ExternalAuthentication.startExternalAuthentication(ExternalAuthentication.java:159)

What I'm doing wrong? Can someone please help me?
Thank you very much!

Martin

Configuration details, jsp page and IdP Status below:


*conf/authn/authn.properties:*idp.authn.flows = External
idp.authn.External.addDefaultPrincipals = false
idp.authn.External.externalAuthnPath = contextRelative:external.jsp


*conf/metadata-providers.xml:*<?xml version="1.0" encoding="UTF-8"?>
<MetadataProvider ....>
    <MetadataProvider id="LocalEntityMetadata"
xsi:type="FilesystemMetadataProvider"
metadataFile="%{idp.home}/metadata/google-metadata.xml"/>
</MetadataProvider>



*metadata/google-metadata.xml:*<md:EntityDescriptor entityID="
https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="
http://www.w3.org/2000/09/xmldsig#">
    <md:SPSSODescriptor WantAssertionsSigned="true"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor use="signing">
            <ds:KeyInfo>
                <ds:X509Data>

<ds:X509Certificate>CERTIFICATE_DATA</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:SingleLogoutService
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs" />
        <md:AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://accounts.google.com/samlrp/xxxxxxxxxxxxxxx/acs" />
    </md:SPSSODescriptor>
</md:EntityDescriptor>



*edit-webapp/external.jsp:*<%@page
import="ch.qos.logback.core.net.SyslogOutputStream"%>
<%@ page language="java" contentType="text/html; charset=UTF-8"
pageEncoding="UTF-8"%>
<%@ page import="net.shibboleth.idp.authn.*"%>
<%@ page import="net.shibboleth.idp.attribute.*"%>
<%@ page import="net.shibboleth.idp.authn.principal.*"%>
<%@ page import="net.shibboleth.shared.primitive.LoggerFactory"%>
<%@ page import="java.util.*"%>
<%@ page import="java.security.*"%>
<%@ page import="javax.security.auth.*"%>
<%@ page import="org.slf4j.Logger"%>
<%
final Logger log = LoggerFactory.getLogger("external.jsp");

try {
    log.info("Inicia autenticación externa");

    /**
     * External authentication logic
     **/

    final String key =
ExternalAuthentication.startExternalAuthentication(request); // EXCEPTION
THROWN HERE

    String userName = "myusername";
    HashSet<Principal> principals=new HashSet<Principal>();
    principals.add(new UsernamePrincipal(userName));

    IdPAttribute attr=new IdPAttribute("uid");
    attr.setValues(Collections.singletonList(new
StringAttributeValue(userName)));
    principals.add(new IdPAttributePrincipal(attr));

    attr=new IdPAttribute("mail");
    attr.setValues(Collections.singletonList(new
StringAttributeValue(userName + "@mydomain")));
    principals.add(new IdPAttributePrincipal(attr));

    attr=new IdPAttribute("displayName");
    attr.setValues(Collections.singletonList(new
StringAttributeValue(userName)));
    principals.add(new IdPAttributePrincipal(attr));

    attr=new IdPAttribute("eduPersonAffiliation");
    attr.setValues(Collections.singletonList(new
StringAttributeValue("member")));
    principals.add(new IdPAttributePrincipal(attr));

    request.setAttribute(ExternalAuthentication.SUBJECT_KEY,new
Subject(false, principals, Collections.EMPTY_SET, Collections.EMPTY_SET));

    ExternalAuthentication.finishExternalAuthentication(key, request,
response);
} catch (final ExternalAuthenticationException e) {
    log.error("Error processing external authentication request", e);
    throw new ServletException("Error processing external authentication
request", e);
}
%>


*IDP Status:*### Operating Environment Information
operating_system: Windows 11
operating_system_version: 10.0
operating_system_architecture: amd64
jdk_version: 17.0.14
available_cores: 12
used_memory: 86 MB
maximum_memory: 2048 MB

### Identity Provider Information
idp_version: 5.1.3
start_time: 2025-03-13T17:14:30.287Z
current_time: 2025-03-14T19:34:18.989696100Z
uptime: PT26H19M48.702S

enabled modules:
        idp.Core (Core IdP Functions (Required))
        idp.CommandLine (Command Line Scripts)
        idp.EditWebApp (Overlay Tree for WAR Build)
        idp.authn.Password (Password Authentication)
        idp.admin.Hello (Hello World)
        idp.plugin.MetadataGen (SAML Metadata Generator)

installed plugins:
        net.shibboleth.idp.plugin.metadatagen Version 2.0.0
        net.shibboleth.idp.plugin.nashorn Version 2.0.0
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250317/5dec556c/attachment.htm>