<div dir="ltr">Hi Hari, can you say more about the csrf issue?<div><br></div><div>Does the issue arise due to new constraints introduced by IdPv4?<div><br></div><div>We have customers here who use saml2aws, but (uh oh) I'm not aware if we've accounted for this potential issue in our planning around our IdPv4 upgrade.</div><div><br></div><div>I understand ECP and AWSCLI-login provide a comparable solution, but it'd be useful to know more about the csrf with IdPv4.</div><div><br></div><div>-Nathan</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 17, 2021 at 6:53 AM Mailvaganam, Hari <<a href="mailto:hari.mailvaganam@ubc.ca">hari.mailvaganam@ubc.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-CA" style="overflow-wrap: break-word;">
<div class="gmail-m_8090212958961972509WordSection1">
<p class="MsoNormal"><span style="font-size:11pt">FYI – confirmed – </span><span style="font-size:11pt">csrf.</span><span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:36pt"><b><span style="color:black">From:
</span></b><span style="color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of "Mailvaganam, Hari" <<a href="mailto:hari.mailvaganam@ubc.ca" target="_blank">hari.mailvaganam@ubc.ca</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Tuesday, February 16, 2021 at 8:14 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>saml2aws -- IDPV4<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<table border="0" cellspacing="0" cellpadding="0" style="margin-left:36pt;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0.75pt 0.75pt 0.75pt 0cm">
<p class="MsoNormal"><span style="font-size:9pt;font-family:Arial,sans-serif;color:black;background:rgb(255,236,179)">[<strong><span style="font-family:Arial,sans-serif">CAUTION:</span></strong> Non-UBC Email]</span><span style="font-size:11pt"><u></u><u></u></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Hi:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Has anyone had opportunity w.r.t saml2aws working with IDPV4.0.1?</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="https://github.com/Versent/saml2aws/blob/master/pkg/provider/shibboleth/README.md" target="_blank">https://github.com/Versent/saml2aws/blob/master/pkg/provider/shibboleth/README.md</a>
- from link tested with IDP v3.3, however can’t quite make out why not working with v4.0.1 (shot in the dark – csrf?)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Rreceiving message below ‘missing Assertion element. Issue only with saml2aws – the AWS console via SAML fine. No other changes made.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">missing Assertion element</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">error parsing aws roles</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:190</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:90</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">main.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.goexit</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Failed to assume role, please check whether you are permitted to assume the given role for the AWS service</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:92</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">main.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.goexit</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Best regards,</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><b><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Hari Mailvaganam</span></b><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)"> <br>
Access Application Architect, Identity & Access Management (IAM)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Cybersecurity | CISO Office</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">The University of British Columbia | Musqueam Traditional Territory<br>
420 - 6356 Agricultural Road | Vancouver BC | V6T1Z2 Canada<br>
Phone 604 827 5117</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:black">Privacy Matters @ UBC</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">Upcoming Scheduled Out of Office:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">-22<sup>nd</sup> March, 2021 – 26<sup>th</sup> March, 2021</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">-09<sup>th</sup> August, 2021 – 20<sup>th</sup> August, 2021</span><u></u><u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>