<div dir="ltr"><div dir="ltr"><div>Hi Nathan,</div><div><br></div>saml2aws logs users in to Shibboleth by "scraping" and automating the web-based login form. The latest release has not yet been updated to support login pages that use CSRF tokens. This means that it does not submit the CSRF token along with the username and password and so Shibboleth rejects the login. <a href="https://wiki.shibboleth.net/confluence/display/IDP4/Cross-Site+Request+Forgery+%28CSRF%29+Protection">CSRF protection</a> is enabled by default for new installs of IdP 4.0 and is an option for upgrades. If you choose to enable it <a href="https://wiki.shibboleth.net/confluence/display/IDP4/Cross-Site+Request+Forgery+%28CSRF%29+Protection"></a>when you upgrade, then your saml2aws users will no longer be able to login via Shibboleth unless they update their saml2aws client.</div><div dir="ltr"><div> </div><div>See <a href="https://github.com/Versent/saml2aws/issues/638">https://github.com/Versent/saml2aws/issues/638</a> for more details. This issue has a pull request to fix it by storing the CSRF token and sending it with the login.</div><div><br></div><div>Max</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, 19 Mar 2021 at 21:08, Nathan Dors <<a href="mailto:dors@uw.edu">dors@uw.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">Hi Hari, can you say more about the csrf issue?<div><br></div><div>Does the issue arise due to new constraints introduced by IdPv4?<div><br></div><div>We have customers here who use saml2aws, but (uh oh) I'm not aware if we've accounted for this potential issue in our planning around our IdPv4 upgrade.</div><div><br></div><div>I understand ECP and AWSCLI-login provide a comparable solution, but it'd be useful to know more about the csrf with IdPv4.</div><div><br></div><div>-Nathan</div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Feb 17, 2021 at 6:53 AM Mailvaganam, Hari <<a href="mailto:hari.mailvaganam@ubc.ca" target="_blank">hari.mailvaganam@ubc.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-CA">
<div>
<p class="MsoNormal"><span style="font-size:11pt">FYI – confirmed – </span><span style="font-size:11pt">csrf.</span><span style="font-size:11pt"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(181,196,223);padding:3pt 0cm 0cm">
<p class="MsoNormal" style="margin-left:36pt"><b><span style="color:black">From:
</span></b><span style="color:black">users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of "Mailvaganam, Hari" <<a href="mailto:hari.mailvaganam@ubc.ca" target="_blank">hari.mailvaganam@ubc.ca</a>><br>
<b>Reply-To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Date: </b>Tuesday, February 16, 2021 at 8:14 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject: </b>saml2aws -- IDPV4<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><u></u> <u></u></span></p>
</div>
<table border="0" cellspacing="0" cellpadding="0" style="margin-left:36pt;border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0.75pt 0.75pt 0.75pt 0cm">
<p class="MsoNormal"><span style="font-size:9pt;font-family:Arial,sans-serif;color:black;background:rgb(255,236,179)">[<strong><span style="font-family:Arial,sans-serif">CAUTION:</span></strong> Non-UBC Email]</span><span style="font-size:11pt"><u></u><u></u></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Hi:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Has anyone had opportunity w.r.t saml2aws working with IDPV4.0.1?</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="https://github.com/Versent/saml2aws/blob/master/pkg/provider/shibboleth/README.md" target="_blank">https://github.com/Versent/saml2aws/blob/master/pkg/provider/shibboleth/README.md</a>
- from link tested with IDP v3.3, however can’t quite make out why not working with v4.0.1 (shot in the dark – csrf?)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Rreceiving message below ‘missing Assertion element. Issue only with saml2aws – the AWS console via SAML fine. No other changes made.</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">missing Assertion element</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">error parsing aws roles</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.selectAwsRole</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:190</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:90</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">main.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.goexit</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">Failed to assume role, please check whether you are permitted to assume the given role for the AWS service</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"><a href="http://github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login" target="_blank">github.com/versent/saml2aws/v2/cmd/saml2aws/commands.Login</a></span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/commands/login.go:92</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">main.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /Users/markw/Code/notgopath/saml2aws/cmd/saml2aws/main.go:163</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.main</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/proc.go:204</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt">runtime.goexit</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> /usr/local/Cellar/go/1.15.1/libexec/src/runtime/asm_amd64.s:1374</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:11pt"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Best regards,</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><b><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Hari Mailvaganam</span></b><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)"> <br>
Access Application Architect, Identity & Access Management (IAM)</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">Cybersecurity | CISO Office</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(0,33,69)">The University of British Columbia | Musqueam Traditional Territory<br>
420 - 6356 Agricultural Road | Vancouver BC | V6T1Z2 Canada<br>
Phone 604 827 5117</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:black">Privacy Matters @ UBC</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span lang="EN-US" style="font-size:10pt;font-family:Arial,sans-serif;color:black"> </span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">Upcoming Scheduled Out of Office:</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">-22<sup>nd</sup> March, 2021 – 26<sup>th</sup> March, 2021</span><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:36pt"><span style="font-size:10pt;font-family:Arial,sans-serif;color:rgb(255,192,0)">-09<sup>th</sup> August, 2021 – 20<sup>th</sup> August, 2021</span><u></u><u></u></p>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><div><br></div></div>