Comments (7)
This is stalled. My work in progress here is in the sp-authn-request-signing branch, but I can't testshib to accept the request. Ugh.
from saml.
@crewjam Hey Ross, I implemented this logic in my fork of this repo: https://github.com/edaniels/go-saml. The only thing is that I decided to gut out the libxmlsec1 stuff since it ended up working out better to just use the binary instead (less dynamic linking). Let me know if you want to actually get this all upstream instead.
from saml.
Eric,
So I'm not 1000% opposed to using the xmlsec1 binary, but I did put in quite a bit of effort to avoid it initially. If there is no rational & reasonably efficient way to get this implemented then I'm grudgingly cool with it.
OTOH, if you now have something that works which we can test against and compare, maybe that is what is needed to get it working with the libxmlsec wrapper -- when I was trying before testshib was just rejecting the requests and I couldn't figure out why.
I'm very open to other thoughts here. :)
-Ross
from saml.
Looking at your branch, I'm not sure why the signing isn't working exactly. In my version I'm using the embedded/enveloped signature in the XML AuthnRequest itself as opposed to the query string version you were attempting. If you wanted to follow that route but via libxmlsec, you could literally follow along the libxmlsec source code for the binary and see exactly what it does (that's how I made other parts work while porting).
My case for using the binary is that it makes for an easier time when using this on any platform where you just need to somehow get the binary. Installing the library itself typically installs the binary (at least on OSX). Plus the clang warnings on OSX are pretty gnarly ;)
I don't mind maintaining my own version of the repo but it would be nice to have it be in one place in case I ever make any more improvements. Alternatives would include somehow choosing the underlying xmlsec pkg you want at build time.
from saml.
I too am in a difficult situation here. I'm integrating my app with an IDP that requires signed authn requests. Is this still not working? @edaniels I might want to use your fork so I can get signed requests working. I would need to check diffs between your fork and mine. I've had to make several changes of my own to get this working with a Ping-federate IDP.
from saml.
@exedor, you should probably be fine then. Just keep in mind that if you have a high volume of requests, you're going to be creating a lot of out of process requests.
from saml.
@crewjam @edaniels any update on this? I don't think there's a sp-authn-request-signing
branch anymore. Is it working?
from saml.
Related Issues (20)
- Azure SAML2.0 not surport
- [question] idp example HOT 1
- Is this project still maintained? HOT 1
- Path property in CookieSessioProvider struct is missing
- ADFS HTTP-Artifact Signature
- Upgrade to use golang-jwt v5
- Why is the default SP signing algorithm SHA1
- bug: make logout request need add signature logic if `sp.SignatureMethod` is not empty. HOT 7
- Feature: IDP metadata URL should not be mandatory
- Should I fork a repo to receive the contribution [Or a community]
- Fail to authenticate on AzureAD when creating signed MakeAuthenticationRequest
- Externalize Login form
- How to log in by clicking on my app via Okta app?
- How to support multiple idp? HOT 1
- [Update Request] Update Project EOL component github.com/beevik/etree:v1.1.0
- can't figure out how to implement IDP initiated from IDP (for writing tests) HOT 2
- How to create a SAML response with Response and Assertion signature
- How to handle IdP-initiated Single Logout (SLO) in the SP ? HOT 1
- When encrypting SAML assertion only SHA1 option can be used
- [Question] Why the Redirect function doesn't handle the error when parsing an URL
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from saml.