Comments (12)
https://pkg.go.dev/github.com/crewjam/saml#AuthnRequest
Line 57 in 5a6e8cc
http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf
from saml.
Well, ProtocolBinding is set as: ProtocolBinding="".
This should be ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" probably.
from saml.
If I add
ProtocolBinding: HTTPPostBinding,
around line 185 in service_provider.go
, I get further, but the authentication still fails with an error from the library:
ERROR: Status code was not urn:oasis:names:tc:SAML:2.0:status:Success
The status returned seems to be:
urn:oasis:names:tc:SAML:2.0:status:Responder
from saml.
You are using samlsp? If so I agree with @puiterwijk that we need to set ProtocolBinding there.
The urn:oasis:names:tc:SAML:2.0:status:Responder
seems to mean it is an IDP error. I wonder if there is a message on the Ipsilon side that might offer a clue.
from saml.
Yes, using samlsp.
The IDP (ipsilon) has at least this in the log:
[Tue Oct 18 15:14:47.910108 2016] [:error] [pid 24560] [18/Oct/2016:15:14:47] ERROR: Authentication succeeded but it was not provided by NameID urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName
from saml.
That's related to #21: this library doesn't suggest a NameID to use.
You probably want to reconfigure the Allowed NameIDs and default NameID in Ipsilon to "unspecified", as that'll just provide the username. You can also use "transient".
from saml.
Yes, unspecified/transient does work, as long as ProtocolBinding is set. No X-Saml-Cn
header like in the example, though.
Thank you very much @puiterwijk for helping with this!
from saml.
Thank you again for the swift response.
So I removed my little patch of adding ProtocolBinding, updated my git checkout of saml and tried to auth against ipsilon again. Without success, I'm afraid. The error message is the same as before.
@puiterwijk thinks the sp metadata needs to have HTTP-Redirect as well, i.e. HTTPRedirectBinding
from saml.
So, the problem with your commit is that you're now telling the IdP that you want to use the SP's HTTP-Redirect ProtocolBinding.
While this is sane to use for SP -> IdP communication, this is unfeasible for IdP -> SP communication.
Especially if you're requesting AuthnResponse's to be signed, since the size of the response would exceed the max limit of most client's HTTP headers.
Some libraries, like the Lasso library used by Ipsilon, will just refuse this for this and other reasons: https://repos.entrouvert.org/lasso.git/commit/?id=88236da2
For this reason, I would suggest to request PostBinding as response, even if you use the HTTP-Redirect binding at the IdP.
So, I think that in the func Redirect(), you need to use: reqCopy.ProtocolBinding = HTTPPostBinding
from saml.
You are absolutely right. I messed it up.
Architecturally, saml.AuthnRequest should probably not be opinionated about how the response is returned. But samlsp.Middleware only supports post, so req.ProtocolBinding should be set there.
Thanks for setting me straight.
from saml.
Thank you again!
That seems to have done it. Even the user name is present as the X-Saml-Subject
header.
from saml.
where is this all documented that there is field called ProtocolBinding in AuthnRequest object. Can someone reference me pls.
from saml.
Related Issues (20)
- Azure SAML2.0 not surport
- [question] idp example HOT 1
- Is this project still maintained? HOT 1
- Path property in CookieSessioProvider struct is missing
- ADFS HTTP-Artifact Signature
- Upgrade to use golang-jwt v5
- Why is the default SP signing algorithm SHA1
- bug: make logout request need add signature logic if `sp.SignatureMethod` is not empty. HOT 7
- Feature: IDP metadata URL should not be mandatory
- Should I fork a repo to receive the contribution [Or a community]
- Fail to authenticate on AzureAD when creating signed MakeAuthenticationRequest
- Externalize Login form
- How to log in by clicking on my app via Okta app?
- How to support multiple idp? HOT 1
- [Update Request] Update Project EOL component github.com/beevik/etree:v1.1.0
- can't figure out how to implement IDP initiated from IDP (for writing tests) HOT 2
- How to create a SAML response with Response and Assertion signature
- How to handle IdP-initiated Single Logout (SLO) in the SP ? HOT 1
- When encrypting SAML assertion only SHA1 option can be used
- [Question] Why the Redirect function doesn't handle the error when parsing an URL
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from saml.