When verifying SAML2 signature through the SAML verification tool, if the KeyInfo in the X509Data is X509Certificate, verification is successful.
<KeyInfo>
<X509Data>
<X509Certificate>MIIEVTCCA.....</X509Certificate>
</X509Data>
</KeyInfo>
If the KeyInfo is other type (X509SubjectName / X509SKI / X509IssuerSerial etc.) then verification fails.
<KeyInfo>
<X509Data>
<X509SKI>E5oVIj....</X509SKI>
</X509Data>
</KeyInfo>
Validation result: Is the correct certificate supplied in the keyinfo? false
Salesforce SAML assertion validation error
The problem is that we cannot use X509Certificate element due to 3rd party limitations.
Does Salesforce allow using any key identifiers in SAML responses instead of X509Certificate element?
Related
I am reading documentation about microsoft azure active directory. Here request sample:
<samlp:AuthnRequest
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
ID="id6c1c178c166d486687be4aaf5e482730"
Version="2.0" IssueInstant="2013-03-18T03:28:54.1839884Z"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
<Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://www.contoso.com</Issuer>
</samlp:AuthnRequest>
As you can see this does not contains any login or pass. Why? How azure figure out actual credentials?
Authentication request in SAML is a trigger that initiates a sequence that leads to authentication of a principal and subsequent assertion with claims about this principal.
From SAML 2.0 spec:
When a principal (or an agent acting on the principal's behalf) wishes
to obtain assertions containing authentication statements to establish
a security context at one or more relying parties, it can use the
authentication request protocol to send an message
element to a SAML authority and request that it return a
message containing one or more such assertions.
Kentor - Using the SampleMvcApplication with success through their StubIdp but when I try with Clareity I receive the above error.
Without knowing anything about the implementations ( Kentor, SampleMvcApplication, StubIdP, Clareity )it looks as if:
Your Identity Provider implementation does not return a 'RelayState' parameter in the body of the HTTP POST along with the SAMLResponse.
Your Identity Provider implementation has added an InResponseTo attribute in the SAMLResponse element
Your Service Provider implementation interprets this as an IdP initiated SSO since it does not see a 'RelayState' parameter
Your Service Provider throws an error since it doesn't make sense for an SAMLResponse in an IdP initiated SSO flow to have an InResponseTo. InResponseTo refers to an AuthenticationRequest which is only there in a normal SP initiated SSO.
To get more help, you should tell us a little about the implementation you are using and your configuration.
I need a clarification about the terminology used in SAML2.0. I want to know if by "assertions" we mean a particular subcategory of SAML2.0 messages
or if we mean ALL SAML2.0 messages.
A SAML Assertion is an XML document that represents a set of claims (i.e. name/value pairs) about a user asserted by an Identity Provider. A SAML Assertion is not a SAML message itself, but it is contained in a SAML Response message. Apart from that there are other SAML messages such as SAML Requests, Logout Requests and Logout Responses that don't contain Assertions.
I did SSO of OpenAM and SalesForce.com (SFDC)
I have installed OpenAM-Client SDK to retrieve SAML Assertion from OpenAM.
I used this assertion data to generate SAML response required for SalesForce. When I pass this data to SFDC. I got error message for SAML.
“Failed: Signature Invalid/Configured Certificate Mismatch”
I used same certificate and signature data which I got from OpenAM-client SDK public API assertion.
At time of SSO configuration with SDFC. I used default certificate (test cert) provided by OpenAM.
Is there any way to retrieve test certificate and its signature from OpenAM ?
Run one of the failing SAML assertions through the SAML Validation tool inside Single Sign-On Settings in SFDC; you should get a slightly more useful error. The most likely cause of this is that you have not uploaded the correct certificate to SFDC as part of your SSO setup. Make sure the "Identity Provider Certificate" section of "Single Sign-On Settings" matches the cert contained in the assertion.
I got SAML assertion from TrustAuthorityClient API. with below Public API code
securityToken = client.getSecurityToken("default", endpointURL, mexEndpointURL,
(java.lang.Object)ssoToken, SecurityMechanism.STS_SECURITY_URI,
(getServletConfig()).getServletContext());
But this is created with SunSTS.
When I test this Assertion to retrieve access token from SalseForce. it gives me invalid Assertion.
Is there any way retrieve SAML response from OpenAM for SalesForce?
When I test IDP initiates SSO with SalesForce. In Debug log I can see SAML Response is created for SSO.
How should I retrieve this SAML response from OpenAM?
You may need to grab the SAML Response via JavaScript at the front end. The full response will be in a SAMLResponse object after SSO, so your Assertion Consumer Service URL (SP SSO URL) that would receive this would need to check for that parameter, save it and somehow submit to SFDC for OAuth token exchange. Alternatively, take the Assertion from SunSTS and make your SAMLP Response wrapper yourself.
I believe this is due to SFDC implementing an earlier draft of the SAML 2.0 Bearer Assertion Profiles for OAuth 2.0 (see: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-saml2-bearer-10).
The latest draft of that spec does not require the Response wrapper - likely just the Assertion itself from SunSTS will work, provided SFDC updates to support it.