Workaround for updated SAML not working against Entra ID

[mrrothe]

Description

As per release notes for 6.2.0, updated version of SAML library requires additional configuration to retain previous behavior with regards to assertion/response singing.

Despite adding the suggested configuration, authentication is still failing with the error

"message":"SAML assertion audience mismatch"

Environment

1. Docker on Debian 11 Bullseye
2. OpenCTI Version 6.2.3
3. OpenCTI client: web frontend
4. SAML docker-compose config

 - PROVIDERS__SAML__STRATEGY=SamlStrategy
      - PROVIDERS__SAML__CONFIG__LABEL="Login with Entra ID"
      - PROVIDERS__SAML__CONFIG__ISSUER=REDACTED
      - PROVIDERS__SAML__CONFIG__CERT=${SAML_CERT}
      - PROVIDERS__SAML__CONFIG__ENTRY_POINT=https://login.microsoftonline.com/REDACTED/saml2
      - PROVIDERS__SAML__CONFIG__SAML_CALLBACK_URL=https://opencti.REDACTED.uk/auth/saml/callback
      - PROVIDERS__SAML__CONFIG__WANT_AUTHN_RESPONSE_SIGNED=false
      - PROVIDERS__SAML__CONFIG__WANT_ASSERTIONS_SIGNED=false
      - PROVIDERS__SAML__CONFIG__DISABLE_REQUESTED_AUTHN_CONTEXT=true

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Start docker containers with above config
2. Click "Login with Entra ID"
3. Browser redirects via Entra ID and then returns to OpenCTI login page

Expected Output

User is logged in

Actual Output

Browser returns to OpenCTI login page

Additional information

Logs from Docker container

{"category":"APP","errors":[{"attributes":{"genre":"TECHNICAL","http_status":500},"message":"SAML assertion audience mismatch","name":"UNKNOWN_ERROR","stack":"UNKNOWN_ERROR: SAML assertion audience mismatch\n    at error (/opt/opencti/build/src/config/errors.js:8:10)\n    at UnknownError (/opt/opencti/build/src/config/errors.js:82:47)\n    at Object._logWithError (/opt/opencti/build/src/config/conf.js:235:17)\n    at Object.error (/opt/opencti/build/src/config/conf.js:244:48)\n    at /opt/opencti/build/src/http/httpPlatform.js:402:14\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)"},{"message":"SAML assertion audience mismatch","name":"Error","stack":"Error: SAML assertion audience mismatch\n    at /opt/opencti/build/node_modules/@node-saml/node-saml/src/saml.ts:1209:18\n    at Array.map (<anonymous>)\n    at nDn.checkAudienceValidityError (/opt/opencti/build/node_modules/@node-saml/node-saml/src/saml.ts:1204:8)\n    at nDn.processValidlySignedAssertionAsync (/opt/opencti/build/node_modules/@node-saml/node-saml/src/saml.ts:1096:32)\n    at processTicksAndRejections (node:internal/process/task_queues:95:5)\n    at nDn.validatePostResponseAsync (/opt/opencti/build/node_modules/@node-saml/node-saml/src/saml.ts:722:16)"}],"level":"error","message":"SAML assertion audience mismatch","provider":"saml","source":"backend","timestamp":"2024-07-10T10:30:02.489Z","version":"6.2.3"}

[mrrothe]

Just to add, this was working without issue in 6.1 without the additional SAML configuration

[SamuelHassine]

Hello,

Here is the working configuration in our cloud env:

              PROVIDERS__SAML__STRATEGY: "SamlStrategy"
              PROVIDERS__SAML__CONFIG__LABEL: "Corporate login"
              PROVIDERS__SAML__CONFIG__ISSUER: "opencti-filigran"
              PROVIDERS__SAML__CONFIG__ENTRY_POINT: "https://login.microsoftonline.com/[REDACTED]/saml2"
              PROVIDERS__SAML__CONFIG__SAML_CALLBACK_URL: "https://filigran.octi.filigran.io/auth/saml/callback"
              PROVIDERS__SAML__CONFIG__DISABLE_REQUESTED_AUTHN_CONTEXT: "true"
              PROVIDERS__SAML__CONFIG__CERT: "MIIC8DCCAdigAwIBAgIQfFMNtRPA5oxAfD5VLfjw9jANBgkqhkiG9w0BAQsFADA0MTIwMAYDVQQDEylNaWNyb3NvZnQg[...]"
              PROVIDERS__SAML__CONFIG__ACCOUNT_ATTRIBUTE: "http://schemas.microsoft.com/identity/claims/displayname"
              PROVIDERS__SAML__CONFIG__FIRSTNAME_ATTRIBUTE: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"
              PROVIDERS__SAML__CONFIG__LASTNAME_ATTRIBUTE: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"

[mrrothe]

I've tried adding the ACCOUNT/FIRSTNAME/LASTNAME ATTRIBUTE fields as per your config above - and tested with all combinations of WANT_AUTHN_RESPONSE_SIGNED and WANT_ASSERTIONS_SIGNED enabled/disabled.

Both -> "SAML assertion audience mismatch" Just 'WANT_ASSERTIONS_SIGNED=false' -> "Invalid document signature" Just 'WANT_AUTHN_RESPONSE_SIGNED=false' -> "SAML assertion audience mismatch" Neither -> "Invalid document signature"

Not sure if there's anything different that needs to be configured on the Entra ID side - no errors/issues in the Entra ID logs and I can't see any configuration options for signing etc on that end.

Does adding a private key to the SAML config allow the response/assertion to be signed and remove the need for these additional parameters? If so is there any documentation for generating this private key?

[SamuelHassine]

@pierremahot @sbocahu did we changed anything in our instances for the Microsoft Entra SAML2 configuration following the library upgrade?

[MaxwellDPS]

Seeing the same Issues with ADFS post upgrade to 6.2.6

[mrrothe]

I've done some testing with a newly created key-pair. Generated with OpenSSL, uploaded public to the SAML Verification Certificate section on Entra and the private into the OpenCTI config. Still had the same error about SAML assertion audience mismatch even with the requests being signed. I've found an option within Entra ID SAML settings to override the 'Audience claim value' - I've tried setting this to my OpenCTI URL with/without trailing slash but no change. https://learn.microsoft.com/en-us/entra/identity-platform/saml-claims-customization#advanced-saml-claims-options

[Markus98]

We faced the same issue but were able to fix it by explicitly setting the configuration variable PROVIDERS__SAML__CONFIG__AUDIENCE to the value that that is returned under <AudienceRestriction><Audience> in the SAML response.

[mrrothe]

@Markus98 That has solved it! Thanks very much for the tip

-- I don't think this configuration option is mentioned in the OpenCTI documentation at all, would it be worth adding a reference to it?