search

amdonov / lite-idp

Lightweight SAML Identity Provider
Apache License 2.0
210 stars 48 forks source link

Config sample #13

Open j-ramirez-bi4group opened 5 years ago

j-ramirez-bi4group commented 5 years ago

Could you provide a config YAML file to see how a SP should be defined? something like 

serviceProviders:
 - EntityId: https://1c61bc0a.ngrok.io
   Certificate: hack/tls-setup/certs/service_provider_cert.pem
   AssertionConsumerServices:
    - Index: 0
      IsDefault: true
      Binding: Artifact
      Location: https://1c61bc0a.ngrok.io/saml/artifact_resolution

Thanks in advance

amdonov commented 5 years ago

Does your service provider implementation provide a metadata endpoint? If it does the easiest way to properly configure it is to run

lite-idp add service-provider "metadata file or url"

That will add the appropriate settings into your configuration file. If your SP doesn't generate metadata let me know, and I'll send you an example this evening.

j-ramirez-bi4group commented 5 years ago

Thank you so much, it worked, but now i'm getting the error unsupported signature algorithm, with this AuthnRequest

<?xml version="1.0" encoding="UTF-8"?>
<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="_880b99d6c7edf8c5e48b77123f48a1c2e0d852287a" IssueInstant="2019-07-10T15:45:43.751Z" Destination="https://localhost:9443/SAML2/Redirect/SSO" AssertionConsumerServiceURL="https://1c61bc0a.ngrok.io/saml/digid/artifact_resolution" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ForceAuthn="false">
   <saml:Issuer>https://1c61bc0a.ngrok.io</saml:Issuer>
   <NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true" />
   <RequestedAuthnContext Comparison="minimum">
      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</saml:AuthnContextClassRef>
   </RequestedAuthnContext>
   <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo>
         <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
         <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
         <Reference URI="#_880b99d6c7edf8c5e48b77123f48a1c2e0d852287a">
            <Transforms>
               <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
               <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>kkrEJOJi1UnbC7azHgcqTwnmyOU=</DigestValue>
         </Reference>
      </SignedInfo>
      <SignatureValue>Uw19xvBFnn5tuwytWXV01K1M23+mJBvWHqiCN0teUQjz7j5c+Kp/E7yKmf3SCoThV3dF3OpSNj8Z7hFEUrDpMtBEbKKMmjRT8BX2cz3gTYzF33Wgp1KGXStLFMRaTKP77gVnYYE71G4y9/ckP4tNHU1hhmcZCMDiMlwdI7CByoAiGQMxvHv+1BT8SmaPZ3e/M/1bbK8aVPZjYJ9Wjo6kNrS+a64xZEStHH309IjyZgwGDS7qt5bOxcxvcrf6gFGU5Sb+HbVWzBmRLX/DjBrPCyZCSYD9fc1vlh9ujP1PqLNEvEHAxC0qjKuINrK/lWWYss7wBB1OhTFYiLzGoJVIrukA6dRIV3pr4t9x6yi/yNzOKD40f5LI68TJMuTR75WTfVceBOHbdlRKcRojdOv4LF9tn6zckS1glGFB93gmI8uvCCS/E4m2pAkWtMxNaqB4wRKX9KAnMJacNXKCp7ARj+0px4Z4/kU16Ll6+QwiX+0lm0kCNEIpHNfMNMTaA1KxlJOO1xeTP91bzksYhFyx5PYssgllk5JjYxah0Z0ZqxfbCC9Q7TjdzQrNEQFpRmINZ/RMAXfg+PrWjA6ILxJSANzh4KKcTqWkGrHR0hrc7l1g+tvHW8ZImYG/EGcfvkC1Q8BfuKZzWeAErBi6rbZBQ57+cgARKMGIGV7Vc/GCXDY=</SignatureValue>
   </Signature>
</AuthnRequest>

But the signature Algorithm is there, so i don't get it...

amdonov commented 5 years ago

You should be probably using the redirect binding to submit your authnrequest. In that case, the signature and the algorithm are request parameters. Is that what you're doing?

j-ramirez-bi4group commented 5 years ago

Yes, i'm doing that, because the POST binding is not implemented, is it?

amdonov commented 5 years ago

Not at this time.

amdonov commented 5 years ago

Can you post the URL string that you're sending to the redirect binding endpoint?

j-ramirez-bi4group commented 5 years ago

Sure this is my code in Node

const samlRequestEncoded = encodeURIComponent(Buffer.from(zlib.deflateRawSync(result.samlAuthRequest.xml)).toString('base64'));
res.redirect(302, environment.SAML_IDENTITY_PROVIDER_SSO_URL + '?SAMLRequest=' + samlRequestEncoded);

where result.samlAuthRequest.xml is the XML i just post above

amdonov commented 5 years ago

I'm afraid there is a good bit more to it than that. You're probably going to what to use a library to create the request if you're not familiar with the SAML spec. If you'd like to write your own and are comfortable reading golang, you can checkout out https://github.com/amdonov/lite-idp/blob/master/sp/redirect.go to see how I construct a valid request.

j-ramirez-bi4group commented 5 years ago

Ok, I will take a look at it, thank you, i will let you know if I make some progress