search

clegaspi / saml_reader

A tool to parse and verify SAML response data for MongoDB Cloud.
MIT License
7 stars 2 forks source link

remove or bypass attribute audience validation for Ops Manager #92

Open pmazeris opened 6 months ago

pmazeris commented 6 months ago

Same as https://github.com/clegaspi/saml_reader/issues/91

this time Ops Manager Audience URIs do not pass attribute audience validation

Can it be bypassed/removed as well?

Thanks!

example analyze output

SAML READER
----------------------
Parsing SAML data...
Done
------------
-----MONGODB CLOUD VERIFICATION-----

The Audience URL does not match the anticipated pattern.
Audience URL: https://om-443-elb-1873156365.us-east-2.elb.amazonaws.com
------

The Assertion Consumer Service URL does not match the anticipated pattern.
ACS URL: https://om-443-elb-1873156365.us-east-2.elb.amazonaws.com/saml/assert
------

-----SAML SUMMARY-----
IDENTITY PROVIDER (from certificate):
Okta
---
SIGNING CERTIFICATE EXPIRATION DATE (MM/DD/YYYY):
05/28/2034
---
ASSERTION CONSUMER SERVICE URL:
https://om-443-elb-1873156365.us-east-2.elb.amazonaws.com/saml/assert
---
AUDIENCE URL:
https://om-443-elb-1873156365.us-east-2.elb.amazonaws.com
---
ISSUER URI:
http://www.okta.com/exkeow00pdOUYrRxi697
---
ENCRYPTION ALGORITHM:
SHA256
---
NAME ID:
Value: patmaz@edenishere.us
Format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
---
ATTRIBUTES:
Name: firstName
Is Duplicated: No
Value: pat
--
Name: lastName
Is Duplicated: No
Value: maz
--
Name: email
Is Duplicated: No
Value: patmaz@edenishere.us
--
Name: memberOf
Is Duplicated: No
Values:
- Everyone
- org-owners
- poweruser
--