search

getsentry / sentry-auth-saml2

SAML2 SSO provider for Sentry
Apache License 2.0
19 stars 19 forks source link

SAML SSO Fails for certain types of Azure AD USers #38

Open TheMacStack opened 5 years ago

TheMacStack commented 5 years ago

Hello

We have Sentry deployed in Docker and SSO configured using the Generic SAML2 plugin and an Enterprise Application in Azure AD.

It works perfectly for Local AAD Users but for B2B accounts in Azure AD it fails.

After discussing with MS they are claiming that the value classes:PasswordProtectedTransport

in the SAML Request is not supported on their side and causes inconsistent behavior and we should have it changed to classes:Password unless there is some specific use case for classes:PasswordProtectedTransport.

extract from SAML request

    <samlp:RequestedAuthnContext Comparison="exact">

        <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>

    </samlp:RequestedAuthnContext>

I understand you may be hesitant to make such a change due to how it may effect the many other users but can you maybe provide some guidance on how we can make that change if we were to fork and maintain a fork of this project?

I did have a dig through the source code but I am not very familiar with SAML so was not able to find anything that seemed relevant.

thanks

evanpurkhiser commented 5 years ago

I recently made a similar change, which may help: https://github.com/getsentry/sentry/pull/12875

TheMacStack commented 5 years ago

Thanks @EvanPurkhiser that does help.

Would it make sense to add classes:Password to that same list? I dont understand how it is iterated through or which is selected etc so that may be nonsense.

eg:

        'requestedAuthnContext': [
            'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport',
            'urn:oasis:names:tc:SAML:2.0:ac:classes:Password',
            'urn:federation:authentication:windows',
        ],
jeffersonluismartins commented 5 years ago

I need to configure the SAML (Generic Saml2 plugin of this repository), however, I'm not finding the URLs, SLS, ACS and Metadata. Could you help me, please?

evanpurkhiser commented 5 years ago

Hi @jeffersonluismartins: Please see https://docs.sentry.io/accounts/sso/#saml2-identity-provider

Also please remember that GitHub issues are not a place for support, but rather the Sentry Forums are

jeffersonluismartins commented 5 years ago

No problem, @EvanPurkhiser. I read the document and installed the plugin getsentry/sentry-auth-saml2, but everytime that I try to get the url ACS, SLS and metadata (as specified in the document), the console returns to the homepage (https://mydnssentry.com/organization). I'll open the ticket on the Forum's Sentry, anyway. Thank you so much!