Authorizing endpoints or domains against a Shibboleth IDP (two different set of keys for encrypt/signing)

greenpau / caddy-security

🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐

https://authcrunch.com/

Apache License 2.0

1.33k stars 69 forks source link

Authorizing endpoints or domains against a Shibboleth IDP (two different set of keys for encrypt/signing) #169

Open drio opened 1 year ago

drio commented 1 year ago

Disclaimer: I have posted this also here. I will make sure I link both once I get things working.

I have successfully added SAML authentication to an Apache server. The IdP I use implements SAML via Shibboleth. Now I want to migrate to Caddy. That’s how I discovered this plugin.

The plugin uses the crewjam/saml package. I have used that before successfully on a standalone golang server against the same IdP I want to use for my Caddy server.

There is one caveat though. The current Apache configuration uses two different set of keys for signing and encrypting.

My questions are:

Can I use this plugin to authorize my domains/endpoints against my SAML IdP?
Can I use the two separate set of keys to setup the SAML flow or I have to use the same keys for signing and encrypting?
When I started working with SAML and crewjam/saml I found this example very useful to get things going. What would be the Caddyfile to implement that with Caddy and the auth plugin? Maybe I can add it to the examples/docs.

Thank you, -drd

greenpau commented 1 year ago

@drio , please take a look at the following links. I am not sure what you mean by separate keys. Upon authentication via SAML IdP, the portal issues its own token and uses its own keys to authenticate access to some path.

https://authp.github.io/docs/authenticate/saml/jumpcloud

https://github.com/authp/authp.github.io/blob/main/assets/conf/saml/jumpcloud/Caddyfile

drio commented 1 year ago

Thank you for the reply @greenpau.

I am not sure what you mean by separate keys.

When I look at the metadata (xml file) that I use to configure my apache webserver, I see the following:

...
        <!-- Simple file-based resolvers for separate signing/encryption keys. -->
        <CredentialResolver type="File" use="signing" key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
        <CredentialResolver type="File" use="encryption" key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
...

My IDP handles the authentication, I just need my webserver to handle the authorization only (via interaction with the IDP). I guessing I only need the saml identity provider and the authorization policy mypolicy from the Caddyfile you posted.

billksun commented 7 months ago

@drio, I'm curious about the outcome, were you able to get Shibboleth working with Caddy in the end?

drio commented 7 months ago

@billksun I ended up bulding my own thing.