Okta SLO

[mjcloutier]

I was able to get SSO working with Okta, but having an issue with Single Logout, always returning 403 Authn Failure "Invalid Signature".

Saml Trace

GET

<?xml version="1.0"?>
<samlp:LogoutRequest
    Destination="https://dev-455970.oktapreview.com/app/heimdall_heimdall_3/exkga21ozaP0T2pcG0h7/slo/saml"
    ID="id153704109584333124814146" IssueInstant="2018-09-15T19:52:28Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Reason="urn:oasis:names:tc:SAML:2.0:logout:user" Version="2.0"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#id153704109584333124814146">
                <ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <ds:DigestValue>4tDSZaOzXbmXi3BCqaiYC2WY5V1wLyPuh5xmAdJK6mg=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>GPYcJ7VSenb/P43/bUYi/8dtLTVlGkHT88l7xB+Eea+zY2bOiUraPTqtbWavDvb0yd6qwdwWCDypNLS3CA/Z1d2LWriv9c23S002PjhxubnbFn0MolcDVWpY/kGnN2h6PJOJLXjHSFbnYAFvPejflHTGur11YJtg7lqrZJ2shxZoER2W1/uS2tj/iVhPIf+OyqHjAkOt2KfYlWDoIemiOwvMmz6uu84sp1wEvfYi8tW42GHHHgJFdSL9k9JdOhlDH0MlhUWF6rzm2DIfZJyRZMg5kgzQiRLAYs1ygGC6NkO2g5IQckWrej0KxyEBaXebwMD0w94xKp3iDivwl/mfudhRNCtIyMThtZw7qfT/PzuSH125MdY0krhWvZCXAZ1DR1fBhzw6/RoZFk/Eq7+iBV+GrRAcgBLv7BOaDUXGuFJIIp1g3TfYtxLRJuiC0rRMV8gEiKXiH0Rm9Wh8jw+pn8A/8/KMRVrcndpzQsla3MJ1BN7HRE5TzsL18SlAS2hMhb+Pj6JNBF6KSoEWZivqGfbwrspjzAg1Xx/ZCrBu7HkrF/+9bt+W9xAuQ6JzNHJFZxg9lufvQYBhvJOfQ3ea0wUCRsHkrb5eEDtndeQ4wPf+g9ncW62zDooQDXyYw0OMHY4IE3iNy8JJt+Up+IUB64tRDYbg6VVxM0Uu6nMSS9g=</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAWXOODnmMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTU5NzAxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTgwOTEyMTQzNzM2WhcNMjgwOTEyMTQzODM1WjCBkjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU1OTcwMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlveqreKkBgHRsCbxLCYAyEWydeqzbzNZ9MWElnE89n/Ums2CpWBh9b9lFZlJXr1eb+07E3jKROZQuzPV8z6Ds2G7jDv92apXJ1so2SZ7DVdE4kC8Z11ujbMW+F3WWeGK+vASdGYkIbcpXdgy42Whi7MWqw8vwFIC4rxJ7HffwSpQvc87+tICDO2jn/iVupoqTQhjyKg0iuJV4vli5D7ne7n0E5sn3AE0R3hLn+88Ufm7MZD8AXVEdna8t8/kqGYVrol7yLYlOPp8u+pNd0bkAQ3lBRJb6f/kch8ommlywzv7lZA9+d02xaHd0G2x/KJt6xqVHTBazK5fdbCKgV7fXQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBvb5Raz1XYOSVV7scdOwSzhf0r0GOBl9V2YNmLD8gCID5VknJHBD+riI8vHu2UkIh39s2c+4LISTQ9Gu0KCcI2LU8nXz9Xy3oGMEgYEUz7ZwmcZGU/bMIANjfdyhJ1kURMG0vQcjNMVpAvqna+mb1idFTwjK7ArEgaOxh/XoCNIZ9t1tkZh69DX09nUYTn1G3RIbyGGZ/7GY2dfSJubuhZnvK528QaowvRG/zGHYbwUdwgbJIMTX2eR1jHKTi3L5xM/hED/fPkbF880fheumiR9AAS3OB71DdiUM3LMc8iaZkTd7PTXvfw7TeSM9rf62Caimx0DhBjJhsuI6PyXxC4</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml:Issuer>heimdall</saml:Issuer>
    <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">michael.cloutier@experian.com</saml:NameID>
    <samlp:SessionIndex>id153704105052115878813602</samlp:SessionIndex>
</samlp:LogoutRequest>

POST https://localhost:4443/sso/sp/logout/okta_heimdall

<?xml version="1.0" encoding="UTF-8"?>
<saml2p:LogoutResponse Destination="https://localhost:4443/sso/sp/logout/okta_heimdall"
    ID="id7678592447510182044070111" InResponseTo="id153704109584333124814146"
    IssueInstant="2018-09-15T19:52:31.109Z" Version="2.0"
    xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"
        xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exkga21ozaP0T2pcG0h7</saml2:Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        <ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
            <ds:Reference URI="#id7678592447510182044070111">
                <ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                <ds:DigestValue>283rIuOaM+hL31Nl+hVcevNirAseiSClDjwpVCWAXtQ=</ds:DigestValue>
            </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>ebcTux5oIGBdJdOiPsrTN9i3W2MZ9PO4HSJQANdXG7ofa3EvcYwwfXzMsqNTrvPOikAYZnKbqgJofmxBMbsD04XmmyxYtrjnop3jW45hHsEMVp44rC2I9PFt0Y+zUh2ua77wjN3c5ozXR2vKzGWZkmpK3TGvpbsMsO1ODCf5DwogheCYwInpoO+gA69xhzgedN0wDU3PPSOhRcROLuhAJUxD8F5nPFQh3sB7ohbgi1mgAjmLjG0M6ogDP2pcN1rdQH/esPFKYwUh8rffL62KGtCgVbSQ53N6cUeCi8iWUfL5o0DHUP8SKVbc1wUhjk/+mK+geh2NCooHgWus6j1HEQ==</ds:SignatureValue>
        <ds:KeyInfo>
            <ds:X509Data>
                <ds:X509Certificate>MIIDpDCCAoygAwIBAgIGAWXOODnmMA0GCSqGSIb3DQEBCwUAMIGSMQswCQYDVQQGEwJVUzETMBEG
                    A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
                    MBIGA1UECwwLU1NPUHJvdmlkZXIxEzARBgNVBAMMCmRldi00NTU5NzAxHDAaBgkqhkiG9w0BCQEW
                    DWluZm9Ab2t0YS5jb20wHhcNMTgwOTEyMTQzNzM2WhcNMjgwOTEyMTQzODM1WjCBkjELMAkGA1UE
                    BhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNV
                    BAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRMwEQYDVQQDDApkZXYtNDU1OTcwMRwwGgYJ
                    KoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
                    lveqreKkBgHRsCbxLCYAyEWydeqzbzNZ9MWElnE89n/Ums2CpWBh9b9lFZlJXr1eb+07E3jKROZQ
                    uzPV8z6Ds2G7jDv92apXJ1so2SZ7DVdE4kC8Z11ujbMW+F3WWeGK+vASdGYkIbcpXdgy42Whi7MW
                    qw8vwFIC4rxJ7HffwSpQvc87+tICDO2jn/iVupoqTQhjyKg0iuJV4vli5D7ne7n0E5sn3AE0R3hL
                    n+88Ufm7MZD8AXVEdna8t8/kqGYVrol7yLYlOPp8u+pNd0bkAQ3lBRJb6f/kch8ommlywzv7lZA9
                    +d02xaHd0G2x/KJt6xqVHTBazK5fdbCKgV7fXQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQBvb5Ra
                    z1XYOSVV7scdOwSzhf0r0GOBl9V2YNmLD8gCID5VknJHBD+riI8vHu2UkIh39s2c+4LISTQ9Gu0K
                    CcI2LU8nXz9Xy3oGMEgYEUz7ZwmcZGU/bMIANjfdyhJ1kURMG0vQcjNMVpAvqna+mb1idFTwjK7A
                    rEgaOxh/XoCNIZ9t1tkZh69DX09nUYTn1G3RIbyGGZ/7GY2dfSJubuhZnvK528QaowvRG/zGHYbw
                    UdwgbJIMTX2eR1jHKTi3L5xM/hED/fPkbF880fheumiR9AAS3OB71DdiUM3LMc8iaZkTd7PTXvfw
                    7TeSM9rf62Caimx0DhBjJhsuI6PyXxC4</ds:X509Certificate>
            </ds:X509Data>
        </ds:KeyInfo>
    </ds:Signature>
    <saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></saml2p:Status>
</saml2p:LogoutResponse>

[handnot2]

The SAML LogoutResponse shows AuthnFailed. What is the error in the Okta IdP logs for this logout request?

The SP initiated SLO is signed based on your LogoutRequest. Is Okta IdP configured to accept signed requests?

Are you using the latest versions of samly and esaml?

[mjcloutier]

Okta IDP: LegacyEventType: app.auth.slo.saml.invalid_signature Reason Invalid Signature

Samly Config:

config :samly, Samly.Provider,
  idp_id_from: :path_segment,
  service_providers: [
    %{
      id: "heimdall",
      entity_id: "heimdall",
      certfile: "priv/keys/heimdall.crt",
      keyfile: "priv/keys/heimdall.pem",
    },
  ],
  identity_providers: [
    %{
      id: "okta_heimdall",
      sp_id: "heimdall",
      base_url: "https://localhost:4443/sso",
      metadata_file: "idp_metadata.xml",
      pre_session_create_pipeline: HeimdallWeb.Plugs.SamlyPipeline,
      use_redirect_for_req: true,
      allow_idp_initiated_flow: true
    }
  ]

[handnot2]

Was the .crt certificate file uploaded to Okta? If it was not exported signature verification will fail. I am assuming the SSO login request went through without issues. If the certificate was not uploaded it should have failed as well.

Can you also confirm if you are using the latest samly and esaml versions?

[mjcloutier]

I tweaked the ./gencert from the samly_howto to produce a cert for localhost creds and uploaded the heimdall.crt to okta SLO field.

"esaml": {:hex, :esaml, "3.5.0", "313b4b98c7eb4720a6c6659b11b16ddb8726d9a1fdeba43bb6d9fdfe9e14e691", [:rebar3], [{:cowboy, "1.1.2", [hex: :cowboy, repo: "hexpm", optional: false]}], "hexpm"},

"samly": {:hex, :samly, "0.9.2", "9dc318cd257b3853539c8456f8977eb2152de57126acd8bd2d037d4cf5633413", [:mix], [{:esaml, "~> 3.4", [hex: :esaml, repo: "hexpm", optional: false]}, {:plug, "~> 1.4", [hex: :plug, repo: "hexpm", optional: false]}, {:sweet_xml, "~> 0.6", [hex: :sweet_xml, repo: "hexpm", optional: false]}], "hexpm"},

[handnot2]

Can you use this tool to validate the request - use the XML dump of your LogoutRequest.

https://www.samltool.com/validate_logout_req.php

[mjcloutier]

For some reason keep getting:

Invalid SAML Logout Request. Not match the saml-schema-protocol-2.0.xsd

[handnot2]

Did you mean "was able to validate the logout request"?

[mjcloutier]

When I paste in the above LogoutRequest it tells me Invalid SAML

[mjcloutier]

Using the Validate XML with XSD Schema I am unable to validate the Authentication Request from Samly app, or the LogoutRequest, but I am able to validate the SAML Response from the Authentication Request.

[mjcloutier]

Here is the LogoutRequest:

Line: 8 | Column: 0  --> Element '{urn:oasis:names:tc:SAML:2.0:protocol}LogoutRequest', attribute 'ProtocolBinding': The attribute 'ProtocolBinding' is not allowed.

Line: 23 | Column: 0  --> Element '{urn:oasis:names:tc:SAML:2.0:assertion}Issuer': This element is not expected. Expected is one of ( {urn:oasis:names:tc:SAML:2.0:protocol}Extensions, {urn:oasis:names:tc:SAML:2.0:assertion}BaseID, {urn:oasis:names:tc:SAML:2.0:assertion}NameID, {urn:oasis:names:tc:SAML:2.0:assertion}EncryptedID ).

[mjcloutier]

If I remove those two lines from the Request, it validates.

[handnot2]

OK. I need to look into this. Will get back to you. Thanks.

[handnot2]

Can you please open this LogoutRequest schema validation error as an issue in the esaml repo?

https://github.com/handnot2/esaml

Thanks.

[mjcloutier]

Sure thing, thanks for taking a look at this!

[mjcloutier]

https://github.com/handnot2/esaml/issues/8

[handnot2]

Are you planning on IdP initiated logout as well? If so, it would be good to check if the Schema validation is present there as well.

[mjcloutier]

When I use the config flag allow_idp_initiated_flow: true It currently automatically logs into the app successfully from Okta.

It is strange that the AuthenRequest is invalid but that it works currently and sends a response back from Okta to sign me in. It only has one error line which is the Issuer: The LogoutRequest has both Issuer: and ProtocolBinding:

[mjcloutier]

My apologies I didn't read your comment correct: IdP initiated logout. I will check.

[handnot2]

Schema validation fixes for LogoutRequest and LogoutResponse are done in esaml v3.6.0. A new version of samly v0.9.3 is released that uptakes the esaml fix. Please try it out. The schema validation error might not be the root cause of your issue. I am updating this issue as the validation problem was uncovered as part of this thread. Uptake this version and try it out if this fix makes any difference.

[mjcloutier]

I tested with the new version and the Authn, LogoutRequest and LoginRequest are producing proper schema validation now. I am still having an issue with Invalid Signature which might be an issue on my end with configuration. When I find a solution to the Okta LogoutRequest I will post a wiki example for Okta for Login and Logout using samly. Thanks much for looking into the issue.

[handnot2]

I would like to close this if the root cause turns out to be a configuration issue. Would appreciate an update on this. Thanks.