search

italia / spid-idp-proxy-shibboleth

Shibboleth IDP con possibilità di delegare l'autenticazione ad un IDP SPID.
Creative Commons Zero v1.0 Universal
12 stars 1 forks source link

AuthnRequest #2

Open ruda76 opened 2 years ago

ruda76 commented 2 years ago

Salve, ho seguito la documentazione per la configurazione, sono riuscito a fare tutto il giro fino all'invocazione dell'idp demo. Il problema è nel messaggio AuthnRequest, risultano i seguenti errori:

{ test_id: '', result: 'failure', test: 'The Destination attribute SHOULD be the address to which the request has been sent but can also be the EntityID of IdP (Av. SPID n.11)', value: 'https://localhost:8443/demo/samlsso', references: [], method: '' } { test_id: '', result: 'failure', test: 'The Format attribute MUST be present', value: '{}', references: [], method: '' } { test_id: '', result: 'failure', test: 'The Format attribute MUST have a value', value: 'None', references: [], method: '' } { test_id: '', result: 'failure', test: 'The Format attribute MUST be urn:oasis:names:tc:SAML:2.0:nameid-format:entity', value: 'None', references: [], method: '' } { test_id: '', result: 'failure', test: 'The NameQualifier attribute MUST be present', value: '{}', references: [], method: '' } { test_id: '', result: 'failure', test: 'The NameQualifier attribute MUST have a value', value: 'None', references: [], method: '' } { test_id: '', result: 'failure', test: 'The ForceAuthn attribute MUST be present if SPID level > 1', value: "['https://www.spid.gov.it/SpidL2']", references: [], method: '' } { test_id: '', result: 'failure', test: 'The AttributeConsumingServiceIndex attribute MUST be present', value: "{'AssertionConsumerServiceURL': 'https://spid.xxx.it/Shibboleth.sso/SAML2/POST', 'Destination': 'https://localhost:8443/demo/samlsso', 'ID': '_be906f743edc7a55943f27f90f87f5f7', 'IssueInstant': '2021-11-06T15:07:26Z', 'ProtocolBinding': 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST', 'Version': '2.0'}", references: [], method: '' } { test_id: '', result: 'failure', test: 'The AllowCreate attribute MUST not be present', value: 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient', references: [], method: '' }

Ho configurato shibboleth SP come indicato nella documentazione all'indirizzo https://github.com/italia/spid-sp-shibboleth, questo comportamento differente può dipendere dalla versione utilizzata?

shibboleth-embedded-ds-1.2.2-3.1.noarch shibboleth-3.2.3-3.1.x86_64

Grazie dell'aiuto

robertogallea commented 2 years ago

Salve, poichè la parte SP non è trattata su questo repo, sarebbe più corretto sottometterla a https://github.com/italia/spid-sp-shibboleth. Ad ogni modo, la versione, in questo caso, non è influente. Sarebbe utile vedere il file shibboleth2.xml

ruda76 commented 2 years ago

Buongiorno Roberto, grazie per la risposta. Riporto qui di seguito il file shibboleth2.xml, se ritieni che sia meglio aprire una issue per nell'altro repository fammi sapere.

<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config" xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="180">

<OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />

<!--
By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
are used. See example-shibboleth2.xml for samples of explicitly configuring them.
-->

<!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
<ApplicationDefaults entityID="https://spid.xxxx.it/shibboleth"
    REMOTE_USER="eppn subject-id pairwise-id persistent-id"
    cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1" signing="true" encryption="true">

    <!--
    Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
    Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
    and should be a relative path, with the SP computing the full value based on the virtual
    host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
    restrictions. Note that while we default checkAddress to "false", this makes an assertion
    stolen in transit easier for attackers to misuse.
    -->
   <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
              checkAddress="false" handlerSSL="true" cookieProps="https"
              redirectLimit="exact">

        <!--
        Configures SSO for a default IdP. To properly allow for >1 IdP, remove
        entityID property and adjust discoveryURL to point to discovery service.
        You can also override entityID on /Login query string, or in RequestMap/htaccess.
        -->
        <!--SSO discoveryProtocol="SAMLDS"
             discoveryURL="https://spid.xxxx.it/shibboleth-ds/index.html">
          SAML2
        </SSO-->

 <SessionInitiator type="Chaining"
            Location="/Login"
            isDefault="true"
            outgoingBinding="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
            isPassive="false"
            signing="true">
        <SessionInitiator type="SAML2" acsIndex="0" acsByIndex="true">
            <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="SPID" Version="2.0" IssueInstant="2021-01-01T00:00:00Z"
                AttributeConsumingServiceIndex="0" ForceAuthn="true">
                <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" NameQualifier="https://spid.xxxx.it/shibboleth">https://spid.xxxx.it/shibboleth</saml:Issuer>
                <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
            </samlp:AuthnRequest>
        </SessionInitiator>
        <SessionInitiator type="SAMLDS" URL="https://spid.xxxx.it/shibboleth-ds/index.html"/>
    </SessionInitiator>

        <!-- SAML and local-only logout. -->
        <!--Logout>SAML2 Local</Logout-->

        <!-- Administrative logout. -->
        <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />

        <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
        <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

        <!-- Status reporting service. -->
        <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

        <!-- Session diagnostic service. -->
        <Handler type="Session" Location="/Session" showAttributeValues="false"/>

        <!-- JSON feed of discovery information. -->
        <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
    </Sessions>

    <!--
    Allows overriding of error template information/filenames. You can
    also add your own attributes with values that can be plugged into the
    templates, e.g., helpLocation below.
    -->
    <Errors supportContact="root@localhost"
        helpLocation="/about.html"
        styleSheet="/shibboleth-sp/main.css"/>

    <!-- Example of locally maintained metadata. -->
    <MetadataProvider type="XML" validate="true" path="metadata.xml" legacyOrgNames="true"/>

    <!-- Example of remotely supplied batch of signed metadata. -->
    <!--
    <MetadataProvider type="XML" validate="true"
                url="http://federation.org/federation-metadata.xml"
          backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
        <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
        <MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
        <DiscoveryFilter type="Blacklist" matcher="EntityAttributes" trimTags="true"
          attributeName="http://macedir.org/entity-category"
          attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
          attributeValue="http://refeds.org/category/hide-from-discovery" />
    </MetadataProvider>
    -->

    <!-- Example of remotely supplied "on-demand" signed metadata. -->
    <!--
    <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
                baseUrl="http://mdq.federation.org" ignoreTransport="true">
        <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
        <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
    </MetadataProvider>
    -->

    <!-- Map to extract attributes from SAML assertions. -->
    <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

    <!-- Default filtering policy for recognized attributes, lets other data pass. -->
    <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

    <!-- Simple file-based resolvers for separate signing/encryption keys. -->
    <CredentialResolver type="File" use="signing"
        key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
    <CredentialResolver type="File" use="encryption"
        key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>

</ApplicationDefaults>

<!-- Policies that determine how to process and authenticate runtime messages. -->
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

<!-- Low-level configuration about protocols and bindings available for use. -->
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

ruda76 commented 2 years ago

Ciao Roberto, la configurazione che non funziona è proprio il giro del DS, puoi aiutarmi?

Grazie