Hi Christian,
Thanks, please do, no last minute changes from my side.
On Thu., Jul. 11, 2019, 06:27 Christian Ehrhardt , < <email address hidden>> wrote:
> Hi, > I reviewed the MPs and they are (aside some potential polishing of the > changelog) ok to me. > You'll need an SRU template for these to be kicked off later on. > Thanks for driving the change upstream, that will help to one day be able > to drop the Delta. > > IMHO Eoan one could sponsor right away, please let me know if you want > me to do so now or if there are any last minute changes. > > -- > You received this bug notification because you are subscribed to the bug > report. > https://bugs.launchpad.net/bugs/1833299 > > Title: > lasso includes "Destination" attribute in SAML AuthnRequest populated > with SP AssertionConsumerServiceURL when ECP workflow is used which > leads to IdP-side errors > > Status in lasso package in Ubuntu: > Confirmed > > Bug description: > See comments on the bug: > https://bugs.launchpad.net/charm-keystone-saml-mellon/+bug/1833134 > > Lasso is used by libapache2-mod-auth-mellon to create SAML messages. > When ECP profile (http://docs.oasis-open.org/security/saml/Post2.0 > /saml-ecp/v2.0/cs01/saml-ecp-v2.0-cs01.pdf) is used it populates an > AuthnRequest with the "Destination" attribute as follows: > > <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" > xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" > ID="_798F26F73776E684A463559CDB77D080" Version="2.0" > IssueInstant="2019-06-18T16:54:25Z" Destination=" > https://keystone.maas:5000/v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth/mellon/paosResponse" > Consent="urn:oasis:names:tc:SAML:2.0:consent:current-implicit" SignType="0" > SignMethod="0" ForceAuthn="false" IsPassive="false" > AssertionConsumerServiceURL=" > https://keystone.maas:5000/v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth/mellon/paosResponse > "> > <saml:Issuer> > https://keystone.maas:5000/v3/OS-FEDERATION/identity_providers/samltestid/protocols/saml2/auth > </saml:Issuer> > <Signature xmlns="http://www.w3.org/2000/09/xmldsig#"> > > This triggers the Destination attribute validation logic relevant for > "HTTP Redirect" and "HTTP POST" bindings only (per the spec, sections > 3.4.5.2 and 3.5.5.2), not SOAP or PAOS bindings (sections before 3.4). > http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf > > For example, Shibboleth IdP (samltest.id) errors out as follows as the > Destination attribute was populated with an SP URL: > > 2019-06-18 16:54:25,435 - ERROR > > [org.opensaml.saml.common.binding.security.impl.ReceivedEndpointSecurityHandler:?] > - Message Handler: SAML message intended destination endpoint > 'https://keystone.maas:5000/v3/OS- > > FEDERATION/identity_providers/samltestid/protocols/saml2/auth/mellon/paosResponse' > did not match the recipient endpoint > 'https://samltest.id/idp/profile/SAML2/SOAP/ECP' > > For ECP it makes sense to avoid inclusion of the "Destination" > attribute to AuthnRequest (see https://bugs.launchpad.net/charm- > keystone-saml-mellon/+bug/1833134/comments/3). > > The attached patch is merely an illustration that not using Destination > with ECP results in a successful authentication: > > https://bugs.launchpad.net/charm-keystone-saml-mellon/+bug/1833134/comments/2 > > To manage notifications about this bug go to: > https://bugs.launchpad.net/ubuntu/+source/lasso/+bug/1833299/+subscriptions >
Hi Christian,
Thanks, please do, no last minute changes from my side.
On Thu., Jul. 11, 2019, 06:27 Christian Ehrhardt , <
<email address hidden>> wrote:
> Hi, /bugs.launchpad .net/bugs/ 1833299 erServiceURL when ECP workflow is used which /bugs.launchpad .net/charm- keystone- saml-mellon/ +bug/1833134 mod-auth- mellon to create SAML messages. docs.oasis- open.org/ security/ saml/Post2. 0 v2.0/cs01/ saml-ecp- v2.0-cs01. pdf) is used it populates an "urn:oasis: names:tc: SAML:2. 0:protocol" "urn:oasis: names:tc: SAML:2. 0:assertion" 76E684A463559CD B77D080" Version="2.0" "2019-06- 18T16:54: 25Z" Destination=" /keystone. maas:5000/ v3/OS-FEDERATIO N/identity_ providers/ samltestid/ protocols/ saml2/auth/ mellon/ paosResponse" "urn:oasis: names:tc: SAML:2. 0:consent: current- implicit" SignType="0" erServiceURL= " /keystone. maas:5000/ v3/OS-FEDERATIO N/identity_ providers/ samltestid/ protocols/ saml2/auth/ mellon/ paosResponse /keystone. maas:5000/ v3/OS-FEDERATIO N/identity_ providers/ samltestid/ protocols/ saml2/auth www.w3. org/2000/ 09/xmldsig#"> docs.oasis- open.org/ security/ saml/v2. 0/saml- bindings- 2.0-os. pdf saml.common. binding. security. impl.ReceivedEn dpointSecurityH andler: ?] /keystone. maas:5000/ v3/OS- identity_ providers/ samltestid/ protocols/ saml2/auth/ mellon/ paosResponse' /samltest. id/idp/ profile/ SAML2/SOAP/ ECP' /bugs.launchpad .net/charm- saml-mellon/ +bug/1833134/ comments/ 3). /bugs.launchpad .net/charm- keystone- saml-mellon/ +bug/1833134/ comments/ 2 /bugs.launchpad .net/ubuntu/ +source/ lasso/+ bug/1833299/ +subscriptions
> I reviewed the MPs and they are (aside some potential polishing of the
> changelog) ok to me.
> You'll need an SRU template for these to be kicked off later on.
> Thanks for driving the change upstream, that will help to one day be able
> to drop the Delta.
>
> IMHO Eoan one could sponsor right away, please let me know if you want
> me to do so now or if there are any last minute changes.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https:/
>
> Title:
> lasso includes "Destination" attribute in SAML AuthnRequest populated
> with SP AssertionConsum
> leads to IdP-side errors
>
> Status in lasso package in Ubuntu:
> Confirmed
>
> Bug description:
> See comments on the bug:
> https:/
>
> Lasso is used by libapache2-
> When ECP profile (http://
> /saml-ecp/
> AuthnRequest with the "Destination" attribute as follows:
>
> <samlp:AuthnRequest xmlns:samlp=
> xmlns:saml=
> ID="_798F26F737
> IssueInstant=
> https:/
> Consent=
> SignMethod="0" ForceAuthn="false" IsPassive="false"
> AssertionConsum
> https:/
> ">
> <saml:Issuer>
> https:/
> </saml:Issuer>
> <Signature xmlns="http://
>
> This triggers the Destination attribute validation logic relevant for
> "HTTP Redirect" and "HTTP POST" bindings only (per the spec, sections
> 3.4.5.2 and 3.5.5.2), not SOAP or PAOS bindings (sections before 3.4).
> http://
>
> For example, Shibboleth IdP (samltest.id) errors out as follows as the
> Destination attribute was populated with an SP URL:
>
> 2019-06-18 16:54:25,435 - ERROR
>
> [org.opensaml.
> - Message Handler: SAML message intended destination endpoint
> 'https:/
>
> FEDERATION/
> did not match the recipient endpoint
> 'https:/
>
> For ECP it makes sense to avoid inclusion of the "Destination"
> attribute to AuthnRequest (see https:/
> keystone-
>
> The attached patch is merely an illustration that not using Destination
> with ECP results in a successful authentication:
>
> https:/
>
> To manage notifications about this bug go to:
> https:/
>