Hi,
I am attempting to set up a SAML environment to better understand how
Satosa works. Here is the model of my environment: SAML Service Provider
(SP, pysaml2) <-> Satosa Proxy <-> SAML Identity Provider (IdP, pysaml2).
During the single sign-on service, after entering the username and
password, when the SAML IdP posts the AssertionConsumerService to the
Satosa Proxy, an error(satosa log attached) occurs:
'saml2.sigver.SignatureError.', the following is my satosa proxy logs:
https://pastebin.com/YsRMVzKD
I am unsure about how to resolve this issue. Could anyone provide me with
some guidance?
Any help would be greatly appreciated.
Thanks,
Sam
Dear Friends,
more than a year passed from TNC22 at Trieste, an event during which we are
supposed to create basic components for issuing and verifying verifiable
credentials in both sd-jwt and mdoc cbor format (ISO 18013-5).
While sd-jwt was produced by Daniel Fett in parallel with writing the
draft, and written in python, for mdoc cbor we had nothing more than a
monolithic demo produced by Google and written in Java.
I confess to having meanly waited for someone to do something, sooner or
later. After a year I gathered my pieces and produced this
https://github.com/peppelinux/pyMDOC-CBOR
0.6.0 will be the first official release and I hereby express my
willingness to migrate this new library to identity python.
The Interop tests are going to be made in the GAIN-PoC WG with colleagues
of Authelete that produced something similar but in Java, and with any
other available participant.
Look forward for your kind answer,
best
--
____________________
Giuseppe De Marco
Centro ICT d'Ateneo
Università della Calabria
87036 Rende (CS) - Italy
Phone: +39 0984 496961
e-mail: giuseppe.demarco(a)unical.it
--
------------------------------------------------------------------------------------------------------------------
Il banner è generato automaticamente dal servizio di posta elettronica
dell'Università della Calabria
<https://www.unical.it/5x1000>
Hello all!
In case you still have calendar entries for idpy calls on the 23rd of May or 6th of June, please note those calls are canceled. Our next call is currently scheduled for 20 June 2023.
See you then!
Thanks! Heather
Attendees:
Alex Perez, Giuseppe, Heather, Ivan, Matthew
Regrets:
Roland, Scott
Notes
0 - Agenda bash
Introductions: Alexandro Perez-Mendez (JISC), working with Alex Stuart and Phil Smith
1 - Project review
a. General
Big things Ivan is looking at: making a plan to convert Satosa to use a framework (flask, fastAPI, etc); figuring out better logging and introducing parts of OpenTelemetry (https://opentelemetry.io/) into the code to help add traces and possibly switching to structured logging.
Hannah has a draft PR about logout support on Satosa. For that, we need to keep some state, and this PR offers an opportunity to consider that again.
• Do we have documentation on the schema for session storage? Session storage is a python dictionary that is not validated. A basic schema would help organize this and our migration to a new framework. Different pieces (microservices) need to have access to the same part of the state, which makes the keys and cleaning up the state more complicated. This would have to be resolved on the plugins.
• Can we rename "microservice" to "plugin"?
Any move towards supporting the wallet framework as per eIDAS 2 and the European Digital Identity Wallet Architecture and Reference Framework (https://digital-strategy.ec.europa.eu/en/library/european-digital-identity-… The ARF specifies two flows - the remote flow using OIDC and the proximate flow where RFIDs will be used. Can Satosa work with those things? The plan is to support the OIDC flows and look later at the other flows. The relevant OIDC specifications are still in draft. The Verifiable Credentials are part of what make this complicated; we need to pick a credential profile and make sure we can support that, then consider how they are signed, whether they can support selective disclosure, etc. There will be dedicated calls for this, organized by Ivan.
b. OIDC - https://github.com/IdentityPython (JWTConnect-Python-OidcRP, JWTConnect-Python-CryptoJWT, etc)
No updates
c. Satosa - https://github.com/IdentityPython/SATOSA
Looking at the following:
• https://github.com/IdentityPython/SATOSA/pull/429
• https://github.com/IdentityPython/SATOSA/pull/433
• https://github.com/IdentityPython/SATOSA/pull/427
• https://github.com/IdentityPython/SATOSA/pull/405
Expect a new release in the next week or so.
d. pySAML2 - https://github.com/IdentityPython/pysaml2
Ivan working on a fix for a Windows issue (see https://github.com/IdentityPython/pysaml2/pull/665 for a description; that PR isn't going in, but it does describe the problem). When this is ready, he will cut a new release.
Also working on https://github.com/IdentityPython/pysaml2/pull/898 ; this will also go into the new release.
e. Any other project (pyFF, djangosaml2, etc)
pyFF - Leif is preparing a new release. There have been fixes and merges, so a new release is due. Matthew is working on a docker image (as well as a thiss.js container that would use a simple HTML template to implement a centralized discovery service). Alex and JISC is interested in this work. They have a small docker compose script available that is close to working.
• https://github.com/IdentityPython/pyFF/issues/243
Note there is a thiss.io slack channel. Can continue discussion there. Can also create a pyFF channel if that would be more helpful.
2 - AOB
Note: Admin task - Pavel, one of the contributors to the independent OIDC front end to Satosa, and his team have been invited to join the OIDC channel in Slack. Need to approve their participation.
Thanks! Heather
