August 2021 - satosa-users - lists3.sunet.se

Different discovery service for different SPs

by xenophon＠irtnog.org

Dear all, Is it possible to use a different discovery service depending on the SP that sent a SAML AuthnRequest to SATOSA, or do I have to do that in the discovery service's frontend somehow? Best wishes, Matthew -- "The lyf so short, the craft so longe to lerne."

1 month, 3 weeks

3
3
0 0

SATOSA Quickstart

by xenophon＠irtnog.org

I want to again say "thanks" to Ioannis, Rainer, Scott, and everyone else for their help and instruction during the various IdentityPython and SATOSA meetings at TIIME this week. Chris Phillips and I were able to get a SATOSA 3.4.8 deployment working in Chris's idp-installer test bed. To that end I want to share my notes from the process, at the end of which an interested party could perform a basic, end-to-end test of the current SATOSA release using SAMLtest (https://samltest.id/) 1. I installed Ubuntu Server 18.04.1; run the following commands as root to install the prerequisites: ```sh apt update apt dist-upgrade -y apt install -y git python3-dev build-essential python3-pip libffi-dev libssl-dev xmlsec1 libyaml-dev libxml2-utils pip3 install --upgrade virtualenv virtualenv -p python3 /opt/satosa /opt/satosa/bin/pip install --upgrade pip setuptools /opt/satosa/bin/pip install SATOSA ``` This is essentially the Docker image build process, only it uses the current SATOSA release (etc.) on PyPI. 2. Copy https://github.com/IdentityPython/SATOSA/tree/v3.4.8/docker/attributemap s to /opt/satosa/attributemaps. I'm not sure this is strictly necessary as the built-in pysaml2 attribute maps should be used by default, but it's what the Docker image build process does. 3. Copy https://github.com/IdentityPython/SATOSA/tree/v3.4.8/example to /opt/satosa/etc. 4. SATOSA doesn't have a default configuration, so you must provide it yourself. ```sh cp /opt/satosa/etc/proxy_conf.yaml.example \ /opt/satosa/etc/proxy_conf.yaml cp /opt/satosa/etc/internal_attributes.yaml.example \ /opt/satosa/etc/internal_attributes.yaml cp /opt/satosa/etc/plugins/frontends/saml2_frontend.yaml.example \ /opt/satosa/etc/plugins/frontends/saml2_frontend.yaml cp /opt/satosa/etc/plugins/backends/saml2_backend.yaml.example \ /opt/satosa/etc/plugins/backends/saml2_backend.yaml cp /opt/satosa/etc/plugins/microservices/static_attributes.yaml.example \ /opt/satosa/etc/plugins/microservices/static_attributes.yaml ``` 5. You may change the proxy URL (the value of BASE in /opt/satosa/etc/proxy_conf.yaml), but it _must_ be a method plus hostname without any trailing slash or path components, e.g., `https://proxy.example.com`, not `https://proxy.example.com/` nor `https://proxy.example.com/satosa`. SATOSA must be hosted at the root of your web site. 6. Comment out the `idp_blacklist_file` and `disco_srv` settings in /opt/satosa/etc/plugins/backends/saml2_backend.yaml. 7. Generate IdP, SP, metadata signing, and web site keying material: ```sh for i in frontend backend metadata https; do openssl req -batch -x509 -nodes -days 3650 -newkey rsa:2048 \ -keyout /opt/satosa/etc/$i.key -out /opt/satosa/etc/$i.crt \ -subj /CN=proxy.example.com done ``` 8. Download the SAMLtest metadata. ```sh curl https://samltest.id/saml/sp > /opt/satosa/etc/sp.xml curl https://samltest.id/saml/idp > /opt/satosa/etc/idp.xml ``` 9. Generate the proxy metadata. (How you do this changes in future releases of SATOSA.) ```sh . /opt/satosa/bin/activate cd /opt/satosa/etc satosa-saml-metadata proxy_conf.yaml metadata.key metadata.crt --split-frontend --split-backend --dir /opt/satosa/etc xmllint --format /opt/satosa/etc/Saml2IDP_0.xml > /opt/satosa/etc/proxy-idp.xml xmllint --format /opt/satosa/etc/Saml2_0.xml > /opt/satosa/etc/proxy-sp.xml ``` 10. Edit the proxy metadata files to remove the `<ns1:Signature>` element, else SAMLtest will be unable to load them due to an invalid signature. 11. Upload the proxy metadata to SAMLtest (https://samltest.id/upload.php) 12. SAMLtest doesn't release the eduPerson Targeted ID attribute, so you'll need to change the last three lines of /opt/satosa/etc/internal_attributes.yaml to the following (and before anyone says anything, NEVER USE AN EMAIL ADDRESS AS AN IDENTIFIER---this is just a quick hack to get SATOSA working): ``` hash: [mail] user_id_from_attrs: [mail] user_id_to_attr: mail ``` 13. Start SATOSA: ```sh . /opt/satosa/bin/activate cd /opt/satosa/etc gunicorn -b0.0.0.0:443 --keyfile https.key --certfile https.crt satosa.wsgi:app ``` 14. At this point you should be able to perform an IdP test (https://samltest.id/start-idp-test/) by specifying the entity ID of the proxy's front end, e.g., https://example.com/Saml2IDP/proxy.xml. The SAMLtest SP will request authentication by your proxy IdP, causing your proxy SP to request authentication by the SAMLtest IdP. If everything works right, you will end up back at the SAMLtest SP: SAMLtest SP ---AuthnRequest---> SATOSA front end (IdP)/back end (SP) ---AuthnRequest---> SAMLtest IdP SAMLtest SP <---AuthnResponse--- SATOSA front end (IdP)/back end (SP) <---AuthnResponse--- SAMLtest IdP I hope this helps other adopters. If you have any questions, please reply on list so everyone can benefit from the discussion. Best wishes, Matthew -- "The lyf so short, the craft so longe to lerne."

2 months, 1 week

2
1
0 0

oidc client registration

by peter.schober＠univie.ac.at

Not knowing whether my satosa instance is fully working yet (see my other thread) I'm now continuing to try to get the application (eduMEET) to work with satosa's oidc frontend, as per the app's published config example: https://github.com/havfo/multiparty-meeting/blob/master/server/config/confi… So I've made up a client_id and client_secret on the RP side and provided the client with an issuerURL (base URL of satosa), let it request all the scopes in the world and set its own redirect_uri. With those all set I do see requests to satosa's .well-known endpoints from the application in satosa logs, e.g. Found registered endpoint: module name:'oidc', endpoint: .well-known/openid-configuration (And of course accessing the endpoint myself I can see that it works and produces JSON with its config.) Now on the OP side (satosa oidc frontend) I haven't done any setup for the client yet, so I guess the error in the log is to be expected: Error in authn req: Unknown client_id Now what would be the next steps to register that client? The request from the client (according to satosa's logs) has these query parameters (where cid and csec are the correct client_id and client_secret, respectively): client_id=cid&scope=openid+email+profile&response_type=code&redirect_uri=https%3A%2F%2Fexample.org%2Fauth%2Fcallback&state=e30%3D&client_secret=csec My plugins/frontends/openid_connect_frontend.yaml looks like the published example, essentially: module: satosa.frontends.openid_connect.OpenIDConnectFrontend name: oidc config: signing_key_path: /etc/satosa/oidc-provider.key #db_uri: mongodb://db.example.com # optional: only support MongoDB, will default to in-memory storage if not specified client_db_path: /etc/satosa/oidc-clients.json provider: client_registration_supported: True response_types_supported: ['code', 'token', 'id_token'] subject_types_supported: ['public', 'pairwise'] scopes_supported: ['openid', 'email', 'profile'] Only that I tried to enable pretty much everything (all repose and subject types, all scopes, client registration) since I had no idea what the RP side wants, yet. (Seems I can remove all response types except 'code', as per the log shown above.) I don't have MongoDB set up yet since the comment above suggests an in-memory store would be used, which is fine for my current testing. And looking at _create_provider() at frontends/openid_connect.py the code would use the file referenced by client_db_path if db_uri isn't set even before falling back to storing it in a variable. The file referenced in client_db_path exists, is writable by the user satosa runs as, and currently contains only '{}' (without the quotes). So IMO that should be sufficient. Any hints on how to register the application? The documenation is a bit sparse here https://github.com/IdentityPython/SATOSA/blob/master/doc/README.md#frontend… only mentioning that *without* dynamic client registration (which I have enabled for now, but maybe the RP doesn't support it) I'd have to manually create the data structures in MongoDB (or the file in client_db_path) for my client, as per the oidc spec for Client Registration Responses. Could someone share a json sample to put into the file referenced by client_db_path (if that's how it's supposed to work)? Cheers, -peter

2 months, 2 weeks

2
2
0 0

Satosa not sending attributes to the SP

by kuba.michal.n＠gmail.com

Hello, It seems that Satosa is not sending attributes to the SP. The only exception is the one attribute specified in user_id_from_attrs. Is it a default behaviour? No SP specific policies were defined. [2021-08-11 15:57:36,463] [DEBUG] [satosa.backends.saml2._translate_response] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] backend received attributes: { "displayName": [ "plguser14" ], "eduPersonTargetedID": [ "64d759cc-1d21-4a29-a6e1-e7a10908d95e" ], "mail": [ "plguser14 at ops.pl" ], "sn": [ "czterna" ] } [2021-08-11 15:57:36,464] [DEBUG] [satosa.routing.frontend_routing] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] Routing to frontend: Saml2IDP-front [2021-08-11 15:57:36,464] [WARNING] [saml2.assertion.restrict] The metadata parameter for saml2.assertion.Policy.restrict is deprecated and ignored; instead, initialize the Policy object setting the mds param. [2021-08-11 15:57:36,465] [DEBUG] [saml2.assertion.filter] required: [{'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.25178.1.2.14', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrnam e-format:uri', 'friendly_name': 'schacPersonalUniqueCode', 'is_required': 'true'}], optional: [{'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.10', 'name_format': 'urn:oasis :names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'eduPersonTargetedID'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6', 'name_format': 'urn:oasis:names:tc:SAML :2.0:attrname-format:uri', 'friendly_name': 'eduPersonPrincipalName'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:0.9.2342.19200300.100.1.3', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrn ame-format:uri', 'friendly_name': 'mail'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:urn:oid:2.16.840.1.113730.3.1.241', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'fr iendly_name': 'displayName'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:2.5.4.3', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'cn'}, {'__class__': 'urn :oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.9', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'eduPersonScopedAffiliation'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.25178.1.2.9', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'schacHomeOrganization'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.13685.1.1.1.1.2.20', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'pleduOrgUniqueNumber'}] [2021-08-11 15:57:36,465] [DEBUG] [satosa.frontends.saml2._get_approved_attributes] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] Filter: ['edupersontargetedid', 'schacPersonalUniqueCode', 'mail'] [2021-08-11 15:57:36,465] [DEBUG] [satosa.attribute_mapping.from_internal] frontend attribute eduPersonTargetedID mapped from edupersontargetedid [2021-08-11 15:57:36,465] [DEBUG] [satosa.attribute_mapping.from_internal] frontend attribute email mapped from mail [2021-08-11 15:57:36,465] [DEBUG] [satosa.frontends.saml2._handle_authn_response] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] returning attributes {"eduPersonTargetedID": ["64d759cc-1d21-4a29-a6e1-e7a10908d95e"], "email": ["plguser14 at ops.pl"]} [2021-08-11 15:57:36,466] [DEBUG] [satosa.frontends.saml2._handle_authn_response] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] signing with algorithm http://www.w3.org/2001/04/xmldsig-more#rsa-sha256 [2021-08-11 15:57:36,466] [DEBUG] [satosa.frontends.saml2._handle_authn_response] [urn:uuid:104101fc-b624-41d0-96d2-c952f11713f9] using digest algorithm http://www.w3.org/2001/04/xmlenc#sha256 [2021-08-11 15:57:36,466] [WARNING] [satosa.frontends.saml2._handle_authn_response] sign_alg and digest_alg are deprecated; instead, use signing_algorithm and digest_algorithm under the service/idp configuration path (not under policy/default). [2021-08-11 15:57:36,467] [DEBUG] [saml2.assertion.filter] required: [{'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.25178.1.2.14', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'schacPersonalUniqueCode', 'is_required': 'true'}], optional: [{'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.10', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'eduPersonTargetedID'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.6', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'eduPersonPrincipalName'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:0.9.2342.19200300.100.1.3', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'mail'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:urn:oid:2.16.840.1.113730.3.1.241', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'displayName'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:2.5.4.3', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'cn'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.5923.1.1.1.9', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'eduPersonScopedAffiliation'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.25178.1.2.9', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'schacHomeOrganization'}, {'__class__': 'urn:oasis:names:tc:SAML:2.0:metadata&RequestedAttribute', 'name': 'urn:oid:1.3.6.1.4.1.13685.1.1.1.1.2.20', 'name_format': 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri', 'friendly_name': 'pleduOrgUniqueNumber'}] [2021-08-11 15:57:36,469] [INFO] [saml2.entity.sign] REQUEST: <ns0:Response xmlns:ns0="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ns2=" http://www.w3.org/2000/09/xmldsig#" Destination=" https://aai.pionier.net.pl/test/module.php/saml/sp/saml2-acs.php/default-sp" ID="id-HquE4vV74jkKMlK19" InResponseTo="_417162b56e4c88f4e2d89d05c295789a5d318a5d91" IssueInstant="2021-08-11T13:57:36Z" Version="2.0"><ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://sso.pre.plgrid.pl:8081/Saml2IDP-front/proxy.xml</ns1:Issuer><ns2:Signature Id="Signature1"><ns2:SignedInfo><ns2:CanonicalizationMethod Algorithm=" http://www.w3.org/2001/10/xml-exc-c14n#" /><ns2:SignatureMethod Algorithm=" http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /><ns2:Reference URI="#id-HquE4vV74jkKMlK19"><ns2:Transforms><ns2:Transform Algorithm=" http://www.w3.org/2000/09/xmldsig#enveloped-signature" /><ns2:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ns2:Transforms><ns2:DigestMethod Algorithm=" http://www.w3.org/2001/04/xmlenc#sha256" /><ns2:DigestValue /></ns2:Reference></ns2:SignedInfo><ns2:SignatureValue /><ns2:KeyInfo><ns2:X509Data><ns2:X509Certificate>MIIFtzCCA5+gAwIBAgIJAMItW6x6FcDjMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNVBAYTAlBMMRYwFAYDVQQIDA1MZXNzZXIgUG9sYW5kMQ8wDQYDVQQHDAZDcmFjb3cxDDAKBgNVBAoMA0FDSzEQMA4GA1UECwwHQUNLLVNFQzEaMBgGA1UEAwwRc3NvLnByZS5wbGdyaWQucGwwHhcNMjEwNzMwMTIzODAxWhcNMjIwNzMwMTIzODAxWjByMQswCQYDVQQGEwJQTDEWMBQGA1UECAwNTGVzc2VyIFBvbGFuZDEPMA0GA1UEBwwGQ3JhY293MQwwCgYDVQQKDANBQ0sxEDAOBgNVBAsMB0FDSy1TRUMxGjAYBgNVBAMMEXNzby5wcmUucGxncmlkLnBsMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAzwaBMIs/laH99rd6VxxIE/pbCv4oQqYelNRPEPpn9w+VmV5Er3RGfhGA8xuahHpFUu7rdqB0G96tmr7J8WMVCjEoDFnXkzYlJf8oul8BAsTXI2CnMw74mE98BnmT0/4jXIJbfcH9/UrtMVpR4pxIYV6CF2deXtPhFHxF8Sp+lhWCqEE27bxt7CVGoq5DMt9cm3qh6TtfdoLjALmKLjFvp6vBcyleufS1xv8AsXz0lHWJ6j8FdG2uBC75aZ9jWYZINopt90gJMUZpZ3XUfNm5DVFQqV3LyiNc4UNexqKtAydGtj6CWYXaBi5XiOflyINakSJf0v/3G5kFUonlleGsBgcq3xNU0ZeC+vjRoh4cA4CpIcvq//VvQvG9jcL5ExUhNc5niMuCBMNiJzPXG0l+HewX+n0PRG/XiYBlgC8dhYmaZXqyHpja5y4UjvKXlJxqcPxdqxfzoe30jK4UlgQZ2hu0i1pOQ+TdVURISJYKu2AjI9WmQ6J0F/77yaSez2J4MkqjZWADEv7EG/fdvCrCl/rSMNX6cEbHZHu8wu+OpWX15tF6av+CKt43NyPTFdB+vC2bHNSFzDAZwYwyX14HkNwkWHjerrGQSK9VdqoOBb2/NRGlHffpvyoS7Jd7TFD8Po26936rfF4weS/Urd9KLrOrg+dpU/8DT7jlROBNDtMCAwEAAaNQME4wHQYDVR0OBBYEFHqQWjL3v2VO2GjeRt221qP/Kkz7MB8GA1UdIwQYMBaAFHqQWjL3v2VO2GjeRt221qP/Kkz7MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAK7m+DKYQsyzniRNCWm4bgeqJ4fBjEdjw6xn8kB43MRTlaOQ41wMB7Qu2MM1umJida3/tIySbHGph/l/l3I/SanlUOAS9ahiKJtWUOj03XDdAKkQPf1ij7NqAq7Ealw9NVee+vhew36hD6m/jskjcJJEmbufb08QgeX7G7dG1jkSr2rfXhGzOnXIvAGiqizkRrI7WUNxferqU6CLgn1LxH3oSQa747dKPG02w0flphSN6f81+H2vxsIddvkeC1NSUq92sIfiMuYuKnzNkEheiFJ6JQpCaHH1yYJpkd8xoMZrSAosNprBYxMyS8cwEColCCdkiUcpab1xE4f3TF12O4eWEKSZw0MxH/FdPUvOjE9IMuGhQOMxbMQFw9AJnY2PNRHotMmyZQ5xUCUjUvfeE5FkD/rM1U8GWDSxoDPx9ORMebU3w2oXR8r4PUc//n405fXn/s4IYA3SleoaU5XmDtfg1QVd/4rN5rCa4yMqIzhVpZli6umVOYULbzhxAnpCd0PwUGoGfPniKg7fNHB5veSRzLXju8JaW7ldJacvkXnWzAnh3ti0BJQ29DbTUZ/QsjWGhzMfub31jp8lPK+tuphTkWoGok0sZRhKLH+2Sdkcb+jJkbhv0Ft197vnMZvz4Ybn4suAP5/GE2ZCgKDj7J9OJ37n/KyiD3gUKJasWFDk</ns2:X509Certificate></ns2:X509Data></ns2:KeyInfo></ns2:Signature><ns0:Status><ns0:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></ns0:Status><ns1:Assertion ID="id-X2qR3due6dcurArXi" IssueInstant="2021-08-11T13:57:36Z" Version="2.0"><ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"> https://sso.pre.plgrid.pl:8081/Saml2IDP-front/proxy.xml</ns1:Issuer><ns1:Subject><ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">64d759cc-1d21-4a29-a6e1-e7a10908d95e</ns1:NameID><ns1:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><ns1:SubjectConfirmationData InResponseTo="_417162b56e4c88f4e2d89d05c295789a5d318a5d91" NotOnOrAfter="2021-08-11T14:12:36Z" Recipient=" https://aai.pionier.net.pl/test/module.php/saml/sp/saml2-acs.php/default-sp" /></ns1:SubjectConfirmation></ns1:Subject><ns1:Conditions NotBefore="2021-08-11T13:57:36Z" NotOnOrAfter="2021-08-11T14:12:36Z"><ns1:AudienceRestriction><ns1:Audience> https://aai.pionier.net.pl/test/module.php/saml/sp/metadata.php/default-sp</ns1:Audience></ns1:AudienceRestriction></ns1:Conditions><ns1:AuthnStatement AuthnInstant="2021-08-11T13:57:36Z" SessionIndex="id-YX0liwOPeyOoMqBv7"><ns1:AuthnContext><ns1:AuthnContextClassRef>default-LoA</ns1:AuthnContextClassRef><ns1:AuthenticatingAuthority> https://sso.pre.plgrid.pl/auth/realms/PLGRID</ns1:AuthenticatingAuthority></ns1:AuthnContext></ns1:AuthnStatement><ns1:AttributeStatement><ns1:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><ns1:AttributeValue><ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">64d759cc-1d21-4a29-a6e1-e7a10908d95e</ns1:NameID></ns1:AttributeValue></ns1:Attribute></ns1:AttributeStatement></ns1:Assertion></ns0:Response> [2021-08-11 15:57:36,472] [DEBUG] [saml2.sigver._run_xmlsec] xmlsec command: /bin/xmlsec1 --sign --privkey-pem /etc/satosa/plugins/frontends/frontend.key --id-attr:ID urn:oasis:names:tc:SAML:2.0:protocol:Response --node-id id-HquE4vV74jkKMlK19 --output /tmp/tmp3ylf1dxd.xml /tmp/tmpj9ip14kl.xml [2021-08-11 15:57:36,516] [INFO] [saml2.entity.apply_binding] HTTP POST Logs from SP: Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] <ns1:AttributeStatement> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] <ns1:Attribute FriendlyName="eduPersonTargetedID" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] <ns1:AttributeValue> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] <ns1:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">64d759cc-1d21-4a29-a6e1-e7a10908d95e</ns1:NameID> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] </ns1:AttributeValue> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] </ns1:Attribute> Aug 11 11:34:20 simplesamlphp DEBUG [ed6e68a42d] </ns1:AttributeStatement> Thank you in advance for any help! Jakub

4 years, 3 months

2
7
0 0

KeyError when routing to frontend

by ymniezab＠cyfronet.krakow.pl

Hello, We are trying to use Satosa as proxy for Keycloak. After successful login backend receives attributes and tries to route them to frontend named Saml2IDP (same name as in the example) but fails: [2021-08-05 11:03:50,412] [DEBUG] [satosa.attribute_mapping.to_internal] backend attribute ['sn', 'surname'] mapped to surname [2021-08-05 11:03:50,413] [DEBUG] [satosa.backends.saml2._translate_response] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] backend received attributes: { "sn": [ "czterna" ] } [2021-08-05 11:03:50,413] [DEBUG] [satosa.routing.frontend_routing] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Routing to frontend: Saml2IDP [2021-08-05 11:03:50,413] [ERROR] [satosa.base.run] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Uncaught exception Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' [2021-08-05 11:03:50,416] [ERROR] [satosa.proxy_server.__call__] Unknown error Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/proxy_server.py", line 118, in __call__ resp = self.run(context) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 258, in run raise SATOSAUnknownError("Unknown error") from err satosa.exception.SATOSAUnknownError: Unknown error Thank you in advance for any help!

4 years, 3 months

2
1
0 0

KeyError when routing to frontend

by kuba.michal.n＠gmail.com

Hello, We are trying to use Satosa as proxy for Keycloak. After successful login backend receives attributes and tries to route them to frontend named Saml2IDP (same name as in the example) but fails: [2021-08-05 11:03:50,412] [DEBUG] [satosa.attribute_mapping.to_internal] backend attribute ['sn', 'surname'] mapped to surname [2021-08-05 11:03:50,413] [DEBUG] [satosa.backends.saml2._translate_response] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] backend received attributes: { "sn": [ "czterna" ] } [2021-08-05 11:03:50,413] [DEBUG] [satosa.routing.frontend_routing] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Routing to frontend: Saml2IDP [2021-08-05 11:03:50,413] [ERROR] [satosa.base.run] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Uncaught exception Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' [2021-08-05 11:03:50,416] [ERROR] [satosa.proxy_server.__call__] Unknown error Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/proxy_server.py", line 118, in __call__ resp = self.run(context) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 258, in run raise SATOSAUnknownError("Unknown error") from err satosa.exception.SATOSAUnknownError: Unknown error Thank you in advance for any help!

4 years, 3 months

2
5
0 0

KeyError when routing to frontend

by ymniezab＠cyfronet.krakow.pl

Hello, We are trying to use Satosa as proxy for Keycloak. After successful login backend receives attributes and tries to route them to frontend named Saml2IDP (same name as in the example) but fails: [2021-08-05 11:03:50,412] [DEBUG] [satosa.attribute_mapping.to_internal] backend attribute ['sn', 'surname'] mapped to surname [2021-08-05 11:03:50,413] [DEBUG] [satosa.backends.saml2._translate_response] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] backend received attributes: { "sn": [ "czterna" ] } [2021-08-05 11:03:50,413] [DEBUG] [satosa.routing.frontend_routing] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Routing to frontend: Saml2IDP [2021-08-05 11:03:50,413] [ERROR] [satosa.base.run] [urn:uuid:6e039cb0-5454-4224-987e-1965c623cad9] Uncaught exception Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' [2021-08-05 11:03:50,416] [ERROR] [satosa.proxy_server.__call__] Unknown error Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 240, in run resp = self._run_bound_endpoint(context, spec) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 180, in _run_bound_endpoint return spec(context) File "/usr/local/lib/python3.6/site-packages/satosa/backends/saml2.py", line 350, in authn_response return self.auth_callback_func(context, self._translate_response(authn_response, context.state)) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 149, in _auth_resp_callback_func context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/attribute_modifications.py", line 17, in process return super().process(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/micro_services/base.py", line 33, in process return self.next(context, data) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 120, in _auth_resp_finish return frontend.handle_authn_response(context, internal_response) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 86, in handle_authn_response return self._handle_authn_response(context, internal_response, self.idp) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 317, in _handle_authn_response request_state = self.load_state(context.state) File "/usr/local/lib/python3.6/site-packages/satosa/frontends/saml2.py", line 149, in load_state state_data = state[self.name] File "/usr/lib64/python3.6/collections/__init__.py", line 991, in __getitem__ raise KeyError(key) KeyError: 'Saml2IDP' The above exception was the direct cause of the following exception: Traceback (most recent call last): File "/usr/local/lib/python3.6/site-packages/satosa/proxy_server.py", line 118, in __call__ resp = self.run(context) File "/usr/local/lib/python3.6/site-packages/satosa/base.py", line 258, in run raise SATOSAUnknownError("Unknown error") from err satosa.exception.SATOSAUnknownError: Unknown error Thank you in advance for any help!

4 years, 3 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

satosa-users August 2021