saml-2.0

Spring Security SAML One Login Global Single Logout LogoutRequest Parsing Issue

由 ╄→гoц情女王★ 提交于 2019-12-07 15:06:28
I am implementing Spring Security SAML with One Login. I have set all the configuration files and meta data is set. I am able to get login work and logout is working if I logoff from the same application I logged in. In this scenario from SAML IDP I get LogoutResponse and Spring Security is able to parse and process it. http://localhost:8080/web/saml/SingleLogout?SAMLResponse= .............. Problem is when I login in two applications, currently I login to One Login admin console, there is a link to my app, I click on it and I am able to login directly in my application, now when I log off

Propagate SAML Assertion Response/Security Context to downstream Services/Apps

由 时间秒杀一切 提交于 2019-12-07 13:46:34
问题 We have multiple services in our environment. There are scenarios where we want the user to auto-login/silently login to one or more participating services without being challenged by the Identity Provider for credentials or communicating with the Identity Provider after the first successful login from one service. For Eg, we have a front-end UI App which we want to be authenticated using Spring Security SAML. And when the UI App communicates to back-end services we want the security context

SAML 2.0 based Authentication for iPhone application

由 ぃ、小莉子 提交于 2019-12-07 03:09:55
问题 Team, kindly help me how to implement SAML based authentication for iPhone application. I have .NET REST based JSON webservice as my backend service. Kindly advice me on this requirement. 回答1: There are existing standards and tools to support your requirement today. As Scott mentioned, it does require either using the embedded browser in iOS within your application or allowing the iOS Safari Browser to handle the SAML/Browser portion of SSO (each has its own pros/cons). You can check out this

Getting error while decryptition of Saml token

由 会有一股神秘感。 提交于 2019-12-07 02:47:01
问题 I am getting error while decryption of saml token. However this issue is not consistent it works after restarting server. It was working properly till last night :( DEBUG Decrypter:631 - Attempt to decrypt EncryptedKey using credential from KEK KeyInfo resolver failed: org.opensaml.xml.encryption.DecryptionException: Probable runtime exception on decryption:unknown parameter type. at org.opensaml.xml.encryption.Decrypter.decryptKey(Decrypter.java:705) at org.opensaml.xml.encryption.Decrypter

Validating a signature without intermediate certificate

由 岁酱吖の 提交于 2019-12-06 23:04:52
问题 Is it possible to validate a signature only having an ancestor or root certificate in the hierarchy? Disclaimer: I'm a newbie to the certificates handling so please forgive the naive terminology. Consider the following situation. We have two parties (let's call them IdP for Identity Provider and SP for service provider) and some central certificate authority CA which is definitely trusted by both IdP and SP. CA has it's own certificate CertCA known to both IdP and SP (imported into IdP's and

OpenSAML how to check if SAML Response (signature/cert) is really from my IDP?

由 拟墨画扇 提交于 2019-12-06 15:49:24
Hello I have this XML as a SAML2 Response from my IDP: <Assertion ID="_97031c65-0139-4047-a416-9495df5d6ed7" IssueInstant="2016-10-26T07:45:43.438Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"> <Issuer> </Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /> <ds:Reference URI="#_97031c65-0139-4047-a416-9495df5d6ed7"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09

SAML 2.0 password authentication

由 老子叫甜甜 提交于 2019-12-06 14:56:43
I'm aware of how SAML is used for single sign on (SSO). That is, redirection to IDP from SP and getting the user's identity from the SAML response/assertion. My question is - Does SAML 2.0 specification define how to pass username and password as part of a SAML request xml for authentication? Note that I'm not talking about single sign on and just want authentication of username/password. Thanks, The SAML standard supports passing a user identifier in the <saml:Subject> field of the <AuthnRequest> (i.e. the request for authentication). There is however no built in support for passing a

Okta Group Attributes

由 两盒软妹~` 提交于 2019-12-06 14:23:05
问题 I have two service providers that I am connecting to Okta in order to manage identities externally. Can you think of a way to configure Okta to accomplish the following: Associate attributes with groups, rather than directly to users. Users within groups would then inherit these attributes. Associate groups with applications, rather than directly associating users with applications. My end goal is to be able to leverage Okta for managing a role store for each service provider. I would expect

Python SAML OneLogin - How to support multiple Identity Providers

由 ▼魔方 西西 提交于 2019-12-06 13:25:57
I'm relatively new to SAML and came across the OneLogin Python SAML library. I was able to get it up and running with my web app being the Service provider (SP) and OneLogin being the Identity Provider (Idp). I would like to be able to add support for other Identity Providers as well. However, I find that the python-saml library is using a settings.json to get the Idp information. I have looked at the following issues on their Github project but have been unable to get an actionable solution: [1] https://github.com/onelogin/python-saml/issues/64 [2] https://github.com/onelogin/python-saml

Azure AD - SAML Single Logout - Unsupported binding HTTP-POST

由 烂漫一生 提交于 2019-12-06 13:23:36
I am integrating a SAML Service Provider with MS AAD and I have found an issue with Single Logout. My Service Provider only supports logout binding "HTTP-POST". And it seems that AAD only supports logout binding "HTTP-Redirect". I think so based on the SAML metadata I got from AAD - this is the only SingleLogoutService element I can see: <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.microsoftonline.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/saml2" /> Is it really the only supported SLO binding or is it possible to switch other bindings
订阅 saml-2.0