Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Repo info
Activity
  • Oct 05 17:21
    subodhan-arinsights labeled #1369
  • Oct 05 17:21
    subodhan-arinsights opened #1369
  • Sep 28 11:25
    JerkerPihl commented #1052
  • Sep 28 11:14
    JerkerPihl commented #1052
  • Sep 28 09:13
    JerkerPihl commented #1052
  • Sep 27 10:41
    AntonioSCoelho commented #758
  • Sep 26 10:06
    AntonioSCoelho commented #758
  • Sep 21 13:37
    ritocesura edited #1367
  • Sep 21 10:07
    ritocesura commented #1367
  • Sep 21 04:43
    semi07 labeled #1368
  • Sep 21 04:43
    semi07 labeled #1368
  • Sep 21 04:43
    semi07 opened #1368
  • Sep 21 04:29
    github-actions[bot] closed #1366
  • Sep 20 20:09
    rikrak commented #1345
  • Sep 20 13:40
    ritocesura edited #1367
  • Sep 20 13:39
    ritocesura labeled #1367
  • Sep 20 13:39
    ritocesura opened #1367
  • Sep 11 04:17
    github-actions[bot] labeled #1366
  • Sep 06 19:01
    mickey-stringer commented #1030
  • Sep 06 13:31
    Narshe1412 commented #1030
Mike Lindegarde
@mlindegarde
It seems that essentially I need to convert the HttpRequest value (which can be accessed in the controller via Response) into an HttpRequestData object but I cannot find an extension method for HttpRequest. I tried the MVC package, HttpModule package... no luck. Those have extension methods for HttpRequestBase which does not exist in ASP.NET Core 3.1.
It seems like I'm just missing something here but I can't figure out what it is. It seems odd that it would be complicated to access the InResponseTo value from the SAML response from within the controller.
I hope the extra detail was helpful.
Anders Abel
@AndersAbel
Why do you need access to InResponseTo? It's a protocol level internal random value.
Did you try the AspNetCore2 package? It contains the extension methods for Asp.Net Core.
But I think you are trying to do something very backwards here... why not use the AspNetCore2 package as it is? Let it set the generated identity into an external Cookie, redirect to an ExternalCallback and do further processing? Just follow the Asp.Net Identity pattern.
Mike Lindegarde
@mlindegarde
I'm trying to get access to InResponseTo because I inherited an old project that uses it. I didn't make the choice to use it nor can I make the choice not to use it.
Personally, I would be perfectly happy to not use InResponseTo.
I am currently using the AspNetCore2 package. The following code inside of the ExternalController does not compile:
Request.ToHttpRequestData(false)
It does not appear that the AspNetCore2 package exports an extension method for HttpRequest that I can use. If the AspNetCore2 package does export an extension method I can use I just need to know the syntax.
Mike Lindegarde
@mlindegarde
Bottom line here, I'm trying to convince the team to move away from the custom built solution that sort of works and to instead use IdentityServer4 + Sustainsys.Saml2.
Their custom solution uses InResponseTo. I don't want that to be a sticking point that keeps us from making the switch.
I'm trying to figure out the best way to access that information so that I can present it if need be.
Anders Abel
@AndersAbel
Thanks for the updated explanation.
Looks like InResponseTo is used as some kind of correlation ID between the authentication request and the returned response?
The contents of InResponseTo when using Sustainsys.Saml2 is the Id of the outbound AuthnRequest, which is a random Id. You cannot control how it is generated.
I suggest that you generate your own correlation id and pass it with the AuthProps when doing the challenge for Saml2. That value will be returned after the authentication is complete.
It will not be transmitted as ID/InResponseTo though, so if your Idp depends on that it is worse
It is of course always possible to custom adaptions - if you want more dedicated help I do provide commercial consulting services.
Mike Lindegarde
@mlindegarde
Thanks for the response. I've already created an example of round tripping and ID using the AuthProps. Between that and using the notifications I can probably accomplish what they want. I was just hoping for something a bit cleaner. If I need something more tailored to our needs I'll reach out.
Thanks again.
Anders Abel
@AndersAbel
@mlindegarde I read what you wrote earlier here too now and understand a bit more: Easiest way to make the InResponseTo value available in the ExternalController.Callback is to implement AcsCommandResultCreated and add the InResponseTo as a claim to the identity. That way you don't have to mess with DI-dependent services in the notification.
Mike Lindegarde
@mlindegarde
@AndersAbel I really like that idea. Seems very promising. The question I have there is how do I access the identity from within AcsCommandResultCreated? Looking at the definitions of CommandResult and Saml2Response I don't see a way to get at the identity. I can get the claims useing Saml2Response.GetClaims but I don't think I can add claims that way.
Bah, I found it: commandResult.Principal.Claims
Mike Lindegarde
@mlindegarde
Well, I need to cast the Principal to a ClaimsIdenitty etc... I get it now.
Mike Lindegarde
@mlindegarde
What is the proper way to add multiple SAML IdPs?
I currently have this code:
builder.AddSaml2(
    provider.AuthenticationScheme,
    provider.DisplayName,
    options =>
    {
        options.SignInScheme = provider.SignInScheme;
        options.SPOptions.EntityId = new EntityId(provider.ServiceProviderEntityId);
        options.SPOptions.Logger = adapter;
        options.SPOptions.ServiceCertificates.Add(certificate);

        options.IdentityProviders.Add(
            new IdentityProvider(new EntityId(provider.IdentityProviderEntityId), options.SPOptions)
            {
                MetadataLocation = provider.MetadataLocation,
                LoadMetadata = provider.LoadMetadata,

            });
    });
It gets called for each of the 2 SAML providers I have.
Each provider works on it's own.
When I add the second one, the second one fails with this error: KeyNotFoundException: The given key 'Sustainsys.Saml2.Metadata.EntityId' was not present in the dictionary.
If I reverse the order, then the second one still fails.
So, if I have a list like: [idpA, idpB].. idpB will return the error message above.
If I reverse the list so it's: [idpB, idpA]... then idpA will return the error message.
I'm clearly not handling adding multiple SAML identity providers correctly. I don't know what I'm missing.
Anders Abel
@AndersAbel
@mlindegarde There are two ways to add multiple Saml2 Idps using the library. 1: Use one authentication scheme (call AddSaml2 once) and add multiple IdentityProviders to the IdentityProviders collection. 2. Use one authentication scheme per Idp (call AddSaml2 once for each Idp). In the latter case you need to set a unique ModulePath for each call.
That's the reason for the error you see: The first handler will catch all incoming responses and if the response is for an Idp that is managed by another handler, it will throw an error message.
Please also note that if you use multiple handlers, they will be logically different SPs, with different metadata. So you need to make sure that you send the right metadata/Urls to each Idp
Mike Lindegarde
@mlindegarde
@AndersAbel Is there an example that shows how to handle multiple IdentityProvidersin the IdentotyProviders collection? With this approach there is only one scheme (Saml2) and I do not see an obvious way to map the scheme to the correct identity provider.
Mike Lindegarde
@mlindegarde
@AndersAbel It looks like I can specify the identity provider by passing "idp" and the entity id for the idp into the Items collection of the AuthenticationProperties object. Is this the "correct" way to handle a single authentiation scheme with multiple identity providers?
var props = new AuthenticationProperties
{
    RedirectUri = Url.Action(nameof(Callback)),
    Items =
    {
        { "returnUrl", returnUrl },
        { "scheme", scheme },
        { "idp", idp }
    }
};
Anders Abel
@AndersAbel
@mlindegarde Yes, with one scheme having multiple Idps the AuthProps is the right way.
But in many cases when the number of Idps is low and known from the start it's better with one Auth Scheme per Idp. It works better with how the Asp.Net and Asp.Net Identity architecture is setup. The main reason to have many Idps with one scheme is if the Idp list is dynamically loaded, such as from a common federation metadata file.
Mike Lindegarde
@mlindegarde
@AndersAbel dynamic loading is exactly where I'm heading.
We will be adding new federation metadata files as new companies come on board and I would prefer not to take down the auth server to do so.
My next question will most likely be around the proper way to add / remove IDPs dynamically. I haven't had the time to see if there is an example of that somewhere on the internet.
Mike Lindegarde
@mlindegarde
@AndersAbel Can you point me in the right direction for dynamically adding and removing IDPs at run-time? As my company sells its product to other companies we will need to add the new SAML2 IDP (if they have one). I do not want to have to restart the server to add the new IDP.
Anders Abel
@AndersAbel
There are several methods. With Asp.Net Core you can add/remove schemes runtime. You can also keep a reference to the options object around and alter the IdentityProviders collection. A third variant is to completely bypass the IdentityProviders collection and use the notifications for lookup instead. Design of solutions like that is what I do as commercial support so please feel free to mail me if you want to discuss more in depth help.
Imene Boussour
@imene-boussour
Hi, I am trying to use IdP initiated flow, my app acts as an IdP. reviewing sustainsys.saml2.stubidp I don't see the use of metadata files when sending Saml2Response to SP and how is the x509 certificates used? can anyone point me to the right direction? Also, I am new to SAML, In our project we will only be using Idp initiated flow, do I need to generate metadata file form my IDP?
Imene Boussour
@imene-boussour
Where can I find the file https://stubidp.sustainsys.com/a34d5bbc-48d0-4c87-9037-03ad7599351f/Metadata in the stubidp project? is it autogenerated
Anders Abel
@AndersAbel
  1. The stub idp is made for testing. It never reads the SP metadata. Instead it relies on the received message and some guessing. This works fine for testing, but is totally unsafe for production use.
  2. Yes, you will need metadata for your Idp that your SP can consume (unless the SP can accept manually entered parameters)
  3. Idp initiated means you can actually start off the StubIdp and get a secure solution - if you never respond to an SP request there's no need to validate any SP requests.
  4. The stubidp/<GUID>/Metadata content is generated by the MetadataController in the StubIdp project each time it is accessed. It is not a file.