SAML2 authentication fails

[artgoldberg]

Hi Leaf Folks

As you know, I'm currently working on configuring SAML2 authentication, which is not easy as it involves a search in a high-dimensional space!

The Chrome Network developer tool shows this error Cross-Origin Resource Sharing error: PreflightMissingAllowOriginHeader.

In addition, /var/log/shibboleth/shibd.log reports a Shibboleth.LogoutInitiator.SAML2 : error building MessageEncoder: Unknown plugin type error:

2021-05-21 10:56:01 INFO Shibboleth.Application : adding LogoutInitiator of type (SAML2) to chain (/Logout)
2021-05-21 10:56:01 INFO Shibboleth.Application : auto-configuring Logout endpoints for protocol (SAML2)
2021-05-21 10:56:01 INFO Shibboleth.Application : adding SingleLogoutService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:SOAP) at (/SLO/SOAP)
2021-05-21 10:56:01 INFO Shibboleth.Application : adding SingleLogoutService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect) at (/SLO/Redirect)
2021-05-21 10:56:01 INFO Shibboleth.Application : adding SingleLogoutService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST) at (/SLO/POST)
2021-05-21 10:56:01 INFO Shibboleth.Application : adding SingleLogoutService for Binding (urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact) at (/SLO/Artifact)
2021-05-21 10:56:01 ERROR Shibboleth.LogoutInitiator.SAML2 : error building MessageEncoder: Unknown plugin type.
2021-05-21 10:56:01 INFO Shibboleth.Handler.DiscoveryFeed : feed files will be cached in /data/shibds/discofeed
2021-05-21 10:56:01 INFO Shibboleth.Application : building MetadataProvider of type XML...
2021-05-21 10:56:01 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (/etc/shibboleth/AzureIdPMetadata.xml)
2021-05-21 10:56:01 INFO Shibboleth.Application : no TrustEngine specified or installed, using default of ExplicitKey
2021-05-21 10:56:01 INFO Shibboleth.Application : building AttributeExtractor of type XML...
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : loaded XML resource (/etc/shibboleth/attribute-map.xml)
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oasis:names:tc:SAML:attribute:subject-id
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oasis:names:tc:SAML:attribute:pairwise-id
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.6
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:mace:dir:attribute-def:eduPersonPrincipalName
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.9
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:mace:dir:attribute-def:eduPersonScopedAffiliation
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.7
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:mace:dir:attribute-def:eduPersonEntitlement
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oid:1.3.6.1.4.1.5923.1.1.1.10
2021-05-21 10:56:01 INFO Shibboleth.AttributeExtractor.XML : creating mapping for Attribute urn:oasis:names:tc:SAML:2.0:nameid-format:persistent

My redacted http.conf and shibboleth2.xml follow:

Include conf.modules.d/*.conf

# Load the Shibboleth module.
LoadModule mod_shib /usr/lib64/shibboleth/mod_shib_24.so

<IfModule mime_module>
    # TypesConfig points to the file containing the list of mappings from filename extension to MIME-type.
    TypesConfig /etc/mime.types

</IfModule>

# User/Group: The name (or #number) of the user/group that runs httpd.
# It is usually good practice to create a dedicated user and group for
# running httpd, as with most system services.
User apache
Group apache

Listen 443
<VirtualHost *:443>

    # configured as recommended by https://wiki.shibboleth.net/confluence/display/SP3/Apache
    ServerName leaf.mssm.edu
    UseCanonicalName On
    ServerAlias www.leaf.mssm.edu
    DocumentRoot /data/www
    HostnameLookups Off
    ErrorLog logs/leaf_ssl_error_log
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    CustomLog logs/leaf_access_log common

    SSLEngine on
    # a key/cert pair with a cert signed by a trusted CA
    SSLCertificateFile "/etc/pki/tls/certs/leaf.crt"
    SSLCertificateKeyFile "/etc/pki/tls/private/leaf.key"
    # SSLProtocol all -SSLv2 -SSLv3
    # SSLHonorCipherOrder on
    # SSLCipherSuite HIGH:!aNULL:!MD5:!AECDH:!ADH

    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0

    <Location /Shibboleth.sso>
      SetHandler shib
    </Location>

    # API proxy directive, overall api doesn't require user session
    <Location /api>
        ProxyPass         http://10.xxx:5001/api
        ProxyPassReverse  http://10.xxx:5001/api

        # AG: based on http://httpd.apache.org/docs/2.4/mod/mod_authz_core.html#require,
        # https://wiki.shibboleth.net/confluence/display/SP3/Apache and
        # https://www.switch.ch/aai/guides/sp/access-rules/
        AuthType shibboleth
        ShibRequestSetting requireSession false
        Require shibboleth
    </Location>

    # /api/user does require user session
    <Location /api/user>

        AuthType shibboleth
        ShibRequestSetting requireSession true
        Require valid-user
    </Location>

</VirtualHost>

shibboleth2.xml:

<!-- based on https://leafdocs.rit.uw.edu/installation/installation_steps/9_saml2/#example-configurations
    for Apache/Shibboleth -->
<!-- also see https://wiki.shibboleth.net/confluence/display/SP3/GettingStarted -->
<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
    clockSkew="180">

    <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a">
        <Extensions>
            <Library path="adfs.so" fatal="true"/>
        </Extensions>
    </OutOfProcess>
    <InProcess>
        <Extensions>
            <Library path="adfs-lite.so" fatal="true"/>
        </Extensions>
    </InProcess>

    <!-- AG: entityID configured -->
    <ApplicationDefaults entityID="https://leaf.mssm.edu/shibboleth"
                        REMOTE_USER="eppn persistent-id targeted-id">

        <Sessions lifetime="28800" timeout="3600" checkAddress="false"
                relayState="ss:mem" handlerSSL="true" cookieProps="https">

            <!-- AG: entityID configured -->
            <!-- https://wiki.shibboleth.net/confluence/display/SP3/SSO -->
            <SSO isDefault="true" entityID="https://sts.windows.net/77e89d61-570f-43b0-b9e4-634f462e34b8/">
                SAML2 SAML1
            </SSO>

            <!-- AG: configured -->
            <Logout outgoingBindings="https://login.microsoftonline.com/77e89d61-570f-43b0-b9e4-634f462e34b8/saml2">SAML2</Logout>

            <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
            <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

            <!-- Status reporting service. -->
            <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>

            <!-- Session diagnostic service. -->
            <Handler type="Session" Location="/Session" showAttributeValues="true"/>

            <!-- JSON feed of discovery information. -->
            <Handler type="DiscoveryFeed" Location="/DiscoFeed" dir="/data/shibds/discofeed"/>
        </Sessions>

        <!-- AG: supportContact temporarily configured, supportContact and helpLocation need to be configured -->
        <Errors supportContact="[email protected]"
            helpLocation="/about.html"
            styleSheet="/shibboleth-sp/main.css"/>

        <!-- AG: path configured - points to the configuration file provided by the Azure IdP administrator -->
        <MetadataProvider type="XML" path="/etc/shibboleth/AzureIdPMetadata.xml"/>

        <!-- AG: confused -->
        <!-- /etc/shibboleth/attribute-map.xml defines <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn"> etc.
            But our Azure IdP will provide a user uid in an attribute named 'emailaddress'. Should an Attribute with
            id='emailaddress' be added to attribute-map.xml? -->
        <!-- Map to extract attributes from SAML assertions. -->
        <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>

        <!-- Use a SAML query if no attributes are supplied during SSO. -->
        <AttributeResolver type="Query" subjectMatch="true"/>

        <!-- Default filtering policy for recognized attributes, lets other data pass. -->
        <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>

        <!-- Simple file-based resolver for using a single keypair. -->
        <!-- AG: key and certificate configured: reference a key/cert pair with a cert signed by a trusted CA -->
        <CredentialResolver type="File"
                key="/etc/pki/tls/private/leaf_sp.key"
                certificate="/etc/pki/tls/certs/leaf_sp.crt" />

    </ApplicationDefaults>

    <!-- Policies that determine how to process and authenticate runtime messages. -->
    <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>

    <!-- Low-level configuration about protocols and bindings available for use. -->
    <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>

</SPConfig>

Thank you!

Arthur

[artgoldberg]

I believe this problem arises because our Azure folks have not configured a user role for me with Leaf.

Digging deeper, I access the request which is failing, and obtain this response:

AADSTS50105: The signed in user '[email protected]' is not assigned to a role for the application '3d9c8b8f-8324-444a-bd4f-5ade7d51bda4'(Mount Sinai Leaf UAT).

Let's see what happens when our Azure folks assign me a user role for Leaf. I've requested superuser.

[artgoldberg]

Resolved! I had the Azure folks assign me a user role for Leaf, and then re-issue me a metadata file for the Azure identity provider. Both of the steps are described in an article I found on Azure AD SAML federation using Shibboleth SP.

Thanks!

[ndobb]

Excellent! Arthur does this resolve #413 as well?

We can definitely add information to our docs specific to Azure AD as linked above.

[artgoldberg]

Thanks. No, #413 remains. I just emailed you about that.
Documentation specific to Azure AD would indeed be helpful. I'm keeping comprehensive notes, so I can draft it once I'm done.