Missing features in dealing with SAML2 delegated authentication

[Fabio Martelli]

Hi All, I'm working to configure my CAS 5.1.1 in order to delegate the authentication to an external SAML2 identity provider.

I successfully configured this scenario just by adding pac4j-webflow dependency + by including into my cas.properties file some cas.authn.pac4j.saml[0].* properties (as per the documentation).
Unfortunately, some important aspects are missing in order to be fully compliant with the specification of my Identity Provider.

I'm asking if there is a way to have more control in generating metadata and AuthnRequest.

For instance, I would have the possibility to specify ForceAuthn and IsPassive AuthnRequest attributes. Is there a way, the right way, to do this?
Please, let me know.

Thank you in advance.
Best regards,
F.

[Misagh Moayyed]

ForceAuth is supported by pac4j at the moment; CAS is not leveraging it. Passive Auth is hardcoded by pac4j as false, always. If you were to do this, you would need to modify pac4j to expose a setting for passive auth, and then modify CAS to set those two flags based on settings you define which would take on the form of cas.authn.pac4j.saml[0].forceAuth=true/false and cas.authn.pac4j.saml[0].passive=true/false.

--Misagh

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2574eee1-14fd-45a9-9769-a9726b3e72f6%40apereo.org.

[Fabio Martelli]

Il 12/07/2017 01:18, Misagh Moayyed ha scritto:

ForceAuth is supported by pac4j at the moment; CAS is not leveraging it. Passive Auth is hardcoded by pac4j as false, always. If you were to do this, you would need to modify pac4j to expose a setting for passive auth, and then modify CAS to set those two flags based on settings you define which would take on the form of cas.authn.pac4j.saml[0].forceAuth=true/false and cas.authn.pac4j.saml[0].passive=true/false.

Hi Misagh, thank you for your prompt reply.
Please, could you address me to the classes of CAS that I have to dealing with?

For pac4j I think I have to change into Pac4jProperties$Saml, haven't I?

Thank you again for your reply.
BR,
F.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/etPan.59655cb4.183471e.56e%40unicon.net.

-- 
Fabio Martelli
https://it.linkedin.com/pub/fabio-martelli/1/974/a44
http://blog.tirasa.net/author/fabio/index.html

Tirasa - Open Source Excellence
http://www.tirasa.net/index.html?pk_campaign=email&pk_kwd=fm

Apache Syncope PMC
http://people.apache.org/~fmartelli/

[Misagh Moayyed]

Please, could you address me to the classes of CAS that I have to dealing with?

For pac4j I think I have to change into Pac4jProperties$Saml, haven't I?

That’s on the CAS side of things, and then you want to modify Pac4jAuthenticationEventExecutionPlanConfiguration.

On the pac4j side, you want to modify the SAML2ClientConfiguration and SAML2Client.

Or, you simply wait for 5.2 RC2. 

[Misagh Moayyed]

 

Hi Misagh, sorry if I'm disturbing you again.

 

No such thing.

This email is just to make you all aware of a bug (I think) about the specification of a RequestedAuthnContext element of an AuthnRequest.
It seems that pac4j requires the comparisonType to permit this operation.

 

Great. What you want to do is:

 

1.      Submit a PR to pac4j allowing to specify the comparison type.

2.      Submit a PR to CAS configuring a comparison type via settings.

3.      Stop writing code :)

[RJ]

though maximumAuthenticationLifetime is matching, we still see tons of:

017-07-12 11:51:55,169 ERROR [org.pac4j.saml.sso.impl.SAML2DefaultResponseValidator] - <Current assertion validation failed, continue with the next one>
org.pac4j.saml.exceptions.SAMLException: Authentication issue instant is too old or in the future

ForceAuth would fix this as well ?

--

- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.

To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscribe@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/027601d2fb1f%24a7f31790%24f7d946b0%24%40unicon.net.

[Fabio Martelli]

Thank you so much.
BR,
F.

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/etPan.59660db4.217acc40.56e%40unicon.net.

[Fabio Martelli]

Hi MIsagh, sorry if I'm disturbing you again.

This email is just to make you all aware of a bug (I think) about the specification of a RequestedAuthnContext element of an AuthnRequest.
It seems that pac4j requires the comparisonType to permit this operation.

In my code I have fixed this issue just by changing into Pac4jAuthenticationEventExecutionPlanConfiguration by forcing comparisonType to minimum in case of an AuthnContextClassRef is specified.


    private void configureSamlClient(final Collection<BaseClient> properties) {
        ......
                    if (StringUtils.isNotBlank(saml.getAuthnContextClassRef())) {
                        // this is required in order to permit pac4j to create the element RequestedAuthnContext
                        cfg.setComparisonType("minimum");
                        cfg.setAuthnContextClassRef(saml.getAuthnContextClassRef());
                    }
        .....
    }

BR,
F.

Il 12/07/2017 13:53, Misagh Moayyed ha scritto:

--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/etPan.59660db4.217acc40.56e%40unicon.net.

[Fabio Martelli]

Hi Misagh, I've just created a PR as requested.
See (https://github.com/apereo/cas/pull/2794)

BR,
F.

--

- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/027601d2fb1f%24a7f31790%24f7d946b0%24%40unicon.net.