[JIRA] (JENKINS-61917) Remove Signature and SigAlg from SAML Request

Issue Type:	Bug
Assignee:	Ivan Fernandez Calvo
Attachments:	Screen Shot 2020-04-15 at 11.48.09 AM.png
Components:	saml-plugin
Created:	2020-04-15 15:58
Environment:	Jenkins 2.230, SAML Plugin 1.1.5, java-1.8.0-openjdk-1.8.0.242.b08-0.el7_7.x86_64
Labels:	plugin
Priority:	Major
Reporter:	Jonathan Blake

We recently updated our plugin from version 0.14 to 1.1.5 and the upgrade has broken our SAML auth. I've noticed that the SAML request sent by Jenkins now contains a block with a signature at the end, which our IdP team has identified as the root cause of the issue. I've tried toggling plugin settings but there does not seem to be a way to remove the SigAlg and Signature from the request. The only workaround we've found is to downgrade the plugin to 0.14.

This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38)

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 12:04:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake

We recently updated our are unable to get the plugin from working with any of the 1.X releases, and have been version locked at 0.14 to 1 . 1.5 and the upgrade has broken our SAML auth. I've noticed that the SAML request sent by Jenkins in the 1.1.5 version now contains a block with a signature at the end, which our IdP team has identified as the root cause of the issue. I've tried toggling plugin settings but there does not seem to be a way to remove the SigAlg and Signature from the request. The only workaround we've found is to downgrade the plugin to 0.14.

Is there a way to remove this block from the request in version 1.1.5?

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 12:36:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo closed an issue as Not A Defect

Jenkins /

Change By:	Ivan Fernandez Calvo
Status:	Open Closed
Resolution:	Not A Defect

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 12:36:04 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

this is not an issue is a support request please read https://wiki.jenkins.io/display/JENKINS/How+to+report+an+issue

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 12:55:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake

The newer versions of the plugin (1.X) have added a SigAlg and Signature to the SAML request that has broken our authentication. There does not appear to be a way to remove this from the request, though the

We are unable to get the plugin working with any of the 1.X releases, and have been version locked at 0.14. I've noticed that the SAML request sent by Jenkins in the 1.1.5 version now contains a block with a signature at the end, which our IdP team has identified as the root cause of the issue. I've tried toggling plugin settings but there does not seem to be a way to remove the SigAlg and Signature from the request. The only workaround we've found is to downgrade the plugin to 0.14.

Is there a way to remove this block from the request in version 1.1.5?

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 12:55:04 PM4/15/20

to jenkinsc...@googlegroups.com

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:20:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

Ivan Fernandez Calvo thank you. I have submitted it to the Jenkins support channel

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:23:04 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake edited a comment on

[~ifernandezcalvo] thank you. I have submitted it to the Jenkins support channel on Gitter. Can you please follow up on this issue there? We've been blocked by this for a few weeks now.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:29:02 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

I think that your issue is related to a change on https://github.com/jenkinsci/saml-plugin/releases/tag/saml-1.1.4, you only have to go to encryption settings and disable the signature

*Auth Request Signature *- Enable signature of the Redirect Binding Auth Request, If you enable it the encryption and signing key would available in the SP metadata file and URL (JENKINS_URL/securityRealm/metadata).

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:44:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	image-2020-04-15-13-43-12-679.png

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:44:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	Screen Shot 2020-04-15 at 1.40.40 PM.png

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 1:44:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

I thought that might be the case but we actually don't have the encryption setting enabled on the plugin. Is there another setting for this?

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:10:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

If you want to force to disable the signature you have to enable description settings and keep the Auth Request Signature disabled, by default the signature is sent.

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:21:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	Screen Shot 2020-04-15 at 2.18.30 PM.png

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:21:04 PM4/15/20

to jenkinsc...@googlegroups.com

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:22:03 PM4/15/20

to jenkinsc...@googlegroups.com

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:22:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	image-2020-04-15-14-21-15-767.png

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:24:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

Unfortunately even with those settings, it's sending a SigAlg and Signature - that's why I originally logged this as a bug.

Could it be an issue with our Java version?

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:25:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake edited a comment on

Unfortunately even with those settings, it's sending a SigAlg and Signature - that's why I originally logged this as a bug

.

Could it be an issue with our Java version?

!image-2020-04-15-14-21-15-767.png!

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:28:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake edited a comment on

Unfortunately even with those settings, it's sending a SigAlg and Signature.

Could it be an issue with our Java version?

!image-2020-04-15-14-21-15-767.png |width=1352,height=502 !

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:51:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

Could you attach the IdP metadata(JENKINS_HOME/saml-ipd-metadata.xml) and SP metadata(JENKINS_HOME/saml-sp-metadata.xml)? Do not forget to remove IPs and sensible data.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:51:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo edited a comment on

Could you attach the IdP metadata(JENKINS_HOME/saml-ipd-metadata.xml) and SP metadata(JENKINS_HOME/saml-sp-metadata.xml)? Do not forget to remove IPs and sensible data.

Also, Which IdP you use?

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 2:53:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo edited a comment on

Could you attach the IdP metadata(JENKINS_HOME/saml-ipd-metadata.xml) and SP metadata(JENKINS_HOME/saml-sp-metadata.xml)? Do not forget to remove IPs and sensible data.

Also, Which IdP you use?

The main difference between 0.14 and 1.x id the update of the pac4j library that changed a lot.

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 3:09:02 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	saml-idp-metadata.xml

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 3:09:02 PM4/15/20

to jenkinsc...@googlegroups.com

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 3:09:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

Sure thing. I believe our IdP is Siteminder, but it's maintained by another part of our organization.

I'm attaching the metadata xml files with redacted info.

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 3:11:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake updated an issue

Jenkins /

Change By:	Jonathan Blake
Attachment:	saml-idp-metadata.xml

Attachment:	saml-sp-metadata.xml

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 4:01:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

the IdP configuration is correct

 
                                                                IDPSSODescriptor WantAuthnRequestsSigned="false" 
                                                            

does not request signature, and the SP configuration is also correct

 
                                                                <md:SPSSODescriptor AuthnRequestsSigned="false" WantAssertionsSigned="true"  
                                                            

looks also correct, Jenkins should not signed the request and request the asserttion signed. I will reopen the issue and take a look on a test environment.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 4:02:02 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo reopened an issue

Jenkins /

Change By:	Ivan Fernandez Calvo
Resolution:	Not A Defect
Status:	Closed Reopened

kuisathaverat@gmail.com (JIRA)

unread,

Apr 15, 2020, 4:02:03 PM4/15/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo started work on

Change By:	Ivan Fernandez Calvo

Status:	Reopened In Progress

jonawayneblake@gmail.com (JIRA)

unread,

Apr 15, 2020, 4:09:03 PM4/15/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

Thank you Ivan Fernandez Calvo, I'll continue to monitor this ticket. Please let me know if there's any other information you need.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 19, 2020, 7:39:05 AM4/19/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

I can confirm that the disable signing setting does not work with redirect binding, It is a long history that drove me crazy a long time ago when I updated the library. So in the version we use of pac4j `forceSignRedirectBindingAuthnRequest` and `authnRequestSigned` do not work as expected. Indeed it is not possible to change the value of authnRequestSigned, I've to extend the class to overwrite the `isAuthnRequestSigned()` method and add a `setAuthnRequestSigned()` method, but this workaround only works with POST binding. It is not possible to upgrade the library again because it uses a newer version of Sprint and Jenkins Core uses an old one. So the only solution is to stop using pac4j library, and use OpenSAML library directly, but this is a reimplementation of the plugin.
I will document it and come back to it when I'll change the library.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 19, 2020, 7:58:02 AM4/19/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo closed an issue as Postponed

Jenkins /

Change By:	Ivan Fernandez Calvo

Status:	In Progress Closed
Resolution:	Postponed

jonawayneblake@gmail.com (JIRA)

unread,

Apr 20, 2020, 11:40:02 AM4/20/20

to jenkinsc...@googlegroups.com

Jonathan Blake commented on

Ivan Fernandez Calvo I appreciate you looking into this. What is the timetable for changing the core library? I'm trying to determine if my team should continue with the deprecated version of the plugin or maybe pursue another auth method for the time being.

kuisathaverat@gmail.com (JIRA)

unread,

Apr 20, 2020, 1:21:04 PM4/20/20

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

>I appreciate you looking into this. What is the timetable for changing the core library?

not soon, I do not have a start date to make it.