SAML Authentication Add-on to accept either Assertions or Response to be signed by IDP

XMLWordPrintable

    • 1
    • 9

      Problem Definition:

      At the moment, the plugin would only accept Assertions to be signed for the Authentication regardless of the Response whether it is also signed. In case that the Assertion is not signed, an error like error will appear:

      2018-04-27 16:13:04,860 http-nio-8080-exec-43 ERROR anonymous xxxxxxxxxx xxxxxxx xxxxxxxxx /plugins/servlet/samlconsumer [c.a.p.a.i.web.filter.ErrorHandlingFilter] Received invalid SAML response: The Assertion of the Response is not signed and the SP requires it
com.atlassian.plugins.authentication.impl.web.saml.provider.InvalidSamlResponse: Received invalid SAML response: The Assertion of the Response is not signed and the SP requires it
        at com.atlassian.plugins.authentication.impl.web.saml.provider.impl.OneloginJavaSamlProvider.lambda$extractSamlResponse$1(OneloginJavaSamlProvider.java:89)
        at com.atlassian.plugin.util.ContextClassLoaderSwitchingUtil.runInContext(ContextClassLoaderSwitchingUtil.java:48)
        at com.atlassian.plugins.authentication.impl.web.saml.provider.impl.OneloginJavaSamlProvider.extractSamlResponse(OneloginJavaSamlProvider.java:80)

      But, in certain cases, there is a possibility that it will be the Response that is signed rather than the Assertions and such option might not able to be changed by the client as well.

      Suggested Solution:

      To have the Add-on to accept either the Response or Assertion to be signed in which it could act as a failover system as well.

            Assignee:
            Unassigned
            Reporter:
            Julian (Inactive)
            Votes:
            10 Vote for this issue
            Watchers:
            12 Start watching this issue

              Created:
              Updated: