I've been trying to configure WSO2is to accept a SAML auth request from Spring Security and pass it along to an external IDP for authentication. I've configured the SP and IDP on WSO2 correctly enough to have my request be redirected to SSOCircle, but when Circle sends the SAML response back to WSO2 it gives a "Not a valid SAML 2.0 Request Message!" error page. Which this makes sense as it's not a request being sent to the server.
I think my problem revolves around the AssertionConsumerService in the metadata I've uploaded to Circle "https://MyLocalHost:8080/samlsso" which is the url for the Resident Identity Provider. I've been hunting around different end point to use for, but have not been find anything.
The closest I've been able to get was following the example here https://docs.wso2.com/display/IS500/Configuring+Single+Sign-On+with+SAML+2.0 but this appears to be used for just logging into the WSO2 server itself.
EDIT after changing the endpoint to commonauth
Here are the logs after the request lands on the server.
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - SAMLSSOAuthenticator returned: INCOMPLETE {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler} - SAMLSSOAuthenticator is redirecting {org.wso2.carbon.identity.application.authentication.framework.handler.step.impl.DefaultStepHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler} - Step is not complete yet. Redirecting to outside. {org.wso2.carbon.identity.application.authentication.framework.handler.sequence.impl.DefaultStepBasedSequenceHandler}
DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Session data key is null in the request {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
Related
I have using wso2 IS with another configured identity provider like: google,yahoo.
when i logged form IDP and redirect back to callback URL my application
call /outh2/token API to fetch id_token base on authorization_code but the problem is not getting remote claim (IDP custom claim attribute) which i have configured in service provider mapping.I have facing this issues randomly not for all user.
Success claims Log:TID: [-1234] [] [2018-04-24 07:25:03,300] DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} - Returning claims from claim handler = [middle_name:M,given_name:abc,family_name:xyz,email:abc.xyz#domain.com,]
Failure claims Log: 07:32:19,062] DEBUG {org.wso2.carbon.identity.application.authentication.framework.handler.claims.impl.DefaultClaimHandler} - Returning claims from claim handler = []
Seems like you are facing the issue mentioned in [1]. This issue is fixed in master branch and also the fix is available as wum update for IS-5.4.0 and IS-5.5.0. You can either try the latest milestone of WSO2 Identity Server or get a wum updated pack of IS 5.4.0 or IS 5.5.0.
[1] https://github.com/wso2/carbon-identity-framework/issues/1494
I am trying to use wso2 SSO. I have set the SP in carbon and set the assertion url like this
Here assertion url is like this http://example.com/acs. Now when trying to login on the SSO login screen i keep getting the below message
TID: [-1234] [] [2017-10-31 20:14:14,381] ERROR
{org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor}
- ALERT: Invalid Assertion Consumer URL value 'http://example.com/simplesaml/module.php/saml/sp/saml2-acs.php/default-sp'
in the AuthnRequest message from the issuer 'simplesaml1'. Possibly
an attempt for a spoofing attack
Here example.com is same as the domain i used in the image. I have used example.com only because stackoverflow doesnt let me add that domain name.
Can anyone kindly let me know from where wso2 keep reading that url. Its not in metadata also. Also why that url is invalid? Any help will be appreciated.
This complaint is about that the assertion consumer URL of the SAML request is different from the provided URL of the Identity Server. Please check the assertion consumer URL of the SAML request from the service provider.
I have a WSO2 Identity Server installed (SP1 included) and I was doing some integration tests with Liferay. I was able to do saml sso login without any problem (with included attributes), but then I installed the critical patch 1256 and it doesn't let me to sign on anymore.
Here's what the log says:
TID: [0] [IS] [2015-05-28 12:16:22,774] ERROR {org.wso2.carbon.identity.sso.saml.builders.assertion.DefaultSAMLAssertionBuilder} - Error when reading claim values for generating SAML Response {org.wso2.carbon.identity.sso.saml.builders.assertion.DefaultSAMLAssertionBuilder}
TID: [0] [IS] [2015-05-28 12:16:22,775] ERROR {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} - Error processing the authentication request {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor}org.wso2.carbon.identity.base.IdentityException: Error while building the saml assertion
I was trying to figure out what could change between patches. When I delete all requested claims or deactivate the option " Include Attributes in the Response Always" it has no problem at all, but it doesn't work for me that way.
Thanks in advance
Did you change the Subject Claim URI? By default it is not select... If this can be an bug in WSO2IS with above patch. I also see this error when i selecte the email address as the Subject Claim URI. There is public jira as well.
I have configured the sample travelocity.com webapp to work with saml2 SSO following link configure SSO web app
But when i try to login using account i get following error message on browser
Here is what i get in logs:
TID: [0] [IS] [2015-03-10 21:06:26,835] WARN {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor} - Signature validation for Authentication Request failed. {org.wso2.carbon.identity.sso.saml.processors.SPInitSSOAuthnRequestProcessor}
After again i tried without restart of server i got this error:
TID: [0] [IS] [2015-03-10 20:30:51,261] ERROR {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator} - Context does not exist. Probably due to invalidated cache {org.wso2.carbon.identity.application.authentication.framework.handler.request.impl.DefaultRequestCoordinator}
I am not sure what is wrong. I have also installed latest service pack . I am using wso2is-5.0.0
Please help.
This same web application is working fine with WSO2IS. I have already tried out it..Details can be found from here as well
According to the error, it says Signature validation for Authentication Request failed it means that SAML2 Auth request that is sent by Web application has been signed and WSO2IS tries to validate the signature of it. WSO2IS does not validate the signature by default, you may have probably tick on following configuration in the SAML2 SSO configuration.
Enable Signature Validation in Authentication Requests and Logout Requests
Please verify it and un-tick it and see.
If you want to really validate the signature of SAML2 Auth requests, you need to tick it. Then you must chose the proper Certificate Alias value from the combo box. Please note proper value is NOT the wso2carbon.cert. Proper value is wso2carbon. Then it would work for you.
Second error may be related to browser cache, just clear the browser cache and try out.. (or open new browser)
Most probably this is a mismatch in the keystores.
Just copy
$WSO2IS/repository/resources/security/keystore.jks
To
$TOMCAT/saml2-web-app-pickup-dispatch.com/WEB-INF/classes
This way, both keystores are the same. Restart Tomcat and it should work fine.
I am unable to implement Multifactor Authentication .
The error i am getting is
TID: [0] [WSO2 Identity Server] [2012-10-30 10:31:38,620] ERROR {org.wso2.carbon.identity.provider.xmpp.MPAuthenticationProvider} - login failed. Trying again.. {org.wso2.carbon.identity.provider.xmpp.MPAuthenticationProvider}
SASL authentication failed:
at org.jivesoftware.smack.SASLAuthentication.authenticate (SASLAuthentication.java:209)
at org.jivesoftware.smack.XMPPConnection.login(XMPPConnection.java:341)
at org.jivesoftware.smack.XMPPConnection.login(XMPPConnection.java:301)
This is for wso2 Identity Server 3.2.3 . Straight out of the box. No additional configuration performed to run this instance of Identity Server.
It appears that signing in as admin , the ldap authentication is completed and then authentication with gtalk is attempted when the error occurs.
Should I be setting my own configuration in the identity.xml where gtalk is being set?
<MultifactorAuthentication>
<XMPPSettings>
<XMPPConfig>
<XMPPProvider>gtalk</XMPPProvider>
<XMPPServer>talk.google.com</XMPPServer>
<XMPPPort>5222</XMPPPort>
<XMPPExt>gmail.com</XMPPExt>
<XMPPUserName>multifactor1#gmail.com</XMPPUserName>
<XMPPPassword>wso2carbon</XMPPPassword>
</XMPPConfig>
</XMPPSettings>
</MultifactorAuthentication>
I found out that I do need to set up a Google talk account.
I added the new settings to the MultifactorAuthentication configuration.
I restarted the server.
I edited the user account with another new Google talk account.
I logged out.
Logged back in via relyingparty URL with openid,
received communication over gtalk requesting pin.
I entered the pin and got logged in.
It would have been nice if wso2 had I their documentation the need to setup the settings for this configuration to get multifactor authentication to work out of the box.