Hello everyone, I'm experiencing an issue with a SAML2 integration and I’ve run out of ideas on what might be wrong. Setup I am using:
Apereo CAS 7.3.7 Acting as SAML Identity Provider (IdP) Behind HAProxy Integrating with Amazon Cognito as the Service Provider (SP) They provided the following configuration: Audience URI (EntityID): urn:amazon:cognito:sp:us-west-2_xxxxxxx Assertion Consumer Service (ACS) URL: https://xxx-xxxx.login.moodys.com/saml2/idpresponse Required SAML Attributes The SP requires the following attributes (case-sensitive): http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress → user email (required) http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname → first name (required) http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname → last name (required) http://schemas.xmlsoap.org/claims/Group → groups (recommended) corp_id → optional identifier Flow description The login flow is as follows: I open a login link provided by Cognito, I enter my email address Cognito redirects me to CAS for authentication I successfully authenticate in CAS After successful authentication, Cognito returns an error: "message": "An error occured during federate callback. Error: 'server_error', ErrorDescription: 'Invalid SAML response received: InResponseTo attribute in the SAML response does not match the ID that was sent with the SAML authentication request'" CAS logs warning I also see the following warning in CAS logs: WARN [org.opensaml.saml.common.binding.SAMLBindingSupport] - Relay state exceeds 80 bytes: [REDACTED - long encoded SAML state] CAS SAML service configuration { "@class": "org.apereo.cas.support.saml.services.SamlRegisteredService", "serviceId": "urn:amazon:cognito:sp:us-west-2_xxxxxxx", "name": "Moodys", "id": 33, "evaluationOrder": 33, "description": "Moody's SAML Integration", "metadataLocation": "file:/etc/cas/saml/sp-metadata/moodys.xml", "skipGeneratingSubjectConfirmationInResponseTo": true, "signAssertions": true, "signResponses": true, "encryptAssertions": false, "attributeReleasePolicy": { "@class": "org.apereo.cas.services.ReturnMappedAttributeReleasePolicy", "allowedAttributes": { "@class": "java.util.TreeMap", "email": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress";, "imie": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname";, "nazwisko": "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"; } } } At the beginning, the SP did not want to provide metadata. Instead, they asked whether I could simply configure the ACS URL directly in the CAS service definition. Later, they provided a metadata file generated using: https://www.samltool.com/sp_metadata.php <?xml version="1.0" encoding="UTF-8"?> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="urn:amazon:cognito:sp:us-west-2_xxxxxxx"> <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://xxxx-xxxx.login.moodys.com/saml2/idpresponse"; index="0" isDefault="true"/> </md:SPSSODescriptor> </md:EntityDescriptor> I’m running out of ideas what could be wrong. It seems that CAS successfully authenticates the user, but Cognito fails during the SAML callback with: InResponseTo attribute in the SAML response does not match the ID that was sent with the SAML authentication request Has anyone experienced a similar issue with CAS acting as IdP and Amazon Cognito as SP, especially in an IdP-initiated flow? Any hints would be greatly appreciated. I also have several other SAML integrations configured in CAS that work without any issues, so the CAS SAML setup in general is functional. -- - Website: https://apereo.github.io/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/2bc62562-c00b-4d09-ab9e-cab8185590can%40apereo.org.
