Re: [cas-user] SAML delegated authN in CAS 6.6.x, SLO has no signature element to external IDP?
Figured out! cas.authn.pac4j.saml[0].signServiceProviderLogoutRequest=true I was looking for signature element in XML SAML Response. actually, with delegated authN to Okta, the signature is not in XML, it is a parameter in GET request, along with SAMLRequest parameter. What got me there is that I thought about CAS delegated authN to Okta has been working, how did that carry signature, and I also saw the property. Thx! On Monday, September 11, 2023 at 1:44:33 PM UTC-4 Yan Zhou wrote: > HI, > > Looks like CAS already performed logout (TGC cookie is already removed) > before it redirect to Okta doing Logout, but it does not have a signature > element in Logout request sent to Okta. > > Would that be a problem, even if Okta would recognize and log user out, it > will redirect back to CAS, now that SSO session is already destroyed, CAS > would not know how to handle Okta response. I did see this message in Log, > but it is not marked as error: Can not evaluate delegated authentication > policy without a service > > Yan > > 2023-09-11 13:12:17,154 DEBUG [https-jsse-nio-8443-exec-7] > [org.apereo.cas.web.flow.actions.DelegatedAuthenticationClientFinishLogoutAction] > > - callbackUrl: https://localhost:8443/cas/login | urlResolver: > org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: > org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | > ajaxRequestResolver: > org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | > redirectionActionBuilder: > org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | > credentialsExtractor: > org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | > authenticator: > org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | > profileCreator: > org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | > logoutActionBuilder: > org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | > authorizationGenerators: [] | checkAuthenticationAttempt: true |]> > 2023-09-11 13:12:17,154 DEBUG [https-jsse-nio-8443-exec-7] > [org.apereo.cas.web.flow.actions.DelegatedAuthenticationClientFinishLogoutAction] > > - http://localhost:8081/saml/logout?SAMLResponse=pZI%2Fb8IwEMX3forI...bELxwQ%3D%3D > ]> > 2023-09-11 13:12:18,950 INFO [scheduling-1] > [org.apereo.cas.services.AbstractServicesManager] - from [JsonServiceRegistry].> > 2023-09-11 13:12:19,887 INFO [https-jsse-nio-8443-exec-3] [Spring Security > Debugger] - < > > > > Request received for POST '/login?client_name=bootsp2=true': > .. > > > > > > 2023-09-11 13:12:19,888 DEBUG [https-jsse-nio-8443-exec-3] > [org.apereo.cas.web.flow.CasFlowHandlerMapping] - [FlowHandlerMapping.DefaultFlowHandler@1f480c09]> > 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] > [org.apereo.cas.support.pac4j.authentication.clients.RefreshableDelegatedClients] > > - callbackUrl: https://localhost:8443/cas/login | urlResolver: > org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: > org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | > ajaxRequestResolver: > org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | > redirectionActionBuilder: > org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | > credentialsExtractor: > org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | > authenticator: > org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | > profileCreator: > org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | > logoutActionBuilder: > org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | > authorizationGenerators: [] | checkAuthenticationAttempt: true |]]> > 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] > [org.pac4j.core.client.Clients] - bootsp2 | callbackUrl: https://localhost:8443/cas/login | urlResolver: > org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: > org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | > ajaxRequestResolver: > org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | > redirectionActionBuilder: > org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | > credentialsExtractor: > org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | > authenticator: > org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | > profileCreator: > org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | > logoutActionBuilder: > org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | > authorizationGenerators: [] | checkAuthenticationAttempt: true | for name: > bootsp2> > 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] >
Re: [cas-user] SAML delegated authN in CAS 6.6.x, SLO has no signature element to external IDP?
HI, Looks like CAS already performed logout (TGC cookie is already removed) before it redirect to Okta doing Logout, but it does not have a signature element in Logout request sent to Okta. Would that be a problem, even if Okta would recognize and log user out, it will redirect back to CAS, now that SSO session is already destroyed, CAS would not know how to handle Okta response. I did see this message in Log, but it is not marked as error: Can not evaluate delegated authentication policy without a service Yan 2023-09-11 13:12:17,154 DEBUG [https-jsse-nio-8443-exec-7] [org.apereo.cas.web.flow.actions.DelegatedAuthenticationClientFinishLogoutAction] - https://localhost:8443/cas/login | urlResolver: org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | ajaxRequestResolver: org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | redirectionActionBuilder: org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | credentialsExtractor: org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | authenticator: org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | profileCreator: org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | logoutActionBuilder: org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | authorizationGenerators: [] | checkAuthenticationAttempt: true |]> 2023-09-11 13:12:17,154 DEBUG [https-jsse-nio-8443-exec-7] [org.apereo.cas.web.flow.actions.DelegatedAuthenticationClientFinishLogoutAction] - http://localhost:8081/saml/logout?SAMLResponse=pZI%2Fb8IwEMX3forI...bELxwQ%3D%3D]> 2023-09-11 13:12:18,950 INFO [scheduling-1] [org.apereo.cas.services.AbstractServicesManager] - 2023-09-11 13:12:19,887 INFO [https-jsse-nio-8443-exec-3] [Spring Security Debugger] - < Request received for POST '/login?client_name=bootsp2=true': .. > 2023-09-11 13:12:19,888 DEBUG [https-jsse-nio-8443-exec-3] [org.apereo.cas.web.flow.CasFlowHandlerMapping] - 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] [org.apereo.cas.support.pac4j.authentication.clients.RefreshableDelegatedClients] - https://localhost:8443/cas/login | urlResolver: org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | ajaxRequestResolver: org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | redirectionActionBuilder: org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | credentialsExtractor: org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | authenticator: org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | profileCreator: org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | logoutActionBuilder: org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | authorizationGenerators: [] | checkAuthenticationAttempt: true |]]> 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] [org.pac4j.core.client.Clients] - https://localhost:8443/cas/login | urlResolver: org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | ajaxRequestResolver: org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | redirectionActionBuilder: org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | credentialsExtractor: org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | authenticator: org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | profileCreator: org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | logoutActionBuilder: org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 | authorizationGenerators: [] | checkAuthenticationAttempt: true | for name: bootsp2> 2023-09-11 13:12:19,890 DEBUG [https-jsse-nio-8443-exec-3] [org.apereo.cas.web.flow.actions.DelegatedClientAuthenticationAction] - https://localhost:8443/cas/login | urlResolver: org.pac4j.core.http.url.DefaultUrlResolver@47cf3a3b | callbackUrlResolver: org.pac4j.core.http.callback.QueryParameterCallbackUrlResolver@c83ed77 | ajaxRequestResolver: org.pac4j.core.http.ajax.DefaultAjaxRequestResolver@69099dc8 | redirectionActionBuilder: org.pac4j.saml.redirect.SAML2RedirectionActionBuilder@23a7d2b8 | credentialsExtractor: org.pac4j.saml.credentials.extractor.SAML2CredentialsExtractor@40492ade | authenticator: org.pac4j.saml.credentials.authenticator.SAML2Authenticator@7ee9de0e | profileCreator: org.pac4j.core.profile.creator.AuthenticatorProfileCreator@d271a54 | logoutActionBuilder: org.pac4j.saml.logout.SAML2LogoutActionBuilder@5b2bfbc6 |
Re: [cas-user] SAML delegated authN in CAS 6.6.x, SLO has no signature element to external IDP?
Yan, It is a wise idea to sign logout requests. This prevents a bad actor from creating false logouts. 'Validate SAML requests with signature ... ' is for the log in request. When your client app sends a logout request to cas, does cas (as IdP) end its session with the client? Ray On Fri, 2023-09-08 at 13:18 -0700, Yan Zhou wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. Hi, I have almost completed SAML delegated authN with CAS and Okta, CAS delegates to Okta, except for SLO. When client app initiates SLO, it goes to CAS, CAS redirects to Okta, but Okta says "invalid signature", the SAML Logout request from CAS has no signature element. See below. I verified Okta setting, Nowhere says it requires signature in Logout Request, regardless, I cannot figure out how to get CAS to sign SLO request when in delgated authN. this setting made no difference even when set. cas.authn.pac4j.saml[0].signServiceProviderLogoutRequest=true This is the SLO from CAS to Okta, no signature element, I suppose that is why Okta says "Invalid Signature", but I do not know how to get Okta turn off checking, In Okta, "Validate SAML requests with signature certificates" is OFF. Ideas? thanks in advance Yan https://dev-...okta.com/app/dev-11p_1/ex..7/slo/saml"ID="_2701..ca870e07705"IssueInstant="2023-09-08T20:09:28.830Z"Version="2.0; >https://localhost:8443/cas/samlspyan...com_4ba2..3a4b0 -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+unsubscr...@apereo.org. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/96ad7e3b201c00516e3a0f217d79facdfa4e0109.camel%40uvic.ca.
