Decrypt the EncryptedID of a LogoutRequest - #1039
Open
christophdb wants to merge 1 commit into
Open
christophdb wants to merge 1 commit into
christophdb wants to merge 1 commit into
Conversation
A Shibboleth IdP encrypts the NameID of a front-channel LogoutRequest by default whenever the service provider publishes an encryption key in its metadata, so this is what a service provider in an identity federation receives. LogoutRequest left the EncryptedID alone: the parsed message carried no NameID, Saml2Client.handle_logout_request compared None with the NameID stored at login and answered UnknownPrincipal, "Wrong user", for the very user the IdP asked about. The IdP could not finish the logout. LogoutRequest now decrypts the EncryptedID with the configured encryption keys when it loads the message, the same way AuthnResponse handles an encrypted NameID in an assertion. If no key can decrypt it, the NameID stays empty and the behaviour is as before. Fixes IdentityPython#536
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #536.
A Shibboleth IdP encrypts the NameID of a front-channel LogoutRequest by default whenever the SP publishes an encryption key in its metadata (SAML2.Logout profile notes: "The default value of encryptNameIDs is also conditional on the same basis", i.e. on for the front channel). So this is what every SP in a Shibboleth-based federation receives:
LogoutRequestleft theEncryptedIDalone, somessage.name_idwasNone,Saml2Client.handle_logout_requestcompared that with the NameID stored at login and answeredUnknownPrincipal/ "Wrong user" for the very user the IdP asked about. The IdP shows an error and cannot finish the logout.LogoutRequest._loadsnow decrypts theEncryptedIDwith the configured encryption keys, the same wayAuthnResponse.get_subjecthandles an encrypted NameID in an assertion. If no key can decrypt it, the NameID stays empty and the behaviour is as before. Since this sits inLogoutRequest,Server.parse_logout_requestbenefits as well when a Shibboleth SP sends an encrypted NameID to a pysaml2 IdP.Verified against a production Shibboleth IdP (5.x): the logout that used to end in "Wrong user" now completes.