Background

Armeria provides a saml integration module, which allows users to easily set up a Service Provider.

The basic flow is as follows:

1. A SamlDecorator checks if a request is authenticated or not

• If it is already authenticated, then the request is served without an issue

  • armeria/saml/src/main/java/com/linecorp/armeria/server/saml/SamlDecorator.java

    Lines 109 to 117 in db3973d

    	return HttpResponse.of(authorizer.authorize(ctx, req).handle((result, cause) -> {
    	if (cause == null && result) {
    	// Already authenticated.
    	try {
    	return unwrap().serve(ctx, req);
    	} catch (Exception e) {
    	return Exceptions.throwUnsafely(e);
    	}
    	}

• If it is not authenticated, a SAML redirect or form is returned depending on the configuration

  • armeria/saml/src/main/java/com/linecorp/armeria/server/saml/SamlDecorator.java

    Lines 149 to 166 in db3973d

    	if (endpoint.bindingProtocol() == SamlBindingProtocol.HTTP_REDIRECT) {
    	return responseWithLocation(toRedirectionUrl(
    	arg.messageContext.getMessage(),
    	endpoint.toUriString(), SAML_REQUEST,
    	signingCredential, sp.signatureAlgorithm(),
    	relayState));
    	} else {
    	// signing can incur a blocking call
    	final String value = toSignedBase64(
    	arg.messageContext.getMessage(),
    	signingCredential,
    	sp.signatureAlgorithm());
    	final HttpData body = getSsoForm(endpoint.toUriString(),
    	SAML_REQUEST, value,
    	relayState);
    	return HttpResponse.of(HttpStatus.OK, MediaType.HTML_UTF_8,
    	body);
    	}

2. The user logs in to the Identity Provider
3. The Idp redirects the user to send a request to the SamlService

• The SAML assertion is validated for usage:

  • armeria/saml/src/main/java/com/linecorp/armeria/server/saml/SamlAssertionConsumerFunction.java

    Line 88 in db3973d

    public HttpResponse serve(ServiceRequestContext ctx, AggregatedHttpRequest req,

There is also an integration test which can be analyzed for this behavior:

ref: https://github.com/line/armeria/blob/main/saml/src/test/java/com/linecorp/armeria/server/saml/SamlServiceProviderTest.java

In terms of this issue

It can be difficult to debug why an assertion is not being processed correctly due to complex the inherent complexity of the SAML protocol.

I think for normal cases, deserializing SAML messages is not a big pain point since 1) the SAML library provides good enough logging, and 2) the SAML message format is relatively straightforward.

The bigger pain point is probably determining why a message refused to be processed. This would probably involve passing the parsed message in the following line:

Passes already parsed MessageContext to loginFailed

So in my opinion this suggestion by @imasahiro should be good enough for starters.

i.e.

return ssoHandler.loginFailed(ctx, req, messageContext, e);

Note that this is simply how I would handle this issue if I were assigned - please feel free to think of any alternative ways to let users more easily debug this issue

I'm looking this issue. 👀