Integrating python-saml with an ADFS IDP #180
Comments
|
If you read the error message of ADFS: so the AuthNRequest sent by python-saml is not signed... if you review your settings: you will need to turn it: and also provide x509 certificate and private key on the 'sp' settings section If you want to create self-signed certs, you can do it at the https://www.samltool.com/self_signed_certs.php service, or using the command: Remember to register SP's x509 certificate on the ADFS in order to let it validate the Signature of the AuthNRequest. In addition review what NameIDFormat and what requestedAuthnContext values ADFS expects, and be sure you configure them properly on python-saml (review the settings documentation) |
|
Hi, Also I have configured the certificates to use valid certs and not self signed. Also I put the sp certs in the sp.crt and sp.key files locally in the certs directory. Do you have any other suggestions that I can try? Thanks! |
|
Have you tried the signature algorithm? |
|
I tried sha-256 and that returns a |
|
Then this was the issue, a SAMLResponse with Status = Success is ok. Now let's try to figure out why the SAMLResponse is invalid...can you validate the SAMLResponse XML here: |
|
Line: 18 | Column: 0 --> Element '{http://www.w3.org/2000/09/xmldsig#}X509SerialNumber': '137159247534293833333515219826463830998' is not a valid value of the atomic type 'xs:integer'. |
|
This is the whole response |
|
I think I will neee to update the xsd file. Here is a related issue: Is related with the private key/public cert used at ADFS. |
|
It works...I had to change apply the same change to the xsd manually and it goes further. It still had issues with Issuer...and I had to turn off strict in python-saml. Can you apply the same change to python-saml as you did for the ruby-saml project at your earliest convenience? Thanks! |
|
Done 616f9fd |
Hi
I am recent user of python-saml and trying to get it integrated with an ADFS IDP and having a difficult time. Everything seems setup correctly on both sides with the URLS and certificates.
Even when all the signing options (authnRequestsSigned, wantMessagesSigned and wantAssertionsSigned) are set to false, I am getting a response from the IDP that the response is either:
The sign in request is not compliant to the WS-Federation language for web browser clients or the SAML 2.0 protocol WebSSO profile.
or
The verification of the SAML message signature failed.
Message issuer: https://dev.site.com/api/saml/metadata/
Exception details:
MSIS1016: Relying party trust 'https://dev.site.com/api/saml/metadata/' indicates that authentication requests sent by this relying party will be signed but no signature present.
My advanced_settings are
{
"security": {
"nameIdEncrypted": false,
"authnRequestsSigned": false,
"logoutRequestSigned": false,
"logoutResponseSigned": false,
"signMetadata": false,
"wantMessagesSigned": false,
"wantAssertionsSigned": false,
"wantNameId" : true,
"wantNameIdEncrypted": false,
"wantAssertionsEncrypted": false,
"signatureAlgorithm": "http://www.w3.org/2000/09/xmldsig#rsa-sha1"
},
"contactPerson": {
"technical": {
"givenName": "Site Admin",
"emailAddress": "info@site.com"
},
"support": {
"givenName": "Site Support",
"emailAddress": "support@site.com"
}
},
"organization": {
"en-US": {
"name": "Site",
"displayname": "Site",
"url": "https://site.com"
}
}
}
I did try the lowercase urlencoding option which didnt make a difference. Anybody have experience with integrating python-saml with with ADFS?
Thanks!
The text was updated successfully, but these errors were encountered: