Skip to main content

SAML2 Toolkit - WSO2 Identity Server 5.0

When you try to configure SAML2 based Web SSO, did you ever hoped is there an easy way to identify what you have missed or did wrong in either in the Identity Provider (IdP) side or Service Provider (SP) side? Then you should try the SAML Toolkit feature which comes with WSO2 Identity Server 5.0.0.

This toolkit consists of two modules,
  • SAML2 Request Validator - user can validate SP initiated SAML2 AuthnRequest
  • SAML2 Response Builder - user can generate SAML2 response for a selected SAML2 Web SSO configuration

Lets try this tool,

First you need to download the WSO2 Identity Server 5.0.0 and follow the "Getting Started" section to run the product. If you have followed the instructions correctly you should be able to access the server using the URL https://localhost:9443/carbon.

Once you have logged to the server, you can find the required tools under Main > Tools > SAML.  

Figure 1: SAML Toolkit Section

SAML Request Validator

Once you clicked the "SAML Request Validator" link, following view will appear,

Figure 2: SAML2 Request Validator UI




Before starting the validation it is required to specify request binding which SP has initiated. This may be either HTTP POST or HTTP Redirect. You can specify this in your SP side configuration.

Then you have to provide the SAML2 Request. For HTTP POST binding you can extract the request using a Firefox add-on like SAML Tracer or using inbuilt developer tools in most of the web browsers. Both cases you can find the SAML Request as "SAMLRequest=IZfhfReBEadHHLl...." inside the form data. So copy and paste only the encoded request (without "SAMLRequest=" part) to the given text area.

If the used binding is HTTP Redirect, you can also get the SAML Request from the developer tools. But here you have to copy the URL instead of encoded request. This is required because parameters like  "SigAlg" and "Signature" which are used in the validation are also included in the URL. The URL should have a similar format to
"https://localhost:9443/samlsso?SAMLRequest=jZLRjqowEIZfhfReBEXRR...".

As the Issuer can be extracted from the SAML request there is no need to specify SAML Web SSO configuration which is required to do the validation. Toolkit will automatically select the appropriate configuration using the issuer value.

Finally use "Validate" button to get the validation results. Results will be displayed as steps indicating the request has passed or failed that specific step,

Figure 3: Results After Validation


Using this information user can identify the exact place he need look in the configuration and fix it using the expected value.


SAML Response Builder

Clicking on the "SAML Response Builder" in Figure 1 will give you the following view,

Figure 4: SAML Response Builder View

This feature allows you to build a valid response against a selected SAML2 Web SSO configuration. All the Issuers which are available in configurations listed here in the Issuer drop down. So you can select the required configuration by selecting the Issuer. User name also required to get the user profile which will be used during the response generation.

When you click the "Generate" button, Response Builder will generate the response using provided data and display it in both XML and in encoded format as follows.


The user can verify the configuration from the returned response, by looking at the XML. Also some web sites like Salesforce provides the facility to validate the encoded response against SP configuration. So you can use the returned encoded response there to identify the issues in configuration. By using the information provided by this tool user can modify the configuration in Idp side or SP side accordingly to get the desired result.


Labels:

Comments

Post a Comment

Popular posts from this blog

UUID Generation with WSO2 ESB

There are use cases which we need to generate a UUID( universally unique identifier ) from the WSO2 ESB server for the back end services. There are two commonly used UUID types, Version 1 UUID or Time UUID A Version 1 UUID use a scheme relying only on timestamp and the MAC address of the computer on which it is generated Version 4 UUID Version 4 UUIDs use a scheme relying only on random numbers Getting a version 4 UUID is really easy in ESB, since we already have one in the message flow. So we can extract it like follows, <property name="MessageID" expression="fn:substring-after(get-property('MessageID'), 'urn:uuid:')"/> But in case of version 1 UUID or Time UUID, we have to use script mediator or class mediator to generate a UUID . Script mediator is slower compared to the class mediator.  A simple class mediator which can use for version 1 UUID generation can be found here . This class mediator uses this library to gene...
Post a Comment
Read more

SAML2 IdP Initiated Single Logout with WSO2 Identity Server 5.1.0

With this feature WSO2 Identity Server facilitates IdP initiated SAML2 single log out requests. In the SAML service provider configuration UI here is a new configuration called “Enable IdP Initiated SLO”. You can enable this feature using this checkbox. Also you can define redirect URL after the single log out using "Return to URL" under “Enable IdP Initiated SLO” option. Following parameters can be used with IdP initiated SLO request. Parameter Description slo This is a mandatory parameter and must have the value “true” to mark the request as an IdP initiated log out request. spEntityID This is an optional parameter. Value of the parameter should be the SAML issuer name as in “Issuer” field in the SAML service provider configuration UI. returnTo This is an optional parameter. Value of the parameter should be the URL which needs to be redirected to, after the log out. If this parameter is present ...
Post a Comment
Read more

How to extract and import certificate from a SAML SP metadata file to a Keystore

Extract certificate from the SAML service provider metadata file as follows, <X509Data> <X509Certificate> MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UE CAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxv Y2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQsw CQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UE AwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTou sMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5 HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQID AQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44i QlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJR O4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo= </X509Certificate> </X509Data> Copy extracted certificate to ...
Post a Comment
Read more