如何使用Influtive为SSO实施SAML？

Question

I am trying to implement SSO via SAML for my Influitive hub. I have followed their documentation here and have set up my environment per their specifications. I have the fingerprint of my cert as well as an endpoint to handle their SAMLRequest's via the QueryString.

I am using the Web Browser SSO use case outlined here .

For forming my SAML Response, I followed the examples here .

I also followed this example for generating a certificate, as well as generating and then signing my SAML Response. However, in my efforts to fix my implementation, I altered the signing method to be SHA1.

For submitting my form, I bound values from my codebehind to an HTML form that POSTed, essentially, this:

  <form method="post" action="https://{myhub}.influitive.com/saml/consume" />
    <input type="hidden" name="SAMLResponse" value="{Base64EncodedStringofSAMLResponse}" />
    <input type="hidden" name="RelayState" value="https://{myhub}.influitive.com/about" />
</form>

<script>
    if ("{Base64EncodedStringofSAMLResponse}" != "") {
        window.onload = function () {
            document.forms[0].submit();
        }
    }
</script>

The problem is whenever my form POSTs, I keep getting 500 Internal Server error, even though my SAML Response is formed, signed, and encoded properly. How do I fix this?

Answer 1

The problem is actually from an unnecessary "Issuer" tag in my SAML Response.

I included two of them based on examples I found online. I took out the first instance of the Issuer tag but left the second instance, inside the Assertion tag, and it worked. Influitive support looked up the logs for my hub and sent me an error message saying approximately this.

Here is an example of the correctly formed, signed SAML Response.

<samlp:Response 
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" 
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" 
xmlns:xs="http://www.w3.org/2001/XMLSchema" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
Destination="https://{YOURHUB}.influitive.com/saml/consume" 
ID="{A GUID}" 
IssueInstant="{CURRENT UTC TIME}" 
Version="2.0" 
InResponseTo="{ID of Influitive SAMLRequest, or leave blank for IdP initiated SSO}">
<Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
    <SignedInfo>
        <CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315" />
        <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <Reference URI="#_f44dfe01e93143d7b1e1b9e826ace708">
            <Transforms>
                <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>{The DigestValue}</DigestValue>
        </Reference>
    </SignedInfo>
    <SignatureValue>{The SignatureValue}<SignatureValue>
    <KeyInfo>
        <X509Data>
            <X509Certificate>{The X509Cert}</X509Certificate>
        </X509Data>
    </KeyInfo>
</Signature>
<samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</samlp:Status>
<saml:Assertion 
    ID="{A SECOND GUID}" 
    IssueInstant="{CURRENT UTC TIME}" 
    Version="2.0">
    <saml:Issuer>{Name of the Issuer. Shouldn't really matter}</saml:Issuer>
    <saml:Subject>
        <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" NameQualifier="Influitive-AdvocateHub">example@gmail.com</saml:NameID>
        <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml:SubjectConfirmationData NotOnOrAfter="{CURRENT UTC TIME + 1 MINUTE}" Recipient="https://{YOURHUB}.influitive.com/saml/consume" InResponseTo="{ID of Influitive SAMLRequest, or leave blank for IdP initiated SSO}" />
        </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Conditions NotBefore="{CURRENT UTC TIME}" NotOnOrAfter="{CURRENT UTC TIME + 1 MINUTE}">
        <saml:AudienceRestriction>
            <saml:Audience>Influitive-AdvocateHub</saml:Audience>
        </saml:AudienceRestriction>
    </saml:Conditions>
    <saml:AuthnStatement AuthnInstant="{CURRENT UTC TIME}">
        <saml:AuthnContext>
            <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
        </saml:AuthnContext>
    </saml:AuthnStatement>
    <saml:AttributeStatement>
        <saml:Attribute Name="FirstName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml:AttributeValue xsi:type="xs:string">{SOME FIRST NAME}</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="LastName" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml:AttributeValue xsi:type="xs:string">{SOME LAST NAME}</saml:AttributeValue>
        </saml:Attribute>
        <saml:Attribute Name="Email" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml:AttributeValue xsi:type="xs:string">{example@gmail.com}</saml:AttributeValue>
        </saml:Attribute>
    </saml:AttributeStatement>
</saml:Assertion>

If you have any more questions about how to generate this SAML Response, how to sign it with a cert, or encode or ANYTHING, please let me know! This was a huge PITA and I would relish the opportunity to help anyone else with this.