Add support for Signed AuthnRequests using the HTTP-POST Binding. #206
Comments
richardTowers
added a commit
to richardTowers/passport-saml
that referenced
this issue
May 3, 2017
…T Binding This commit adds support for signing AuthnRequests in the SAML HTTP-POST binding. In the POST Binding the signature sits inside the SAML message (as opposed to the Redirect binding, where the signture lives in the URL's query string). This will help suppport identity providers that require signed AuthnRequests over the HTTP-POST binding. Two new configuration options have been added: * `digestAlgorithm`: allows you to specify the digest algorithm for the signature. * `xmlSignatureTransforms`: allows you to configure which XML transforms to use.
|
Raised PR #207 to address signing of HTTP-POST AuthnRequests. Let me know if it needs any more work. |
|
HI, Thanks, |
|
@richardTowers @markstos We've come across this issue recently - has there been a consensus on the best approach? |
richardTowers
added a commit
to richardTowers/passport-saml
that referenced
this issue
Jan 16, 2020
…T Binding This commit adds support for signing AuthnRequests in the SAML HTTP-POST binding. In the POST Binding the signature sits inside the SAML message (as opposed to the Redirect binding, where the signture lives in the URL's query string). This will help suppport identity providers that require signed AuthnRequests over the HTTP-POST binding. Two new configuration options have been added: * `digestAlgorithm`: allows you to specify the digest algorithm for the signature. * `xmlSignatureTransforms`: allows you to configure which XML transforms to use.
|
Updating here to say that PR #207 was just rebased against master by @richardTowers, had a change to improve spec compliance, and was successfully tested against my company's PingFederate server. |
markstos
pushed a commit
that referenced
this issue
Jan 20, 2020
…#207) * Issue #206: Support signing AuthnRequests using the HTTP-POST Binding This commit adds support for signing AuthnRequests in the SAML HTTP-POST binding. In the POST Binding the signature sits inside the SAML message (as opposed to the Redirect binding, where the signture lives in the URL's query string). This will help suppport identity providers that require signed AuthnRequests over the HTTP-POST binding. Two new configuration options have been added: * `digestAlgorithm`: allows you to specify the digest algorithm for the signature. * `xmlSignatureTransforms`: allows you to configure which XML transforms to use. * Provide a clearer description of digestAlgorithm It's not exactly easy to explain XMLDSIG in a single bullet point in a readme, so I think this is necessarily going to be a bit confusing. * Place the Signature immediately after the Issuer
|
I believe this is addressed by #207, so closing. |
|
A new release of passport-saml today includes this change. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hello, I'm a developer for the UK's Government Digital Service. I work on the GOV.UK Verify product, which is a reasonably complex SAML federation.
GOV.UK Verify uses the SAML HTTP-POST binding, and mandates that AuthnRequests are signed.
At the moment it looks like passport-saml does not sign HTTP-POST AuthnRequests. The signing process is a little different from the HTTP-Redirect binding (the signature lives in the XML, rather than the URL), but it's supported by XML Crypto, so it shouldn't be too difficult to add.
If this feature is something you'd accept a Pull Request for we'd be very keen to contribute. I've made a start in my fork.
Most of all: thanks to all the contributors of passport-saml so far - having good open source implementations of infrastructure like this is fantastic 💯 .
The text was updated successfully, but these errors were encountered: