single sign on - SAML / is RelayState required for signed logout request? -


i wish confirm relaystate required valid signed saml logout request.

we have federated microsoft's adfs 2012 r2 oracle's identity federation adfs sp , oif idp. basis, followed integrating adfs 2.0/3.0 sp oif idp.

everything works, except logout. have sp doing logout , working oif. 1 difference we've found adfs not sending relaystate parameter signed logout request, other sp is. i've been using samltool's validate logout req, input following:

  • saml logout request
  • entityid of source
  • target url, destination of logout request
  • sigalg
  • signature of saml logout request
  • x.509 cert of source (to check signature)
  • ignore timing issues: checked

that gives me error:

in order check signature must provide relaystate parameter , x.509 cert

if input relaystate along other values in samltool's validate logout req reports signed logout request valid.

in case of adfs, because not have relaystate parameter, cannnot samltool's validate logout req logout adfs valid.

all said, cannot find anywhere in saml spec says relaystate required signed logout request. can confirm required , documentation?

the logoutrequest message not have reference relaystate parameter (as other post suggests) part of so-called binding used convey messages between saml parties. assuming logout uses http-redirect, http-post or artifact binding, spec allows sender include relaystate parameter , receiver must return same relaystate parameter part of response (as way sender keep state).

see section 3.4.3 relaystate of saml bindings document: https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf http-redirect binding:

3.4.3 relaystate

relaystate data may included saml protocol message transmitted binding. value must not exceed 80 bytes in length , should integrity protected entity creating message independent of other protections may or may not exist during message transmission. signing not realistic given space limitation, because value exposed third-party tampering, entity should ensure value has not been tampered using checksum, pseudo-random value, or similar means. if saml request message accompanied relaystate data, saml responder must return saml protocol response using binding supports relaystate mechanism, , must place exact data received request corresponding relaystate parameter in response. if no such value included saml request message, or if saml response message being generated without corresponding request, saml responder may include relaystate data interpreted recipient based on use of profile or prior agreement between parties

for other bindings similar section exists. @nzpcmad says: it's not mandatory include in request.


Comments

Post a Comment

Popular posts from this blog

java - pagination of xlsx file to XSSFworkbook using apache POI -

right in code, reading xlsx file, xssfworkbook, , writing database. but, when size of xlsx file increases, causes outofmemory error. can not increase server size, or divide xlsx file pieces. tried loading workbook using file (instead of inputstream), didn't either. i looking way read 10k rows @ time (instead of entire file @ once) , iteratively write workbook , database. is there way apache poi? poi contains called "eventmodel" designed purpose. it's mentioned in faq : the ss eventmodel package api reading excel files without loading whole spreadsheet memory. require more knowledge on part of user, reduces memory consumption more tenfold. based on awt event model in combination sax. if need read-only access, best way it. however, may want double check first if issue somewhere else. check out this item : i think poi using memory! can do? 1 comes quite lot, reason isn't might think. so, first thing check - what's source of prob...
Read more

Unlimited choices in BASH case statement -

consider simple bash snippet: case $option in 1) image=${options[0]%.tar} ;; 2) image=${options[1]%.tar} ;; 3) image=${options[2]%.tar} ;; 4) image=${options[3]%.tar} ;; *) echo "invalid option" exit 1 esac in real script numbers goes 30. makes pretty long. can somehow specify cases variable? something this: case $option in $i) image=${options[$(($i-1))]%.tar} any pointer appreciated. you can match against multiple patterns in single clause: case $option in 1|2|3: echo "$option one, 2 or three" ;; esac if still typing you, can use simple pattern matching: case $option in # following matches # - single-digit numbers 0-9 # - two-digit numbers starting either 1 or 2 # - number 30 [0-9]|[12][0-9]|30) image=${options[$(($option-1))]%.tar} ;; *) echo "invalid option" 1>&2 exit 1 esac
Read more

apache - How do I stop my index.php being run twice for every user -

we've got webapp initial html served using apache , php. i noticed index.php being run twice every request. seems caused / effected rewrite rules in our .htaccess - rewritecond %{http_host} ^(www\.|hotels\.)ourdomain\.com$ [nc,or] rewritecond %{server_name} ^(www\.|hotels\.)ourdomain\.com$ [nc] rewriterule (.*) http://ourdomain.com/$1 [r=301] rewriterule ^hotels/([^/]+)/?\??(.*)$ ?d=$1&$2 [qsa] the final rule moving parameter url path query string. i.e. http://ourdomain.com/hotels/vegas?someparam=1 becomes http://ourdomain.com?d=vegas&someparam=1 if go directly query string version index.php run once. if use url redirected, index.php run twice (i'm checking adding error_log('end of index.php') file). so example going http://ourdomain.com/hotels/paris hits file twice http://ourdomain.com?d=paris hits once. i've seen this question , had @ blog mentioned , , can't find empty string url's (i've tried using yslow process). ...
Read more