2

I'm attempting to implement SSO for a salesforce sandbox Community instance with a custom Rails app as the IdP, and no matter how I format the SAML Assertion after login I'm redirected to the error page with no error code in the URL.

On the SAML Validator page I get:

11. Validating the Signature
  Is the response signed? false
  Is the assertion signed? true
  The reference in the assertion signature is valid
  Is the correct certificate supplied in the keyinfo? true
  Signature or certificate problems
  The signature in the assertion is not valid

Everything else is green, and the subject is found via the FederationID.

I'm using this gem (customized to fit the SAML examples from the Salesforce Single Sign On docs as closely as possible) and its default certificate and secret key:

https://github.com/lawrencepit/ruby-saml-idp

You can see how it's doing the signing here on line 88:

https://github.com/lawrencepit/ruby-saml-idp/blob/master/lib/saml_idp/controller.rb

...the algorithm used is SHA1.

Any idea what might be causing the incorrect signature error?

An example SAML response is below:

<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" ID="_9f7f2f60-881a-0134-5879-14109fe1c093" Version="2.0" IssueInstant="2016-11-08T19:51:11Z" Destination="https://full-[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified">
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://2f5fdc55.ngrok.io/saml/auth</Issuer>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
  </samlp:Status>
  <Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_9f7f3050-881a-0134-5879-14109fe1c093" IssueInstant="2016-11-08T19:51:11Z" Version="2.0">
    <Issuer>http://2f5fdc55.ngrok.io/saml/auth</Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <ds:Reference URI="#_9f7f3050-881a-0134-5879-14109fe1c093">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
          </ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
          <ds:DigestValue>nMivGNZKL8W+5/Mec9racVJWMgA=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>S405EwCezDM4mo672fd+dJNOGRoHPZ5CmyfDF00AuUA0Bp7nDkphdqaDsfwc+bJksp6PjEmYz7pdQtaUSky38FulGz6JphsSPrQiTV+qFhrsjmPqsUHp6ni3+QVdgrUlAHTSqP+S+j4Wzdd9oKG8dNFXQfBcT3sdGjWq/diDjfw=</ds:SignatureValue>
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURxekNDQXhTZ0F3SUJBZ0lCQVRBTkJna3Foa2lHOXcwQkFRc0ZBRENCaGpFTE1Ba0dBMVVFQmhNQ1FWVXgKRERBS0JnTlZCQWdUQTA1VFZ6RVBNQTBHQTFVRUJ4TUdVM2xrYm1WNU1Rd3dDZ1lEVlFRS0RBTlFTVlF4Q1RBSApCZ05WQkFzTUFERVlNQllHQTFVRUF3d1BiR0YzY21WdVkyVndhWFF1WTI5dE1TVXdJd1lKS29aSWh2Y05BUWtCCkRCWnNZWGR5Wlc1alpTNXdhWFJBWjIxaGFXd3VZMjl0TUI0WERURXlNRFF5T0RBeU1qSXlPRm9YRFRNeU1EUXkKTXpBeU1qSXlPRm93Z1lZeEN6QUpCZ05WQkFZVEFrRlZNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVApCbE41Wkc1bGVURU1NQW9HQTFVRUNnd0RVRWxVTVFrd0J3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psCmJtTmxjR2wwTG1OdmJURWxNQ01HQ1NxR1NJYjNEUUVKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnYKYlRDQm56QU5CZ2txaGtpRzl3MEJBUUVGQUFPQmpRQXdnWWtDZ1lFQXVCeXdQTmxDMUZvcEdMWWZGOTZTb3RpSwo4Tmo2L25XMDg0TzRvbVJNaWZ6eTd4OTU1UkxFeTY3M3EyYWlKTkIzTHZFNlh2a3Q5Y0d0eHROb09YdzFnMlV2CkhLcGxkUWJyNmJPRWpMTmVETlc3ajBvYitKclJ2QVVPSzlDUmdkeXc1TUM2bHdxVlFRNUMxRG5hVC8yZlNCRmoKYXNCRlRSMjRkRXBmVHk4SGZLRUNBd0VBQWFPQ0FTVXdnZ0VoTUFrR0ExVWRFd1FDTUFBd0N3WURWUjBQQkFRRApBZ1VnTUIwR0ExVWREZ1FXQkJRTkJHbW10M3l0S3BjSmFCYVlOYm55VTJ4a2F6QVRCZ05WSFNVRUREQUtCZ2dyCkJnRUZCUWNEQVRBZEJnbGdoa2dCaHZoQ0FRMEVFQllPVkdWemRDQllOVEE1SUdObGNuUXdnYk1HQTFVZEl3U0IKcXpDQnFJQVVEUVJwcHJkOHJTcVhDV2dXbURXNThsTnNaR3VoZ1l5a2dZa3dnWVl4Q3pBSkJnTlZCQVlUQWtGVgpNUXd3Q2dZRFZRUUlFd05PVTFjeER6QU5CZ05WQkFjVEJsTjVaRzVsZVRFTU1Bb0dBMVVFQ2d3RFVFbFVNUWt3CkJ3WURWUVFMREFBeEdEQVdCZ05WQkFNTUQyeGhkM0psYm1ObGNHbDBMbU52YlRFbE1DTUdDU3FHU0liM0RRRUoKQVF3V2JHRjNjbVZ1WTJVdWNHbDBRR2R0WVdsc0xtTnZiWUlCQVRBTkJna3Foa2lHOXcwQkFRc0ZBQU9CZ1FBRQpjVlVQQlg3dVptenFaSmZ5K3RVUE9UNUltTlFqOFZFMmxlcmhuRmpuR1BIbUhJcWhwemdud0hRdWpKZnMvYTMwCjlXbTVxd2NDYUMxZU81Y1dqY0cweDNPamRsbHNnWURhdGw1R0F1bXRCeDhKM05oV1JxTlVnaXRDSWtRbHhISXcKVWZnUWFDdXNoWWdEREw1WWJJUWErK2VnQ2dwSVorVDBEajVvUmV3Ly9BPT0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=</ds:X509Certificate>
        </ds:X509Data>
      </KeyInfo>
    </ds:Signature>
    <Subject>
      <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">[redacted]@[redacted].com</NameID>
      <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData NotOnOrAfter="2016-11-08T19:54:11Z" Recipient="https://full-[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj" />
      </SubjectConfirmation>
    </Subject>
    <Conditions NotBefore="2016-11-08T19:51:06Z" NotOnOrAfter="2016-11-08T20:51:11Z">
      <AudienceRestriction>
        <Audience>https://full-[redacted].cs2.force.com/</Audience>
      </AudienceRestriction>
    </Conditions>
    <AttributeStatement>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <AttributeValue>[redacted]@[redacted].com</AttributeValue>
      </Attribute>
      <Attribute Name="User.ProfileID" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">
        <AttributeValue type="anyType">00e15000001Iomk</AttributeValue>
      </Attribute>
    </AttributeStatement>
    <AuthnStatement AuthnInstant="2016-11-08T19:51:11Z" SessionIndex="_9f7f3050-881a-0134-5879-14109fe1c093">
      <AuthnContext>
        <AuthnContextClassRef>urn:federation:authentication:windows</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
  </Assertion>
</samlp:Response>

SAML Single Sign-On Settings:

Name: developer.[redacted].com
SSO API Name: developer_[redacted]_com_SSO2
SAML Version:  2.0
Issuer: http://[redacted].ngrok.io/saml/auth
Entity ID: https://[redacted].cs2.force.com/
Identity Provider Certificate EMAILADDRESS=lawrence.pit@gmail.com, CN=lawrencepit.com, OU=, O=PIT, L=Sydney, ST=NSW, C=AU
Expiration: 23 Apr 2032 02:22:28 GMT
Request Signing Certificate: Default Certificate
Request Signature Method: RSA-SHA1
Assertion Decryption Certificate: Assertion not encrypted
SAML Identity Type: Federation ID
SAML Identity Location: Subject
Identity Provider Login URL: http://[redacted].ngrok.io/saml/auth
Identity Provider Logout URL:
Custom Error URL: http://[redacted].ngrok.io/saml/error

Just-in-time User Provisioning:
User Provisioning Enabled: Not Checked

Endpoints:
Salesforce Login URL: https://test.salesforce.com?so=00DR0000001yqNj
Customer Community Community Login URL: https://[redacted].cs2.force.com/[redacted]customers/login?so=00DR0000001yqNj
OAuth 2.0 Token Endpoint: https://test.salesforce.com/services/oauth2/token?so=00DR0000001yqNj
Improve this question
1

1 Answer 1

Reset to default
2

I could make it work with this lib https://github.com/sportngin/saml_idp

The example on the README file worked with default config/key/certificate. This lib implements some missing features on ruby-saml-idp, like decode/encode response, etc.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .