3

My aim is service provider-initiated Web SSO profile. I am implementing the service provider (SP), using Salesforce as the identity provider (IDP) for testing my SP. Can I use Salesforce IDP?

I have configured Salesforce as my test identity provider for my service provider [I am implementing the SP using the OpenSAML library].

"Edit 1 start"

First of all , can we use salesforce IdP for the sp(locally hosted) intiated sso web profile? I wanted to send my request message to salesForce IdP from my program *

[adding my request messages] 

<?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="http://localhost:8080/test_with_OpenSAML/AssertionConsumerService.jsp" ID="7ickdmjo241394083307023" IssueInstant="2014-03-06T05:21:47.115Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ProviderName="ls" Version="2.0"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://localhost:8080/test_with_OpenSAML</saml:Issuer></samlp:AuthnRequest>

: In the case of HTTP Redirect , deflating , base64 and url encoding should be done.

after deflating(with zero compression ):SAME REQUEST MESSAGE AS ABOVE [what level of deflating level should I use?]

after base64 encoding : 

PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cDovL2xvY2FsaG9zdDo4MDgwL3Rlc3Rfd2l0aF9PcGVuU0FNTC9Bc3NlcnRpb25Db25zdW1lclNlcnZpY2UuanNwIiBJRD0iN2lja2Rtam8yNDEzOTQwODMzMDcwMjMiIElzc3VlSW5zdGFudD0iMjAxNC0wMy0wNlQwNToyMTo0Ny4xMTVaIiBQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIFByb3ZpZGVyTmFtZT0iY3YiIFZlcnNpb249IjIuMCI+PHNhbWw6SXNzdWVyIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPmh0dHA6Ly8xNzIuMTYuNjUuMTA6ODA4MC90ZXN0X3dpdGhfT3BlblNBTUw8L3NhbWw6SXNzdWVyPjwvc2FtbHA6QXV0aG5SZXF1ZXN0Pg==

after URLencoded :[ONLY THE SAMLRequest message should be url encoded]

PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48c2FtbHA6QXV0aG5SZXF1ZXN0IHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIEFzc2VydGlvbkNvbnN1bWVyU2VydmljZVVSTD0iaHR0cDovL2xvY2FsaG9zdDo4MDgwL3Rlc3Rfd2l0aF9PcGVuU0FNTC9Bc3NlcnRpb25Db25zdW1lclNlcnZpY2UuanNwIiBJRD0iN2lja2Rtam8yNDEzOTQwODMzMDcwMjMiIElzc3VlSW5zdGFudD0iMjAxNC0wMy0wNlQwNToyMTo0Ny4xMTVaIiBQcm90b2NvbEJpbmRpbmc9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpiaW5kaW5nczpIVFRQLVBPU1QiIFByb3ZpZGVyTmFtZT0iY3YiIFZlcnNpb249IjIuMCI%2BPHNhbWw6SXNzdWVyIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iPmh0dHA6Ly8xNzIuMTYuNjUuMTA6ODA4MC90ZXN0X3dpdGhfT3BlblNBTUw8L3NhbWw6SXNzdWVyPjwvc2FtbHA6QXV0aG5SZXF1ZXN0Pg%3D%3D

http:xxx.salesforce.com/idp/endpoint/HttpRedirect?SAMLRequest=ABOVE_MESSAGE

Is it mandatory to add RelayState?what it should contain?

Edit 1 ends

Once configured I have built the AuthnRequest and by using HTTP POST binding just appended the SAMLREQUEST="URLencodedAuthnRequest" to the POST binding URL of IDP [provided from IDP metadata]

When I send the request message, I see the unable to parse AuthnRequest from service provider error in the Identity Provider Event Log: Service provider is also unknown.why is that so? I have registered my SP as well

Where am I going wrong? I have referred to all the discussions in the Salesforce forums, but I cant find the solution.

Improve this question

1 Answer 1

Reset to default
1

With the SAML 2.0 POST binding you have to POST the SAML request in a base64-encoded control within an HTML form - here's an example of what the service provider might send to the browser, from section 3.5.8 of the SAML 2.0 Bindings Specification:

HTTP/1.1 200 OK
Date: 21 Jan 2004 07:00:49 GMT
Content-Type: text/html; charset=iso-8859-1

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<body onload="document.forms[0].submit()">

<noscript>
<p>
<strong>Note:</strong> Since your browser does not support JavaScript,
you must press the Continue button once to proceed.
</p>
</noscript>

<form action="https://ServiceProvider.com/SAML/SLO/Browser"
method="post">
<div>
<input type="hidden" name="RelayState"
value="0043bfc1bc45110dae17004005b13a2b"/>
<input type="hidden" name="SAMLRequest"
value="PHNhbWxwOkxvZ291dFJlcXVlc3QgeG1sbnM6c2FtbHA9InVybjpvYXNpczpuYW1l
czp0YzpTQU1MOjIuMDpwcm90b2NvbCIgeG1sbnM9InVybjpvYXNpczpuYW1lczp0
YzpTQU1MOjIuMDphc3NlcnRpb24iDQogICAgSUQ9ImQyYjdjMzg4Y2VjMzZmYTdj
MzljMjhmZDI5ODY0NGE4IiBJc3N1ZUluc3RhbnQ9IjIwMDQtMDEtMjFUMTk6MDA6
NDlaIiBWZXJzaW9uPSIyLjAiPg0KICAgIDxJc3N1ZXI+aHR0cHM6Ly9JZGVudGl0
eVByb3ZpZGVyLmNvbS9TQU1MPC9Jc3N1ZXI+DQogICAgPE5hbWVJRCBGb3JtYXQ9
InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OnBlcnNp
c3RlbnQiPjAwNWEwNmUwLWFkODItMTEwZC1hNTU2LTAwNDAwNWIxM2EyYjwvTmFt
ZUlEPg0KICAgIDxzYW1scDpTZXNzaW9uSW5kZXg+MTwvc2FtbHA6U2Vzc2lvbklu
ZGV4Pg0KPC9zYW1scDpMb2dvdXRSZXF1ZXN0Pg=="/>
</div>
<noscript>
<div>
<input type="submit" value="Continue"/>
</div>
</noscript>
</form>
</body>
</html>

The SAML 2.0 Redirect binding uses a query parameter containing the request, compressed then base64-encoded. Here's an example from section 3.4.8 of the same document:

HTTP/1.1 302 Object Moved
Date: 21 Jan 2004 07:00:49 GMT
Location:
https://ServiceProvider.com/SAML/SLO/Browser?SAMLRequest=fVFdS8MwFH0f7D%
2BUvGdNsq62oSsIQyhMESc%2B%2BJYlmRbWpObeyvz3puv2IMjyFM7HPedyK1DdsZdb%2F%
2BEHfLFfgwVMTt3RgTwzazIEJ72CFqRTnQWJWu7uH7dSLJjsg0ev%2FZFMlttiBWADtt6R%
2BSyJr9msiRH7O70sCm31Mj%2Bo%2BC%
2B1KA5GlEWeZaogSQMw2MYBKodrIhjLKONU8FdeSsZkVr6T5M0GiHMjvWCknqZXZ2OoPxF7kG
naGOuwxZ%2Fn4L9bY8NC%
2By4du1XpRXnxPcXizSZ58KFTeHujEWkNPZylsh9bAMYYUjO2Uiy3jCpTCMo5M1StVjmN9SO1
50sl9lU6RV2Dp0vsLIy7NM7YU82r9B90PrvCf85W%2FwL8zSVQzAEAAA%3D%
3D&RelayState=0043bfc1bc45110dae17004005b13a2b&SigAlg=http%3A%2F%
2Fwww.w3.org%2F200%2F09%2Fxmldsig%23rsa-
sha1&Signature=NOTAREALSIGNATUREBUTTHEREALONEWOULDGOHERE
Content-Type: text/html; charset=iso-8859-1

Salesforce will accept either binding, using the appropriate URL from the metadata. Render the HTML form, or use the redirect binding, whichever works best for you.

Edit 1 start:

You have http://localhost:8080/test_with_OpenSAML as the Issuer. This element should actually refer to the issuer of the SAML Assertion (the IdP). Use the value from the Identity Provider config in Salesforce - it will be something like https://company-dev-ed.my.salesforce.com.

Also, you have ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" in your request, but you're sending it via redirect. It should be ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect". EDIT - this was incorrect - the ProtocolBinding identifies the protocol binding to use for the SAML response

RelayState is optional. Whatever you pass here, the IdP will pass back to you with the SAML response. RelayState is typically used to hold the URL that the user originally requested, or some handle to that URL.

Edit 1 end.

Improve this answer
8
  • I have tried HTTP redirect as u stated,still the same results persist.@metadaddy
    – mavis
    Commented Mar 5, 2014 at 7:48
  • Can you edit your question and paste in the request that you're sending?
    – metadaddy
    Commented Mar 5, 2014 at 16:59
  • 1
    You have the Issuer wrong in the request - see the edit I just made to my answer.
    – metadaddy
    Commented Mar 6, 2014 at 17:39
  • 1
    The issuer is wrong as you said.I corrected that. ProtocolBinding of mine is correct.That is to notify the IdP to use that binding while sending the response back.
    – mavis
    Commented Mar 10, 2014 at 8:40
  • 1
    Yes - you are right - SAML Core spec says that ProtocolBinding is "A URI reference that identifies a SAML protocol binding to be used when returning the <Response> message." - I'll edit my answer - thanks!
    – metadaddy
    Commented Jun 1, 2015 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .