SAML Assertion Query/Request Profile- WSO2 IS Client Configuration

In this post I will explain you how to test Assertion Query/Request profile feature in WSO2 Identity server v 5.3.0 and onward.First you need to clone or download client application from the below git repository.
https://github.com/gayangithub/wso2-is-assertion-query-client

Start Identity Server, select Service Providers---> Add and create new service provider. Here I create travelocity.com as service provider.

WSO2 IS Create Service Provider 

Now go to Home > Manage > Keystores > List and click on import cert. Browse to below path and import certificate into Identity Server.

CERTIFICATE_FILE_PATH : wso2-is-assertion-query-client\src\test\resources\soa.cert

Now you need to configure newely created service provider. So go to Home> Identity > Service Providers > List> SAML SSO Configuration and add aseertion consumers URL, certificate alias and so on as below.

Configure service Provider

Go to WSO2IS_HOME/repository/conf/identity/identity.xml and check the Assertion builder class. For this profile we use custom assertion builder which has capability to persist Assertions on database.Check for SAMLSSOAssertionBuilder element and value should be org.wso2.carbon.identity.sso.saml.builders.assertion.ExtendedDefaultAssertionBuilder

When users login, created assertions persist in IDN_SAML2_ASSERTION_STORE table on H2 database. You can verify, is that table available on database server referring below tutorial. http://www.vitharana.org/2012/04/how-to-browse-h2-database-of-wso2.html

You can try a test login using travelocity.com service provide by accessing this URL

https://localhost:9443/samlsso?spEntityID=travelocity.com with 'admin' username and 'admin' password. Check database for newely created assertion.

Assertion Query Request feature support below request message types.

1. AssertionID Request - require to store assertions
2. AttributeQuery - not required to store assertions
3. AuthnQuery - required
4. AuthzDecision - required
5. SubjectQuery -not required

Now we are ready to test a scenario. I select AssertionID Request to test. Now open above repository source codes using your IDE and go to wso2-is-assertion-query-client\src\test\java\org\wso2\carbon\identity\query\saml\test . Open SAMLAssertionIDRequestClient.java

Copy a AssertionID from your database--> table-->column  IDN_SAML2_ASSERTION_STORE.SAML2_ID  and assign value to ASSERTION_ID variable in above class. Run the main() of  SAMLAssertionIDRequestClient class.

Here you can see generated request message.

And the response message from IS

As above you can try other messages also with changing SessionIndex, subject, attributes and so on.

Read More

SAML2.0 Assertion Query/Request Profile - Introduction

What is SAML

SAML is the short form of Security Assertion Markup Language. It is a universal standard for authentication request messages and response messages. SAML consist with two profiles

• Active Profile - Process through web browser using redirects
• Passive Profile - Process directly using API calls (Mostly in mobile applications)

Use case of SSO with SAML is when a Service Provider (SP) has multiple services (Example Google has Gmail, Google Drive, Keep, Google Doc and etc.) users had to logging several times for that services with different credentials. So it is bad experience. Then service provider had to keep multiple database instances to manage users for multiple services. It is worst design for administrative tasks. Security issues can be occur at service provider’s methodology. So SSO separate user credential information from service provider and add it to a separate server called Identity Provider (IDP).It holds user credentials, user roles on multiple services of particular Service provider and other attributes of user like email, contact no, date of register and etc. Service providers can have multiple IDPs and identity provides can have multiple service providers.

Message Flow

According to the order of initiating authentication process there are two types.

•          IDP Initiative – client directly contact IDP then SP
•          SP Initiative – client connect with SP first and redirect to IDP

SAML is better for authentication message passing because it eliminate opportunities to phishing attack, eliminate administrative effort, high level of binding with different entities.

SAML Response is consist with Assertion. This SAML response has two sections

•  Payload format – Content of the message (receiver, sender, signature, user’s attributes and etc.)
•  Transport format – Relevant information for message transport (IP addresses, protocols, status)

There are three major components are used for SSO functionality with SAML standard.
1. Client/Principal
2. Service Provider (SP)
3. Identity Provider (IDP)

Information flow of client

Information flow of IDP

Information flow of SP

Assertion is a part of the Response message. We can discuss about Assertion in next tutorial.

Read More