onelogin SSO shibboleth ACS config

Question

Ich versuche, Shibboleth SP mit OneLogin [SAML Test Connector (IdP w/attr)] in meinem Labor zu arbeiten. Ich konnte alles mit testshib IDP arbeiten bekommen, aber wenn ich meine Metadaten-Provider ändern und meine SSO Entity ID aktualisieren bekomme ich nur diesen Fehler:

SAML-Nachricht mit POST falschen Server-URL geliefert

Bei der Betrachtung meine Metadatendatei ich sehe, dass mein ACS ist:

http://testserver/Shibboleth.sso/SAML2/POST

aber, wenn dies in meinem ONELOGIN Teststecker platziert ist alles, was ich bekomme, ist der obige Fehler.

Unten ist mein Shibboleth2.xml-Datei (mit entfernt Entität ID)

<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" clockSkew="1800"> 
<!-- Windows RequestMapper --> 
<!-- 
The RequestMap defines portions of the webspace to protect; testserver/secure here. 
--> 
<!-- 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPRequestMap 
--> 

    <InProcess logger="native.logger"> 
     <ISAPI normalizeRequest="true" safeHeaderNames="false"> 
      <!-- 
      Maps IIS Instance ID values to the host scheme/name/port. The name is 
      required so that the proper <Host> in the request map above is found without 
      having to cover every possible DNS/IP combination the user might enter. 
      --> 
      <Site id="1" name="testserver"/> 
      <!-- 
      When the port and scheme are omitted, the HTTP request's port and scheme are used. 
      If these are wrong because of virtualization, they can be explicitly set here to 
      ensure proper redirect generation. 
      --> 
      <!-- 
      <Site id="42" name="virtual.example.org" scheme="https" port="443"/> 
      --> 
     </ISAPI> 
    </InProcess> 

<RequestMapper type="Native"> 
<RequestMap applicationId="default"> 
<Host name="testserver"> 
<Path name="secure" authType="shibboleth" requireSession="true"/> 
</Host> 
</RequestMap> 
</RequestMapper> 
<!-- 
The entityID is the name TestShib made for your SP. 
--> 
<ApplicationDefaults entityID="" REMOTE_USER="eppn"> 
<!-- 
You should use secure cookies if at all possible. See cookieProps in this Wiki article. 
--> 
<!-- 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions 
--> 
<Sessions lifetime="28800" timeout="3600" checkAddress="false" relayState="ss:mem" handlerSSL="false"> 
<!-- 
Triggers a login request directly to the TestShib IdP. 
--> 
<!-- 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceSSO 
--> 
<SSO entityID="">SAML2</SSO> 
<!-- SAML and local-only logout. --> 
<!-- 
https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPServiceLogout 
--> 
<Logout>SAML2 Local</Logout> 
<!-- 

       Handlers allow you to interact with the SP and gather more information. Try them out! 
       Attribute values received by the SP through SAML will be visible at: 
       http://sdserver/Shibboleth.sso/Session 

--> 
<!-- 
Extension service that generates "approximate" metadata based on SP configuration. 
--> 

<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/> 
<!-- Status reporting service. --> 
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> 
<!-- Session diagnostic service. --> 
<Handler type="Session" Location="/Session" showAttributeValues="true"/> 
<!-- JSON feed of discovery information. --> 
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/> 

</Sessions> 
<!-- 
Error pages to display to yourself if something goes horribly wrong. 
--> 
<Errors supportContact="root@localhost" logoLocation="/shibboleth-sp/logo.jpg" styleSheet="/shibboleth-sp/main.css"/> 
<!-- 
Loads and trusts a metadata file that describes only the Testshib IdP and how to communicate with it. 
--> 
<MetadataProvider type="XML" file="onelogin_metadata.xml"/> 
<!-- 
Attribute and trust options you shouldn't need to change. 
--> 
<AttributeExtractor type="XML" validate="true" path="attribute-map.xml"/> 
<AttributeResolver type="Query" subjectMatch="true"/> 
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/> 
<!-- 
Your SP generated these credentials. They're used to talk to IdP's. 
--> 
<CredentialResolver type="File" key="sp-key.pem" certificate="sp-cert.pem"/> 
</ApplicationDefaults> 
<!-- 
Security policies you shouldn't change unless you know what you're doing. 
--> 
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/> 
<!-- 
Low-level configuration about protocols and bindings available for use. 
--> 
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/> 
</SPConfig> 

Metadaten (wieder sensible Informationen entfernt)

<?xml version="1.0"?> 
<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://app.onelogin.com/saml/metadata/"> 
    <IDPSSODescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> 
    <KeyDescriptor use="signing"> 
     <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> 
     <ds:X509Data> 
      <ds:X509Certificate></ds:X509Certificate> 
     </ds:X509Data> 
     </ds:KeyInfo> 
    </KeyDescriptor> 
    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat> 
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://.onelogin.com/trust/saml2/http-post/sso/"/> 
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://.onelogin.com/trust/saml2/http-post/sso/"/> 
    <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://.onelogin.com/trust/saml2/soap/sso/"/> 
    </IDPSSODescriptor> 
    <ContactPerson contactType="technical"> 
    <SurName>Support</SurName> 
    <EmailAddress>support@onelogin.com</EmailAddress> 
    </ContactPerson> 
</EntityDescriptor> 

Der Stecker nur diese Einstellungen hat:

ACS (Consumer) URL-Validator: ^ http: //testserver/shibboleth.sso/SAML2/POST$

URL

ACS (Consumer) http://testserver/shibboleth.sso/SAML2/POST

Answer 1

Diese guide erklärt Ihnen, wie Sie den Stecker des ONELOGIN konfigurieren.

• Publikum: http://testserver/shibboleth.sso/SAML2/POST
• Empfänger: -> IdP Entity ID <-
• ACS (Consumer) URL Validator:^http://testserver/shibboleth.sso/SAML2/POST $
• ACS (Consumer) URL: http://testserver/shibboleth.sso/SAML2/POST

Bei Shibboleth:

Bearbeiten /etc/shi bboleth/shibboleth2.xml, um die Metadaten-URL als Metadatenanbieter hinzuzufügen.

Ich habe gesehen, dass Sie bereits die Metadaten-URL für die App erhalten haben, indem Sie sich bei OneLogin als Administrator angemeldet und auf Test Connector> SSO-Registerkarte> Aussteller-URL geklickt haben.

und ihn in die Datei hinzugefügt:

<MetadataProvider type="XML" file="onelogin_metadata.xml"/> 

Add Attributzuordnung, bearbeiten /etc/shibboleth/Attribut-Karte.xml und fügen Sie die folgenden Attribute:

<!-- OneLogin attributes --> 

<Attribute name="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" id="login"> 
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/> 
</Attribute> 

<Attribute name="User.Email" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="email"> 
<AttributeDecoder xsi:type="ScopedAttributeDecoder"/> 
</Attribute> 

<Attribute name="User.FirstName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="firstName"> 
<AttributeDecoder xsi:type="StringAttributeDecoder"/> 
</Attribute> 

<Attribute name="User.LastName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="lastName"> 
<AttributeDecoder xsi:type="StringAttributeDecoder"/> 
</Attribute> 

Der Fehler, der Sie "SAML-Nachricht mit POST falsche Server-URL geliefert" is documented erfahren:

When a SAML message is addressed to a location inconsistent with where the SP believes it's running, this error will be thrown. The SP pulls much of this information from the web environment. 

* Verify that the server name and port are properly set in accordance with the SP's metadata. 
* Rewriting rules in effect for the Shibboleth.sso handler path must be consistent with the SP's metadata. 
* The IdP needs to properly address the SAML response. 

Nehmen Sie die SAML-Fluss mit dem SAML Tracer Tool und stellen Sie sicher, dass Eine SAMLResponse wird über die HTTP-POST-Bindung an den Endpunkt http://testserver/shibboleth.sso/SAML2/POST gesendet.

Ich bin kein Experte shibboleth, aber vielleicht von HTTPS auf die Tatsache des Sendens zu HTTP, wie here, Erklärung here