Missing "InResponseTo" with SP initiated SSO to Auth0 IdP SAML

neerolyte · February 4, 2019, 1:32am

I’m trying to integrate a PHP based app that already uses SimpleSAMLphp with other SAML2 IdPs.

When authenticating with our app as the SP and Auth0 as the IdP and roughly the following procedure for configuration:

Sign up for https://manage.auth0.com
Applications > Create Application
Give it a name
Choose “Regular Web App”
Addons > Enable “SAML2 WEB APP”
Set our SAML Assertion Consumer Service URL as the “Application Callback URL”
Usage > Identity Provider Metadata > Download
Convert xml metadata to php config for SimpleSAMLphp

We end up getting a response that’s got no InResponseTo in the XML here:

simplesamlphp/saml2/blob/0deeeba/src/SAML2/StatusResponse.php#L68


      
          $this->status = [
              'Code' => Constants::STATUS_SUCCESS,
              'SubCode' => null,
              'Message' => null,
          ];
          
          
if ($xml === null) {
              return;
          }
          
          
if ($xml->hasAttribute('InResponseTo')) {
              $this->inResponseTo = $xml->getAttribute('InResponseTo');
          }
          
          
/** @var \DOMElement[] $status */
          $status = Utils::xpQuery($xml, './saml_protocol:Status');
          if (empty($status)) {
              throw new \Exception('Missing status code on response.');
          }
          
          
/** @var \DOMElement[] $statusCode */

This results in the response being processed as “unsolicited” (which I believe should only happen when the IdP initiated the auth - i.e not this case).

Trying to handle the unsolicited response we end up with SimpleSAMLphp effectively redirecting to the RelayState parameter as a path roughly here:

github.com

simplesamlphp/simplesamlphp/blob/1de2e1d39350bd3e80b5923f4006c52622efaf74/modules/saml/www/sp/saml2-acs.php#L114


      
              // check that the issuer is the one we are expecting
              assert(array_key_exists('ExpectedIssuer', $state));
              if ($state['ExpectedIssuer'] !== $idp) {
                  $idpMetadata = $source->getIdPMetadata($idp);
                  $idplist = $idpMetadata->getArrayize('IDPList', []);
                  if (!in_array($state['ExpectedIssuer'], $idplist, true)) {
                      SimpleSAML\Logger::warning('The issuer of the response not match to the identity provider we sent the request to.');
                  }
              }
          } else {
              // this is an unsolicited response
              $state = [
                  'saml:sp:isUnsolicited' => true,
                  'saml:sp:AuthId'        => $sourceId,
                  'saml:sp:RelayState'    => \SimpleSAML\Utils\HTTP::checkURLAllowed(
                      $spMetadata->getString(
                          'RelayState',
                          $response->getRelayState()
                      )
                  ),
              ];

This results in a 404 - aside from the 404 the auth actually works correctly. As far as I can tell the RelayState is optional but is meant to be a URL so I wouldn’t mind understanding what’s going wrong here, but I think at this stage it’s more important to get the responses being “solicited” as that’s the more common case and I don’t think we can redirect back to a sensible place in the app without that.

James.Morrison · February 4, 2019, 6:26pm

Hey there @neerolyte, I’d love to help you track this down. When you get a free minute can you DM me your tenant name please so we can continue to investigate what may be occurring? Thanks in advance!

neerolyte · February 4, 2019, 10:44pm

I’ve PM’d you @James.Morrison, thanks but I’ll also share here that I’ve since set up an independent install of SimpleSAMLphp as a SP and it works fine (even with the unsolicited SAMLResponse) - so it’s something weird about how we’re embedding the code in our app.

I’ll keep trying to track down where the process differs between the embedded and stand alone version for now.

James.Morrison · June 4, 2019, 7:50pm

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Auth0 IdP does not return InResponseTo Help saml , sso	9	2975	October 29, 2020
SAML assertion returning InResponseTo Help samlp , saml2	4	11498	December 17, 2018
The InResponseTo attribute does not match the id in the AuthNRequest Help connections , saml-enterprise-connection	4	1754	May 26, 2023
IdP initiated SAML fails with InResponseTo error Help saml2 , idp-initiated	2	5497	July 19, 2019
no 'InResponseTo' field in a SAML Assertion when redirecting a access for old SAML IdP to new SAML IdP on auth0 Help saml	1	3581	March 2, 2018

Missing "InResponseTo" with SP initiated SSO to Auth0 IdP SAML

Related topics