Re: SSO without existing federation using NameIDPolicy "onetime"

Hi Peter,=20

The "one-time" identifier is not implemented in
SourceID software. I was trying to test that a couple
of months ago, and I came up to that conclusion after
looking in the software (right know I do not remember
where) but somewhere in the workflow was commented
something like "to do: one time identifier". So that's
why you run into that situation.=20

Best regards,=20
Ruth
 --- Peter Fennema <[email protected]> escribi=F3:

> Hello
>=20
> The SourceID demo (ID-FF 1.2 Java Toolkit 2.0.)
> requires a federation
> between SP and IDP. I want to modify the demo to the
> situation that
> the SP has no authentication infrastructure or user
> database at all. It
> simply relies on the assertions made by the IDP.
> According to the Liberty spec the SP can specify
> this in the
> <NameIDPolicy> element in the authentication
> request.
> I quote:=20
> "If the <NameIDPolicy> element is "onetime", then
> the
> <saml:NameIdentifier> element in the <saml:Subject>
> element MUST be a temporary, one-time-use identifier
> for the Principal,
> with a Format attribute of=20
> urn:liberty:iff:nameid:one-time. "
>=20
> I decided to implement this behaviour in the demo,
> but the behaviour is
> not as I expected. I wonder if there is anything
> wrong with my assumptions and conclusions, or if I
> run into a software
> bug ?
> Below is my modification and some sequential
> fragments of the JBoss
> logs.
>=20
> Regards, Peter
>=20
> -------------- Details ---------
>=20
> In the login.jsp of the SP I found the hook to
> specify the NameIDPolicy
> parameter value:
> <c_rt:param
> name=3D"<%=3DSSOInitiateServlet.PARAM_ACTION%>"
>
value=3D"<%=3DSSOInitiateServlet.PARAM_ACTION_ONETIME_VALUE%>"
> />
>=20
> The Jboss logs show the following messages:
>=20
> 2005-05-26 09:46:27,142 DEBUG
> [org.obe.engine.WorkflowEngineUtilities]
> Putting requestDocument =3D=20
> <AuthnRequest
> IssueInstant=3D"2005-05-26T07:46:27.064Z"
> MinorVersion=3D"2"
> MajorVersion=3D"1"
> RequestID=3D"iZZqaqdjJA5wsPLRNJJuOLu7W3Dk"
> xmlns=3D"urn:liberty:iff:2003-08">
>   <ProviderID>http://sourceid-idff-demo</ProviderID>
>   <NameIDPolicy>onetime</NameIDPolicy>
>   <IsPassive>false</IsPassive>
> =20
>
<ProtocolProfile>http://projectliberty.org/profiles/brws-post</ProtocolP
> rofile>
>   <RelayState>NQA=3D</RelayState>
> </AuthnRequest>
>  into workflow data
>=20
> My conclusion: The NameIDPolicy is correctly set to
> "onetime".
>=20
> 2005-05-26 09:46:27,189 DEBUG
> [org.obe.engine.WorkflowEngineUtilities]
> Putting assertion =3D=20
> <lib:Assertion
> IssueInstant=3D"2005-05-26T07:46:27.174Z"
> AssertionID=3D"i5G4yIiYBuJ4PuHhIABh41w9jHSU"
> Issuer=3D"http://sourceid-idff-demo"
> InResponseTo=3D"iZZqaqdjJA5wsPLRNJJuOLu7W3Dk"
> MinorVersion=3D"2"
> MajorVersion=3D"1" xmlns:lib=3D"urn:liberty:iff:2003-08"
> xmlns=3D"urn:oasis:names:tc:SAML:1.0:assertion"
>
xmlns:xsi=3D"http://www.w3.org/2001/XMLSchema-instance">
>   <Conditions
> NotOnOrAfter=3D"2005-05-26T07:51:27.174Z"
> NotBefore=3D"2005-05-26T07:45:27.174Z">
>     <AudienceRestrictionCondition>
>       <Audience>http://sourceid-idff-demo</Audience>
>     </AudienceRestrictionCondition>
>   </Conditions>
>   <AuthenticationStatement SessionIndex=3D"01"
> AuthenticationInstant=3D"2005-05-26T07:46:27.174Z"
>
AuthenticationMethod=3D"urn:oasis:names:tc:SAML:1.0:am:unspecified"
> xsi:type=3D"lib:AuthenticationStatementType">
>     <Subject xsi:type=3D"lib:SubjectType">
>       <SubjectConfirmation>
> =20
>
<ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:bearer</ConfirmationM
> ethod>
>       </SubjectConfirmation>
>     </Subject>
>   </AuthenticationStatement>
> </lib:Assertion>
>  into workflow data
>=20
> My conclusion: An authentication statement was
> created, but I think it
> should include a one time identifier for the
> principal, as mentionened in the spec quote.
>=20
> Later an exception occurs
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.engine.WorkflowRunner] Executing
> activity 'createResponse' implementation for
> instance 92
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.spi.util.WorkflowUtilities]
> Searching workflow 'idp-authn' for tool
> 'CreateAuthnResponseDocument'
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.spi.util.WorkflowUtilities]
> Searching package 'IDFF-1.2' for tool
> 'CreateAuthnResponseDocument'
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.spi.util.WorkflowUtilities] Tool
> 'CreateAuthnResponseDocument found in package
> 'IDFF-1.2'
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.engine.WorkflowRunner] Executing
> tool 'CreateAuthnResponseDocument'
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.engine.WorkflowRunner] Parameter
> count: 4
> 2005-05-26 09:46:27,205 DEBUG
> [org.obe.engine.WorkflowRunner] Invoking
> tool 'CreateAuthnResponseDocument'
> 2005-05-26 09:46:27,220 ERROR
>
[org.sourceid.idff12.workunit.idp.CreateAuthnResponseDocument]
> Failure
> in workflow: Setting response code to
> "{urn:liberty:iff:2003-08}FederationDoesNotExist"
> org.sourceid.idff12.workunit.idp.FederationFailure:
> Federation does not
> exist.
> 	at
>
org.sourceid.idff12.workunit.idp.FederationFailure.<clinit>(FederationFa
> ilure.java:25)
> 	at
>
org.sourceid.idff12.workunit.idp.ThrowFederationFailure.execute(ThrowFed
> erationFailure.java:39)
>=20
>=20
> The following response is created:
>=20
> 2005-05-26 09:46:27,220 DEBUG
> [org.obe.engine.WorkflowEngineUtilities]
> Putting responseDocument =3D=20
> <lib:AuthnResponse MinorVersion=3D"2" MajorVersion=3D"1"
> IssueInstant=3D"2005-05-26T07:46:27.205Z"
> Recipient=3D"http://sourceid-idff-demo"
> InResponseTo=3D"iZZqaqdjJA5wsPLRNJJuOLu7W3Dk"
> ResponseID=3D"i2oUjOP42cgsOlFsg_hpaf6M3FsY"
> xmlns:lib=3D"urn:liberty:iff:2003-08"
> xmlns:samlp=3D"urn:oasis:names:tc:SAML:1.0:protocol">
>   <samlp:Status>
>     <samlp:StatusCode Value=3D"samlp:Responder">
>       <samlp:StatusCode
> Value=3D"lib:FederationDoesNotExist"/>
>     </samlp:StatusCode>
>     <samlp:StatusMessage>Federation does not
> exist.</samlp:StatusMessage>
>   </samlp:Status>
> =20
>
<lib:ProviderID>http://sourceid-idff-demo</lib:ProviderID>
>   <lib:RelayState>NQA=3D</lib:RelayState>
> </lib:AuthnResponse>
>  into workflow data
>=20
>=20
> _______________________________________________
> sso-users mailing list
> [email protected]
> http://lists.sourceid.org/mailman/listinfo/sso-users
>=20



	=09
______________________________________________=20
Renovamos el Correo Yahoo!=20
Nuevos servicios, m=E1s seguridad=20
http://correo.yahoo.es