element-hq / element-hq/synapse

SAML: last RequestedAttribute is always set to isRequired="false"

Open
#8,720 0 comments 0 reactions 0 assignees View on GitHub
A-SSO S-Minor T-Defect Z-Help-Wanted
Dominant language
Python
Stars
4.6k
Forks
600
Avg merge
5d 22h
Merged PRs (30d)
51

Description

This issue has been migrated from [#8720](https://github.com/matrix-org/synapse/issues/8720).

---

### Description

In the SAML metadata generated under URL `/_matrix/saml2/metadata.xml` for the last `requestedAttribut` `isRequired` is always set to `false`. If `isRequired` is evaluated by the IDP, this results in the attribute not being passed from the IDP to the SP.

```

Matrix
Matrix


```

### Steps to reproduce

- configure `saml2_config` in homeserver.yaml
```
saml2_config:
[...]
service:
sp:
required_attributes: ["uid", "email", "displayName"]
```
- configure `saml2-attribute-maps/map.py`:

```
MAP = {
"identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
"fro": {
'urn:oid:0.9.2342.19200300.100.1.1': 'uid',
'urn:oid:0.9.2342.19200300.100.1.3': 'email',
'urn:oid:2.16.840.1.113730.3.1.241': 'displayName',
},
"to": {
'uid': 'urn:oid:0.9.2342.19200300.100.1.1',
'email': 'urn:oid:0.9.2342.19200300.100.1.3',
'displayName': 'urn:oid:2.16.840.1.113730.3.1.241',
},
}
```
- check your metadata URL `/_matrix/saml2/metadata.xml`. The last `RequestedAttribute`, in this example `displayName`, is set to `isRequired="false"`. I would expect `isRequired="true"` for all `required_attributes`.
```

```
### Workaround

As a workaround I have added an optional attribute in the homeserver.yaml. This means that the optional attribute is the last attribute and this one is set to false. I'm not really sure if this is a bug or if my configuration is incorrect.

```
required_attributes: ["uid", "email", "displayName"]
optional_attributes: ["eduPersonPrincipalName"]
```
generated metadata URL `/_matrix/saml2/metadata.xml`:

```

Matrix
Matrix



```

### Version information

- synapse 1.22.1 on Ubuntu 18.04 LTS, deb pakage from `https://packages.matrix.org/debian/ bionic main`

Contributor guide

Open the contributing guide

Research direction

Start at the `/_matrix/saml2/metadata.xml` entry point and trace how `required_attributes` and `optional_attributes` from `homeserver.yaml` are converted into SAML RequestedAttribute elements. Use the provided `saml2-attribute-maps/map.py` mapping as the reproduction setup. Done means every required attribute is emitted with `isRequired="true"` and optional attributes with `isRequired="false"`.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.