nextcloud / nextcloud/user_saml

BLOCKING - User_saml suddenly unable to process valid SAML response

Open
#326 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

Steps to reproduce
  1. unknown - we had a fine working SAML authentication against an Azure AD for our LDAP users synchronized to Nextcloud. But without any known changes the SAML authentication fails.
Expected behaviour
  1. We expect a working SAML authentication against our Azure AD, which allows us to use Single Sign On for our users sychronized with LDAP.
Actual behaviour
  1. The SAML authentication fails with the displayed error of User not provisioned.

    Konto nicht bereitgestellt.
    Ihr Konto wird nicht bereitgestellt. Der Zugriff ist daher nicht möglich.

  2. Looking at the logs we see, the SAML plugin does receive any authentication information as it usually does (see first log below). We assume that this causes the errors after that and results in the user not provisioned message, as nextcloud has no information whatsoever to map the authentication to a user.
  3. Looking at the debug information from our browser we can see though, that we have received a complete and fine looking SAML response from our Identity Provider Azure AD (See second log below).
  4. Based on that we assume there is something unknown going wrong in between the browser making the final post request to nextcloud and nextcloud receiving and processing this request.

We are desperatly looking forward to your help.

Server configuration

Nextcloud version: (see Nextcloud admin page)
14.0.8.2
user_saml version:
2.1.1

Client configuration

Browser:

  • Google Chrome Version 73.0.3683.103 (Offizieller Build) (64-Bit)
  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15

Operating system:

  • Windows 10
  • MacOs
Logs
Nextcloud log (data/owncloud.log)

a) The javascript console log

{
  "reqId": "0Jb3RQl84Tj4VvwkCwpM",
  "level": 0,
  "time": "2019-04-24T08:13:34+02:00",
  "remoteAddr": "XXX.XXX.XXX.XXX",
  "user": "--",
  "app": "no app in context",
  "method": "POST",
  "url": "/index.php/apps/user_saml/saml/acs",
  **"message": "Attributes send by the IDP: []",**
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15",
  "version": "14.0.8.2"
},
{
  "reqId": "0Jb3RQl84Tj4VvwkCwpM",
  "level": 3,
  "time": "2019-04-24T08:13:34+02:00",
  "remoteAddr": "XXX.XXX.XXX.XXX",
  "user": "--",
  "app": "user_saml",
  "method": "POST",
  "url": "/index.php/apps/user_saml/saml/acs",
  "message": "invalid_response",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15",
  "version": "14.0.8.2"
},
{
  "reqId": "0Jb3RQl84Tj4VvwkCwpM",
  "level": 3,
  "time": "2019-04-24T08:13:34+02:00",
  "remoteAddr": "XXX.XXX.XXX.XXX",
  "user": "--",
  "app": "user_saml",
  "method": "POST",
  "url": "/index.php/apps/user_saml/saml/acs",
  "message": "Signature validation failed. SAML Response rejected",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15",
  "version": "14.0.8.2"
},
{
  "reqId": "0Jb3RQl84Tj4VvwkCwpM",
  "level": 1,
  "time": "2019-04-24T08:13:34+02:00",
  "remoteAddr": "XXX.XXX.XXX.XXX",
  "user": "--",
  "app": "user_saml",
  "method": "POST",
  "url": "/index.php/apps/user_saml/saml/acs",
  "message": "Auth failed",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15",
  "version": "14.0.8.2"
},
{
  "reqId": "sP58xZYMaTmDd22O6OTu",
  "level": 0,
  "time": "2019-04-24T08:13:38+02:00",
  "remoteAddr": "XXX.XXX.XXX.XXX",
  "user": "--",
  "app": "no app in context",
  "method": "GET",
  "url": "/index.php/css/icons/icons-vars.css?v=1555884489",
  "message": "No cache entry found for <PATHTO>/icons-vars.css.gzip (storage: local::<INTERNAL_PATH_TO>, internalPath: <INTERNAL_PATH_TO>/icons-vars.css.gzip)",
  "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1 Safari/605.1.15",
  "version": "14.0.8.2"
})
Browser log

a) The SAML repose in Browser (was base 64 encoded)

<samlp:Response ID="XXXXXXXXXXXXXXXXXXX" Version="2.0" IssueInstant="2019-04-24T06:32:07.431Z" Destination="<URL_TO_NEXTCLOUD>/index.php/apps/user_saml/saml/acs" InResponseTo="XXXXXXXXXXXXXXXXXXX" 
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
    <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">XXXXXXXXXXXXXXXXXXX</Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
    </samlp:Status>
    <Assertion ID="XXXXXXXXXXXXXXXXXXX" IssueInstant="2019-04-24T06:32:07.415Z" Version="2.0" 
        xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Issuer>XXXXXXXXXXXXXXXXXXX</Issuer>
        <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
            <SignedInfo>
                <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <Reference URI="XXXXXXXXXXXXXXXXXXX">
                    <Transforms>
                        <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </Transforms>
                    <DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <DigestValue>XXXXXXXXXXXXXXXXXXX</DigestValue>
                </Reference>
            </SignedInfo>
            <SignatureValue>XXXXXXXXXXXXXXXXXXX</SignatureValue>
            <KeyInfo>
                <X509Data>
                    <X509Certificate>XXXXXXXXXXXXXXXXXXX</X509Certificate>
                </X509Data>
            </KeyInfo>
        </Signature>
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">XXXXXXXXXXXXXXXXXXX</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="XXXXXXXXXXXXXXXXXXX" NotOnOrAfter="2019-04-24T06:37:07.415Z" Recipient="<URL_TO_NEXTCLOUD>/index.php/apps/user_saml/saml/acs"/>
            </SubjectConfirmation>
        </Subject>
        <Conditions NotBefore="2019-04-24T06:27:07.415Z" NotOnOrAfter="2019-04-24T07:27:07.415Z">
            <AudienceRestriction>
                <Audience>URL_TO_NEXTCLOUD/index.php/apps/user_saml/saml/metadata</Audience>
            </AudienceRestriction>
        </Conditions>
        <AttributeStatement>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/displayname">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
            <Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences">
                <AttributeValue>XXXXXXXXXXXXXXXXXXX</AttributeValue>
            </Attribute>
        </AttributeStatement>
        <AuthnStatement AuthnInstant="2019-04-24T06:23:50.306Z" SessionIndex="XXXXXXXXXXXXXXXXXXX">
            <AuthnContext>
                <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
            </AuthnContext>
        </AuthnStatement>
    </Assertion>
</samlp:Response>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the /index.php/apps/user_saml/saml/acs entry point and compare the browser's SAML response with the Nextcloud log entries showing empty attributes, invalid_response, and failed signature validation. Check the reported Nextcloud 14.0.8.2 and user_saml 2.1.1 context. Done means a valid Azure AD response is accepted and the LDAP-synchronized user can complete SSO.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.