mirror of
https://github.com/zitadel/zitadel.git
synced 2025-07-01 09:08:58 +00:00
0e10ed0e0b
# Which Problems Are Solved When using implicit flow through the session API and a login UI on a custom domain (proxy), the tokens were signed by the API domain of the instance, rather than the public (proxy) domain. The SAML response had the same issue. Additionally, the saml library had an issue and lost the issuer context. This prevented also a successful login through the hosted login UI. # How the Problems Are Solved - The issuer of the SAML and Auth request is persisted to provide the information when signing the responses and tokens. - The SAML library is updated to the latest version. # Additional Changes None # Additional Context None
101 lines
3.0 KiB
Go
101 lines
3.0 KiB
Go
package saml
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"net/url"
|
|
|
|
"github.com/zitadel/saml/pkg/provider"
|
|
"github.com/zitadel/saml/pkg/provider/models"
|
|
"github.com/zitadel/saml/pkg/provider/xml"
|
|
|
|
"github.com/zitadel/zitadel/internal/api/authz"
|
|
"github.com/zitadel/zitadel/internal/command"
|
|
"github.com/zitadel/zitadel/internal/domain"
|
|
)
|
|
|
|
func (p *Provider) CreateErrorResponse(authReq models.AuthRequestInt, reason domain.SAMLErrorReason, description string) (string, string, error) {
|
|
resp := &provider.Response{
|
|
ProtocolBinding: authReq.GetBindingType(),
|
|
RelayState: authReq.GetRelayState(),
|
|
AcsUrl: authReq.GetAccessConsumerServiceURL(),
|
|
RequestID: authReq.GetAuthRequestID(),
|
|
Issuer: authReq.GetDestination(),
|
|
Audience: authReq.GetIssuer(),
|
|
}
|
|
return createResponse(p.AuthCallbackErrorResponse(resp, domain.SAMLErrorReasonToString(reason), description), authReq.GetBindingType(), authReq.GetAccessConsumerServiceURL(), resp.RelayState, resp.SigAlg, resp.Signature)
|
|
}
|
|
|
|
func (p *Provider) CreateResponse(ctx context.Context, authReq models.AuthRequestInt) (string, string, error) {
|
|
resp := &provider.Response{
|
|
ProtocolBinding: authReq.GetBindingType(),
|
|
RelayState: authReq.GetRelayState(),
|
|
AcsUrl: authReq.GetAccessConsumerServiceURL(),
|
|
RequestID: authReq.GetAuthRequestID(),
|
|
Audience: authReq.GetIssuer(),
|
|
Issuer: p.GetEntityID(ctx),
|
|
}
|
|
|
|
samlResponse, err := p.AuthCallbackResponse(ctx, authReq, resp)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
|
|
if err := p.command.CreateSAMLSessionFromSAMLRequest(
|
|
setContextUserSystem(ctx),
|
|
authReq.GetID(),
|
|
samlComplianceChecker(),
|
|
samlResponse.Id,
|
|
p.Expiration(),
|
|
); err != nil {
|
|
return "", "", err
|
|
}
|
|
|
|
return createResponse(samlResponse, authReq.GetBindingType(), authReq.GetAccessConsumerServiceURL(), resp.RelayState, resp.SigAlg, resp.Signature)
|
|
}
|
|
|
|
func createResponse(samlResponse interface{}, binding, acs, relayState, sigAlg, sig string) (string, string, error) {
|
|
respData, err := xml.Marshal(samlResponse)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
|
|
switch binding {
|
|
case provider.PostBinding:
|
|
return acs, base64.StdEncoding.EncodeToString(respData), nil
|
|
case provider.RedirectBinding:
|
|
respData, err := xml.DeflateAndBase64(respData)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
parsed, err := url.Parse(acs)
|
|
if err != nil {
|
|
return "", "", err
|
|
}
|
|
values := parsed.Query()
|
|
values.Add("SAMLResponse", string(respData))
|
|
values.Add("RelayState", relayState)
|
|
values.Add("SigAlg", sigAlg)
|
|
values.Add("Signature", sig)
|
|
parsed.RawQuery = values.Encode()
|
|
return parsed.String(), "", nil
|
|
}
|
|
return "", "", nil
|
|
}
|
|
|
|
func setContextUserSystem(ctx context.Context) context.Context {
|
|
data := authz.CtxData{
|
|
UserID: "SYSTEM",
|
|
}
|
|
return authz.SetCtxData(ctx, data)
|
|
}
|
|
|
|
func samlComplianceChecker() command.SAMLRequestComplianceChecker {
|
|
return func(_ context.Context, samlReq *command.SAMLRequestWriteModel) error {
|
|
if err := samlReq.CheckAuthenticated(); err != nil {
|
|
return err
|
|
}
|
|
return nil
|
|
}
|
|
}
|