Int 275

[iguanajazz]

Status

READY

Migrations

NO

Description

Add security to avoid user impersonation / authentication bypass

Deploy Notes

Configure files:
sample/src/main/webapp/index.jsp
set AssertionConsumerServiceUrl if is necessary
set Issuer if is necessary
set IdpSsoTargetUrl with your OneLogin SAML app information

sample/src/main/webapp/consume.jsp
set certificateS with your app X.509 Certificate

Steps to Test or Reproduce

1. Install the core code into your local Maven repository with:
   mvn install
2. Run the web app sample which depends on this code:
   cd sample
   mvn jetty:run
3. Navigate to http://localhost:8080
4. Attempt SSO to the toolkit, after authentication it will make a final POST containing the SAML data, similar to below. (You will have to base64 decode the data, then you will see the XML structure below): http://pentestadfs.pentest.local/adfs/services/trusthttp://pentestadfs.pentest.local/adfs/services/trusthdMwdq4IaOlYxj9IWdXdMqsmcw1TS9LeBPWZ392BJiU=lK2csDXHq462wPEjWKFNZXYz4woFsfJUjEGk1VpC6imOTGwGWpK1dmqex3niZnQbF7XW/upFQrKbMht7I4UWrQkgmFx8cMnkk7J6X8XyHQVzt7QRltpZ1pQC8D47qzV5xkZJLWMooDNRz9lRJOXhSignatureValueOUDE1epHFLzW7vGajqmq36eHQiy9GEG4GVcCn8CDkEWJy1GGRz1iVx8ySh/GBLOYkXYaRgNCAviSigValueUlSkrNbEOEJg8g1LsTB5LilMp1CSyxSPXXHrx+ZA6bnLHJzpz273cj7/SL4O+M8GXI3aqXB76DLCSSKaBWL8wAgXL5uWWRVKgSA==Base64EncodedCertData==testuser2https://ptest2.uat.example.com/authgatewaytestuser1@pentest.localTest User1urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
5. insert a misspelled assertion with a correct xmlns. This must be in front of the valid assertion. The test below inserts an assertion with a NameID of "leavey" instead of the valid assertion with a NameID of testuser1. Search for "Assetion" in the data below, this is the misspelled assertion tag. http://pentestadfs.pentest.local/adfs/services/trusthttp://pentestadfs.pentest.local/adfs/services/trustleaveyhttps://ptest2.uat.example.com/authgatewaytestuser1@pentest.localTest User1urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransporthttp://pentestadfs.pentest.local/adfs/services/trusthdMwdq4IaOlYxj9IWdXdMqsmcw1TS9LeBPWZ392BJiU=lK2csDXHq462wPEjWKFNZXYz4woFsfJUjEGk1VpC6imOTGwGWpK1dmqex3niZnQbF7XW/upFQrKbMht7I4UWrQkgmFx8cMnkk7J6X8XyHQVzt7QRltpZ1pQC8D47qzV5xkZJLWMooDNRz9lRJOXh8nPel4zraOUDE1epHFLzW7vGajqmqSignatureValue1GGRz1iVx8ySh/GBLOYkXYaRgNCAvi1uQE93r4balUlSkrNbEOEJg8g1LsTB5LilMp1CSyxSPXXHrx+ZA6bnLHJzpz273cj7/SL4O+M8GXI3aqXB76DLCSSKaBWL8wAgXL5uWWRVKgSA==Base64EncodedCert==testuser1https://ptest2.uat.example.com/authgatewaytestuser1@pentest.localTest User1urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
6. An error page must be shown.

[pitbulk]

Remove the spaces

[pitbulk]

🐠

Keep adding validations! we want this toolkit as secure as the php/python/ruby toolkits! gogogo!