Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle stored request state without returnurl during OWIN error response #935

Merged
merged 2 commits into from
Mar 29, 2018
Merged

Handle stored request state without returnurl during OWIN error response #935

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
609d2b8
handle stored request state without returnurl during OWIN error response
explunit Mar 26, 2018
1473154
Do not restore authproperties from relaystate for error response
explunit Mar 29, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 4 additions & 9 deletions Sustainsys.Saml2.Owin/Saml2AuthenticationHandler.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,12 +60,10 @@ protected async override Task<AuthenticationTicket> AuthenticateCoreAsync()
[System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Naming", "CA2204:Literals should be spelled correctly", MessageId = "ReturnUrl")]
private AuthenticationTicket CreateErrorAuthenticationTicket(HttpRequestData httpRequestData, Exception ex)
{
AuthenticationProperties authProperties = null;
if (httpRequestData.StoredRequestState != null)
{
authProperties = new AuthenticationProperties(
httpRequestData.StoredRequestState.RelayData);
var authProperties = new AuthenticationProperties();

if (httpRequestData.StoredRequestState?.ReturnUrl != null)
{
// ReturnUrl is removed from AuthProps dictionary to save space, need to put it back.
authProperties.RedirectUri = httpRequestData.StoredRequestState.ReturnUrl.OriginalString;
}
Expand All @@ -83,10 +81,7 @@ private AuthenticationTicket CreateErrorAuthenticationTicket(HttpRequestData htt

redirectUrl = httpRequestData.ApplicationUrl;
}
authProperties = new AuthenticationProperties
{
RedirectUri = redirectUrl.OriginalString
};
authProperties.RedirectUri = redirectUrl.OriginalString;
}

// The Google middleware adds this, so let's follow that example.
Expand Down
72 changes: 72 additions & 0 deletions Tests/Owin.Tests/Saml2AuthenticationMiddlewareTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -978,6 +978,78 @@ public async Task Saml2AuthenticationMiddleware_AcsRedirectsToAuthPropsReturnUri
context.Authentication.AuthenticationResponseGrant.Should().BeNull();
}

[TestMethod]
public async Task Saml2AuthenticationMiddleware_AcsRedirectsToAuthProps_StoredRequestStateWithNoReturnUrl()
{
var context = OwinTestHelpers.CreateOwinContext();
context.Request.Method = "POST";

var authProps = new AuthenticationProperties();

var state = new StoredRequestState(new EntityId("https://idp.example.com"),
null,
new Saml2Id("InResponseToId"),
authProps.Dictionary);

var relayState = SecureKeyGenerator.CreateRelayState();

var cookieData = HttpRequestData.ConvertBinaryData(
CreateAppBuilder().CreateDataProtector(
typeof(Saml2AuthenticationMiddleware).FullName)
.Protect(state.Serialize()));

context.Request.Headers["Cookie"] = $"{StoredRequestState.CookieNameBase}{relayState}={cookieData}";

var response =
@"<saml2p:Response xmlns:saml2p=""urn:oasis:names:tc:SAML:2.0:protocol""
xmlns:saml2=""urn:oasis:names:tc:SAML:2.0:assertion""
ID = """ + MethodBase.GetCurrentMethod().Name + @""" Version=""2.0""
IssueInstant=""2013-01-01T00:00:00Z"">
<saml2:Issuer>
https://idp.example.com
</saml2:Issuer>
<saml2p:Status>
<saml2p:StatusCode Value=""urn:oasis:names:tc:SAML:2.0:status:Success"" />
</saml2p:Status>
<saml2:Assertion
Version=""2.0"" ID=""" + MethodBase.GetCurrentMethod().Name + @"_Assertion1""
IssueInstant=""2013-09-25T00:00:00Z"">
<saml2:Issuer>https://idp.example.com</saml2:Issuer>
<saml2:Subject>
<saml2:NameID>SomeUser</saml2:NameID>
<saml2:SubjectConfirmation Method=""urn:oasis:names:tc:SAML:2.0:cm:bearer"" />
</saml2:Subject>
<saml2:Conditions NotOnOrAfter=""2100-01-01T00:00:00Z"" />
</saml2:Assertion>
</saml2p:Response>";

// No signature, that's an error.
var bodyData = new KeyValuePair<string, string>[] {
new KeyValuePair<string, string>("SAMLResponse",
Convert.ToBase64String(Encoding.UTF8.GetBytes(response))),
new KeyValuePair<string, string>("RelayState",relayState)
};

var encodedBodyData = new FormUrlEncodedContent(bodyData);

context.Request.Body = encodedBodyData.ReadAsStreamAsync().Result;
context.Request.ContentType = encodedBodyData.Headers.ContentType.ToString();
context.Request.Host = new HostString("localhost");
context.Request.Path = new PathString("/Saml2/Acs");

var middleware = new Saml2AuthenticationMiddleware(null, CreateAppBuilder(),
new Saml2AuthenticationOptions(true)
{
SignInAsAuthenticationType = "AuthType"
});

await middleware.Invoke(context);

context.Response.StatusCode.Should().Be(302);
context.Response.Headers["Location"].Should().Be("http://localhost/LoggedIn?error=access_denied");
context.Authentication.AuthenticationResponseGrant.Should().BeNull();
}

[TestMethod]
public async Task Saml2AuthenticationMiddleware_AcsWorks()
{
Expand Down