ERROR: cannot validate signature on Response: Could not verify certificate against trusted certs

[gourlaa]

Hi,

We have an issue since the last commit. We just have to fork the repo and go back to the version before August.
Do you know why ?

2018/09/17 15:28:19 RESPONSE: ===
<samlp:Response ID="_b44ec1fc-4c6b-427b-9816-f963e26e03a3" Version="2.0" IssueInstant="2018-09-17T15:28:19.239Z" Destination="https://team-preprod.braineet.com/saml/acs" InResponseTo="id-be7faf3e13e6746e0f7fe0a9d4f9c86951631e43" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">https://sts.windows.net/b82c86db-0af9-44fc-b1bc-dc394d5788e5/</Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><Assertion ID="_337d7aec-4d5b-4bcd-9a24-25133e56b967" IssueInstant="2018-09-17T15:28:19.223Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion"><Issuer>https://sts.windows.net/b82c86db-0af9-44fc-b1bc-dc394d5788e5/</Issuer><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><SignedInfo><CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><Reference URI="#_337d7aec-4d5b-4bcd-9a24-25133e56b967"><Transforms><Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>56DNnutCE2eAA+Xosg3Vnlm3pg4YPs8Apf2JMTEKpyQ=</DigestValue></Reference></SignedInfo><SignatureValue>nkxIViGlA2Yla******************==</SignatureValue><KeyInfo><X509Data><X509Certificate>MIIDBTC******************</X509Certificate></X509Data></KeyInfo></Signature><Subject><NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">CdWXbKwrtQuOuAgsxnrIM6hrpBL4hzg7DTUxTcGHrA8=</NameID><SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData InResponseTo="id-be7faf3e13e6746e0f7fe0a9d4f9c86951631e43" NotOnOrAfter="2018-09-17T15:33:19.223Z" Recipient="https://team-preprod.braineet.com/saml/acs"/></SubjectConfirmation></Subject><Conditions NotBefore="2018-09-17T15:23:19.223Z" NotOnOrAfter="2018-09-17T16:23:19.223Z"><AudienceRestriction><Audience>https://team-preprod.braineet.com/saml/metadata</Audience></AudienceRestriction></Conditions><AttributeStatement><Attribute Name="http://schemas.microsoft.com/identity/claims/tenantid"><AttributeValue>b82c86db-0af9-44fc-b1bc-dc394d5788e5</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/objectidentifier"><AttributeValue>4e1fda94-c1a1-43d9-b83d-0e525b3856f8</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"><AttributeValue>X</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"><AttributeValue>Gourlaouen</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"><AttributeValue>Pierre</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/displayname"><AttributeValue>Pierre Gourlaouen</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/identityprovider"><AttributeValue>https://sts.windows.net/b82c86db-0af9-44fc-b1bc-dc394d5788e5/</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/claims/authnmethodsreferences"><AttributeValue>http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</AttributeValue><AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue></Attribute><Attribute Name="http://schemas.microsoft.com/identity/claims/agegroup"><AttributeValue>3</AttributeValue></Attribute></AttributeStatement><AuthnStatement AuthnInstant="2018-09-17T15:28:03.339Z" SessionIndex="_337d7aec-4d5b-4bcd-9a24-25133e56b967"><AuthnContext><AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef></AuthnContext></AuthnStatement></Assertion></samlp:Response>
===
NOW: 2018-09-17 15:28:19.484177586 +0000 UTC
ERROR: cannot validate signature on Response: Could not verify certificate against trusted certs

Thanks,

[Xoib]

Hello,

First approach (investigating August commits due to @gourlaa comment "go back to the version before August"):

Since the @crewjam merged #127 intermediates certificate are now included.

An intermediate certificate of @gourlaa website might contain a signature algorithm of SHA-256 ECDSA.

Now, @d4l3k tried to warn us with #153 and I think thanks to #126 @apilloud thought it would be enough to handle the different signature algorithm.

Second approach (doing local testing against @gourlaa website):

The certificate chain delivered by @gourlaa website contain the website certificate and the intermediate certificate authority but not the root certificate authority. Therefore, the intermediate certificate can't be verified.

Nevertheless the major root certificates authority should be within the trust store of your server.

Thus @gourlaa, depending of your distribution you'll have to install ca-certificates package and then could you run an update-ca-certificates as root and try again after relaunching the web server.

Cheers,
Sacha.

[tchataigner]

Hello,

I am currently trying out the package and I encountered the same problem as @gourlaa. I reused the example that is proposed in the READE.md and used https://samltest.id as the idp tester because https://testshib.org seems not usable anymore.

Everything works well until i get redirected on /saml/acs where my request returns with a forbidden code.

Edit: Also I already tried to update the certificates and nothing has changed

I hope what I just explained was clear enough.

Best Regards,

[gourlaa]

Hello,

I just found the solution, it's was a bug of @crewjam!

When you get the x509 certificate from the medata provider, the code just get the first signing certificate. However often their are multiple root certificates!

This function in service_provider:
func (sp *ServiceProvider) getIDPSigningCert() (*x509.Certificate, error)

Must return an array of certificates like this:
func (sp *ServiceProvider) getIDPSigningCert() ([]*x509.Certificate, error)

I have this metadata for example:
<IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <KeyDescriptor use="signing"> <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> <X509Data> <X509Certificate> X1 </X509Certificate> </X509Data> </KeyInfo> </KeyDescriptor> <KeyDescriptor use="signing"> <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"> <X509Data> <X509Certificate> X2 </X509Certificate> </X509Data> </KeyInfo> </KeyDescriptor> <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.microsoftonline.com/b82c86db-0af9-44fc-b1bc-dc394d5788e5/saml2"/> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://login.microsoftonline.com/b82c86db-0af9-44fc-b1bc-dc394d5788e5/saml2"/> <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/b82c86db-0af9-44fc-b1bc-dc394d5788e5/saml2"/> </IDPSSODescriptor>

As we see, their is multiple X509 certificate and the provider choose one of them.

I forked the repository, you can use my repository, just the time for @crewjam to correct this implementation. We can find also an another pull request #181, it's the same correction and both issue are linked.
=> https://github.com/braineet/saml/

I also added the pull request of #178.

Have a good day,

[crewjam]

closing because it looks like this is fixed.