signing, decryption, and relay state HMAC-SHA1 for service providers #4
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
A demo SP is provided in dev/demo_sp.clj. This version adds the following: - Validate the signature of the IdP responses - Decryption of the IdP supplied assertions - Creation of SAML Metadata - SP related 'routes', check the saml20-clj/routes.clj file Please keep in mind that in order to use it you need to create a private and public key pair and store them in a Java keystore file (use the 'keytool').
the SP interoperates successfully with the testshib (https://www.testshib.org) IdP (found at https://idp.testshib.org/)
According to the SAML Bindings specification "RelayState data MAY be
included with a SAML protocol message" transmitted with the
HTTP-Redirect binding. But "because the value is exposed to third-party
tampering, the entity SHOULD ensure that the value has not been tampered
with by using a checksum, a pseudo-random value, or similar means". In
the current implementation we create a "secret key" on starutp that is
later on used to create a keyed-hash message authentication code (HMAC)
using SHA-1 as the secure hash algorithm. What is currently hashed is the
"continue-url" information, to produce the following as relay state:
<continue-url>:<hmac-sha1(continue-url, secret-key)>
On the arrival of the response the relay state data is again validated
and if the continue-url does not match its hashed value the response
is rejected.
Set the canonicalizer declaration in the signature as well
jrdoane
added a commit
that referenced
this pull request
Feb 20, 2016
signing, decryption, and relay state HMAC-SHA1 for service providers
|
Sorry it took a while to get back to this, I haven't really been working on this library. I may be updating parts of this because this was one of my first Clojure projects and I think that a little bit of clean-up is in order. |
|
@sgsfak This is in Clojars now with the version I bumped versions and change some dep ordering to keep versions playing nicely as well. |
|
Thanks Jon, I will test it when time permits |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.