rack-saml Assertion Consumer Service binding

Question

I am using rack-saml as middleware with omniauth-shibboleth to allow my app to work as a Service Provider.

I would like to know how to set the binding for an Assertion Consumer Service (ACS) url?

Presently my ACS url binding is 'any'. However, I have searched in rack-saml and omniauth-shibboleth to find where this is being set, and have not been able to find it.

I am trying to get my app working with testshib.org in hopes of using the app with a similarly configured Identity Provider (IdP).

I have uploaded my metadata to testshib.org. I am not sure how to implement their custom shibboleth.xml file; however my app is able to redirect to their IdP login page and cookies are set by their IdP.

Hear are some errors from the testhib.org logs.

20:14:15.864 - WARN [org.opensaml.saml2.binding.AuthnResponseEndpointSelector:206] - Relying party 'https://test_shib.com' requested the response to be returned to endpoint with ACS URL 'https://test_shib.com:443/auth/shibboleth/callback'  and binding 'any' however no endpoint, with that URL and using a supported binding,  can be found in the relying party's metadata 

20:14:15.864 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.AbstractSAMLProfileHandler:447] - No return endpoint available for relying party https://test_shib.com

Any help would be greatly appreciated.

Answer 1

There may be a better way to do this; but I got things working by overriding Onelogin::Saml::Authrequest (and the other classes that called Onelogin::Saml::Authrequest) and then changing AssertionConsumerServiceURL to AssertionConsumerService in the create method.

Answer 2

in lib/rack/saml.rb you will find:

 @config['assertion_consumer_service_uri'] ||= "#{saml_sp_prefix}#{@config['protected_path']}"

So, in your config/rack-saml.yml you can configure it like this (and you may need to if having the port number in the uri causes problems):

assertion_consumer_service_uri: https://www.abc.edu/users/auth/shibboleth/callback

Also, you shouldn't need anything from their shibboleth2.xml file, Just put the certificate from their provider's xml in your metadata.yml config file:

---
idp_lists:
  https://idp.testshib.org/idp/shibboleth:
    certificate: |-
      -----BEGIN CERTIFICATE-----
      MIIEDjCCAvagAwIBAgIBADANBgkqhkiG9w0BAQUFADBnMQswCQYDVQQGEwJVUzEV
      ...
      8K/qhmFT2nIQi538n6rVYLeWj8Bbnl+ev0peYzxFyF5sQA==
      -----END CERTIFICATE-----
    saml2_http_redirect: https://idp.testshib.org/idp/profile/SAML2/Redirect/SSO