Single Sign on using SAML Sender Vouches example

Scenario: A web services consumer sends a SOAP 1.1 message protected with a X.509 XML signature to the provider. The message contains a timestamp, SAML assertion, SecurityTokenReference, BinarySecurityToken, Signature. The SAML assertion must be signed according to the SecurityTokenReferenceTransform (see section 8.3 from http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0.pdf).

When computing the C14N of the SAML assertion. Correct handling of the default namespace needs to be ensured: A namespace declaration xmlns="" MUST be emitted with every apex element that has no namespace node declaring a value for the default namespace; cf. XML Decryption Transform.
- SOAP Version: 1.1

- Addressing: No (optional)

- Signature Certificate: RSA or DSA

- Timestamp: Yes (precision: seconds)

- Signed parts: Timestamp, Body, SAML assertion over STR transform

- Canonicalization: XML-EXC-C14N

- Signature: SHA1 (WS-SP asymmetric key binding)

Example Message:

<test:Envelope xmlns:test="http://schemas.xmlsoap.org/soap/envelope/" xmlns:s11="http://schemas.xmlsoap.org/soap/envelope/">
  <test:Header>
    <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" AssertionID="_6221ece8-1c27-41e6-85d0-d8df92b9003f" IssueInstant="2021-03-31T14:41:03.797Z" Issuer="Axis" MajorVersion="1" MinorVersion="1">
        <Conditions NotBefore="2021-03-31T14:41:03.797Z" NotOnOrAfter="2021-03-31T15:24:42.114Z" />
        <AuthenticationStatement AuthenticationInstant="2021-03-31T14:41:03.797Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
          <Subject>
            <NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">BBUYER</NameIdentifier>
            <SubjectConfirmation>
              <ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:sender-vouches</ConfirmationMethod>
            </SubjectConfirmation>
          </Subject>
        </AuthenticationStatement>
      </Assertion>
      <wsse:SecurityTokenReference wsu:Id="STRSAMLId-8078a27f-43f5-47ee-b0b6-aa4164fa9b47">
        <wsse:Reference URI="#_6221ece8-1c27-41e6-85d0-d8df92b9003f" ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID" />
      </wsse:SecurityTokenReference>
      <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-1ef5d969-9344-49fd-9d9a-de605a68afa2">Certificate</wsse:BinarySecurityToken>
      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#" Id="SIG-ba9bbe38-568f-499a-8fff-e632a0eed9f5">
        <ds:SignedInfo>
          <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
          <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
          <ds:Reference URI="#STRSAMLId-8078a27f-43f5-47ee-b0b6-aa4164fa9b47">
            <ds:Transforms>
              <ds:Transform Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
                <wsse:TransformationParameters>
                  <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                </wsse:TransformationParameters>
              </ds:Transform>
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <ds:DigestValue>FADq9Qv94EFMObEywgrn8/RW5zk=</ds:DigestValue>
          </ds:Reference>
          <ds:Reference URI="#id-dd348b89-87fc-4565-9b5a-7dd5ebd911a7">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <ds:DigestValue>nJqp5hNEgKTY94oXv66K0jp/P8g=</ds:DigestValue>
          </ds:Reference>
          <ds:Reference URI="#TS-f697613a-608a-4094-9d09-570d882f408a">
            <ds:Transforms>
              <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </ds:Transforms>
            <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <ds:DigestValue>25sGhbndf+Roqhl2EJKjrZdlnw0=</ds:DigestValue>
          </ds:Reference>
        </ds:SignedInfo>
        <ds:SignatureValue>Signature</ds:SignatureValue>
        <ds:KeyInfo Id="KeyId-3f051cc8-51ac-40a1-80a2-08503c378723">
          <wsse:SecurityTokenReference wsu:Id="STRId-3b827d63-1956-4792-867f-c87deddef4cc">
            <wsse:Reference URI="#CertId-1ef5d969-9344-49fd-9d9a-de605a68afa2" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" />
          </wsse:SecurityTokenReference>
        </ds:KeyInfo>
      </ds:Signature>
      <wsu:Timestamp wsu:Id="TS-f697613a-608a-4094-9d09-570d882f408a">
        <wsu:Created>2021-03-31T14:41:03.797Z</wsu:Created>
        <wsu:Expires>2021-03-31T14:46:03.797Z</wsu:Expires>
      </wsu:Timestamp>
    </wsse:Security>
  </test:Header>
  <test:Body xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="id-dd348b89-87fc-4565-9b5a-7dd5ebd911a7">
    <n0:WSSE_ECHO xmlns:n0="urn:sap-com:document:sap:rfc:functions">
      <INPUT>some data</INPUT>
    </n0:WSSE_ECHO>
  </test:Body>
</test:Envelope>

----

Page tree

1 Comment

Unknown User (lw8ku2e)