SAML single log out

 SAML single log out has two cases

SP initiated

SP Client Logout -> SP server Logs Out -> Sends SLO request to IDP -> IDP clear session -> Send SLS to SP -> SP redirects

IDP initiated

SP2 Client Logout -> SP2 server Logs Out -> Sends SLO request to IDP -> IDP clear session -> Send request to SP 2-> SP2 redirects -> IDP sends SLS to SP -> SP logs out user -> SP sends SAML confirmation to IDP

NOTE: 

For SP initiated logout ,  IDP initiated logout, SP will either send SLO request to IDP or logout confirmation request to IDP, the IDP end point should be the same.

Since in both scenarios IDP will send a request to SP's SLO end point

to check which scenario it is, SP should check the SAML XML data in the request from IDP :

https://github.com/SAML-Toolkits/python-saml/blob/master/src/onelogin/saml2/auth.py

For SP initiated logout, IDP data should contain "SAMLResponse" attribute

     if 'get_data' in self.__request_data and 'SAMLResponse' in self.__request_data['get_data']:

becasue SP send IDP LogoutRequest prioro like :

<samlp:LogoutRequest ></samlp:LogoutRequest>

usually SP will ad a relaystate attribute: mysp/slo to tell IDP where to go(dont need it)

For IDP initiated logout, IDP data should contain "SAMLRequest" attribute

     elif 'get_data' in self.__request_data and 'SAMLRequest' in self.__request_data['get_data']:

then SP should then send a redirect(depending on binding) "LogoutResponse" to IDP. note this redirect did not get triggered by client so client wont see anything

<samlp:LogoutResponse ></samlp:LogoutResponse>

    

SAML SP send request twice

 Yes, in most cases, the original request will be sent twice:

1. First Request (Before Authentication)

   • The client sends a request to the Service Provider (SP) for a protected resource.
   • The SP detects no active session and redirects the client to the Identity Provider (IdP) for authentication.

2. SAML Authentication Flow

   • The client logs in at the IdP.
   • The IdP sends a POST request to the SP’s Assertion Consumer Service (ACS) with the SAML Assertion.

3. Second Request (After Authentication)

   • The SP validates the SAML assertion and creates a session.
   • The SP redirects the client back to the original resource.
   • The client sends a second request for the original resource.

Important Notes:

• The first request is incomplete because the user isn't authenticated yet.
• The SP does not process the first request immediately but instead remembers it (e.g., using RelayState or session storage).
• After authentication, the SP triggers the second request via redirection.

Exception:

• If the original request is a POST request with a payload, it might not be automatically retried unless the SP explicitly replays it.
• In such cases, some SPs show an intermediate page asking the user to resubmit the form.

Would you like details on handling POST requests with payloads in SAML flows?

pytho3, python3-saml, xml upgrade library version mismatch 2024

 https://github.com/xmlsec/python-xmlsec/issues/320

!!!!!!!!!!!!!!!!!!!!! be wary when doing docker-compose build --no-cache

“lxml & xmlsec libxml2 library version mismatch” error under uWSGI

It seems like lxml@5.2.1 uses libxml2@2.12.6. However, libxml2@2.12.7 has been released, and python-xmlsec@1.3.14 breaks because of this libxml2 version mismatch (?)

Fix:

in requirements.txt

lxml==4.9.3
xmlsec==1.3.13
python3-saml==1.11.0

saml IDP send to sp acs, base 64 encode response, python base64 utf-8(each letter is 1-4 bytes), python idp

 saml IDP send to sp acs 

by respond 200 http status code after user login in IDP page, and return an html with javascript that posts to sp'acs on browser with base 64 encoded saml response

https://security.stackexchange.com/questions/264406/can-someone-please-clarify-about-how-the-saml-response-is-sent-back-from-idp-to

"

1. The IdP returns a 200 HTTP response to the browser. The content is an HTML form with the SAML response encoded as a hidden form variable. Typically there's also some JavaScript to automatically submit the form so the user doesn't have to click a button etc. The result is an HTTP Post of the SAML response and other post data to the SP. In other words, the IdP doesn't send the SAML response directly to the SP. It's sent via the browser.

2. HTTP-Redirect and HTTP-Post are the most commonly used SAML bindings (ie transports). Both see messages between the IdP and SP being sent via the browser. There is no direct IdP - SP communication with these bindings.

3. The SAML authn request sent to the IdP can be sent using with the HTTP-Redirect or HTTP-Post binding. If the HTTP-Post binding is used, it's exactly the same mechanism used by the IdP when it sends the SAML response.

For a more detailed explanation, refer to the "Bindings for the OASIS Security Assertion Markup Language (SAML) V2.0" specification."

sample HTML 

"<html>

  <body Onload="document.forms[0].submit()">
    <form method="POST" action="<%= request.getAttribute("wbsso_endpoint") %>">
      <input type="hidden" name="SAMLRequest" value="<%= request.getAttribute("SAMLRequest") %>">
      <% if (request.getAttribute("RelayState") != null) { %>
        <input type="hidden" name="RelayState" value="<%= request.getAttribute("RelayState") %>">
      <% } %>
    </form>
  </body>
</html>"

https://stackoverflow.com/questions/48700273/saml2-submitting-xml-samlrequest-value-in-a-form

return HttpResponse(content='<html><body Onload="document.forms[0].submit()"><form method="POST>...", content_type="text/html)

Base64
SAML protocol uses the base64 encoding algorithm when exchanging SAML messages. If you intercept a SAML Message, you will turn it in plain-text through base64 decoding.
https://developers.onelogin.com/saml/online-tools/code-decode/base64#:~:text=SAML%20protocol%20uses%20the%20base64,plain%2Dtext%20through%20base64%20decoding.

python base64 eoncde takes binary only

for string need to conver to binary(utf-8, encoding pirncipal convert letter to numbe, using 8 bits unit)

https://www.ibm.com/docs/en/db2-for-zos/12?topic=unicode-utfs

UTF-8 is based on 8-bit code units. Each character is encoded as 1 to 4 bytes. The first 128 Unicode code points are encoded as 1 byte in UTF-8.

import base64

string_data = 'Hello, World!'

byte_data = string_data.encode('utf-8')

encoded_data = base64.b64encode(byte_data)

print(encoded_data)

# Output:

# b'SGVsbG8sIFdvcmxkIQ=='

Python idp server:

https://github.com/EmilJunker/python-saml-idp/blob/main/idp.py#L222