KB No. 07: Analysis of the SAML response sent by the IDP to Olfeo SaaS

Why analyze a SAML response?

A SAML response contains crucial information about the authentication and authorization process to the service provider. Analyzing it can help you identify exactly where a problem occurred. This may include fields at the assertion level, identity attributes, certificates, digital signatures, timestamps, etc.

Analyzing the SAML response is relevant when an authentication problem occurs or when the user session with the service provider (Olfeo SaaS) cannot be established. This analysis will enable you to adapt or correct your IDP configuration.

The initial purpose of this document is to provide you with some basic information about how the SAML protocol works, and then to give you the keys you need to analyze the SAML response for troubleshooting purposes.

 

The SAML protocol in brief

SAML, which stands for "Security Assertion Markup Language," is a security protocol used to exchange authentication and authorization information between different computer systems, typically between an identity provider (IdP) and a service provider (SP), in this case the SaaS Olfeo. Here is a summary of the main features of SAML:

  • Single Sign-On (SSO): SAML allows users to log in once to a central authentication service (Identity Provider – IdP) and then access multiple applications (service provider – SP) without having to re-enter their credentials (except for time-limited tokens).
  • Identity federation: SAML facilitates collaboration between different organizations by allowing users from one organization to securely log in to services belonging to another organization.
  • Security assertion: When a user logs in, the identity provider generates a security assertion that contains information about the user and the permissions granted. This assertion is then sent to the service provider, which decides whether to grant access based on this information.
  • XML-based: SAML assertions are typically encoded in XML, making them easily readable by SAML-compatible systems and applications.
  • Security: SAML uses encryption and digital signature mechanisms to ensure the integrity and confidentiality of authentication and authorization data during transmission between different parties.
  • Various usage scenarios: SAML is used in a variety of scenarios, such as access to cloud applications, web services, enterprise portals, etc.

 

SAML authentication sequence

Here are the main steps in a SAML authentication sequence between an IDP, an SP (in this case Olfeo SaaS), and the user's web browser:

  1. Request for access to SP: The user attempts to access SP using a web browser.
  2. SAML request generation: The SP identifies that the user is not yet authenticated and generates a SAML authentication request, which is encoded and integrated into the URL associated with the IDP's SSO service.
  3. Redirection to the IDP: The SP sends a redirection URL to the user's browser. This URL includes the encoded authentication request that must be sent to the IDP's SSO service. It includes information about the requested service (Assertion Consumer Service – ACS) and a unique request identifier (Request Identifier).
  4. Authentication by the IDP: The IDP decodes the SAML request and verifies the user's authentication (for example, via a username and password). Once authentication is successful, the IDP creates a SAML token containing information about the user's identity and the necessary attributes.
  5. Creation of the SAML assertion: The IDP generates a SAML assertion that contains the user's authentication information. In accordance with SAML 2.0 specifications, this assertion is digitally signed by the IDP to guarantee its integrity and origin.
  6. Redirection to the SP with the SAML assertion: The IDP encodes the response by including the SAML assertion. It redirects the user to the ACS (Assertion Consumer Service). The SP verifies the digital signature of the assertion to ensure that it originates from the IDP.
  7. Processing of the assertion by the SP: The SP receives the SAML assertion, verifies the digital signature of the assertion to ensure that it originates from the IDP, and extracts the authentication information. This information can be used by the SP to authorize access to the requested resources.
  8. Establishing the user session: The SP creates a user session for the authenticated user and grants them access to the requested services. The user can now interact with the SP's services without having to provide additional credentials for the duration of the session.

 

Capturing the SAML response

The SAML response contains crucial information about the authentication and authorization process to the service provider. Analyzing it can help you identify exactly where a problem occurred. This may include fields at the assertion level, identity attributes, certificates, digital signatures, timestamps, etc.

To retrieve the SAML response (step 6 in the previous diagram), it must be captured at the client web browser level. To do this, we recommend using the SAML-Tracer extension available for Edge or Firefox browsers. The SAML response can then be viewed in XML format using Notepad++.

 

SAML response analysis

Assertion Status:

The element in a SAML response is used to indicate the status of the request or operation associated with the SAML assertion. It provides information about the outcome of the transaction or authentication, whether it was successful or an error. Ensure that the element in the SAML response indicates a successful status.

Some examples of possible statuses:

  • Success: Indicates that the operation was successful.
  • VersionMismatch: Indicates that the SAML version in the request does not match the version supported by the receiver.
  • AuthnFailed: Indicates that authentication failed for the user.
  • InvalidAttrNameOrValue: Indicates that the attributes provided in the request are invalid. In this case, it is usually the format or value of the NameID (Name Identifier) attribute that is incorrect.

 

NameID attribute:

NameID plays a key role in the authentication, authorization, and identity management process. Thanks to NameID, the SP receiving the SAML assertion can uniquely identify the user and make decisions based on this identification.

The identifying property (green box) defined when synchronizing your directory with Olfeo SaaS must be used for the NameID attribute. You must also ensure that the domain (red box) is entered correctly. Note that Olfeo SaaS uses UserPrincipalName as the default identifying property.

If you defined SamAccountName as the identifier property when synchronizing your directory, you must modify your IDP claims so that it associates SamAccountName with the NameID passed in the authentication response. For more information on this topic, see " Configure and manage directories."

 

Transmitter:

The SAML assertion attribute must contain the unique identifier of the issuing IDP. Ensure that this issuer is the one expected by the SP. It must also be present in the SAML response.

 

Destination:

The response URL (ACS) tells the identity provider (IdP) where to send the SAML assertion once the user has been authenticated. The response URL (ACS) must be located in the "destination" field of the SAML response. Note that you should also find the response URL (ACS) in the SAML assertion element.

 

Audience:

In a SAML assertion, the field is used to define constraints on the audience for which the assertion is intended. In other words, it specifies the entities (services, applications, service providers) that are authorized to receive and consume this assertion.

 

Digital Signature:

The SAML assertion must be digitally signed by the IDP to guarantee its integrity and origin. Signing the assertion is the minimum requirement; a signed SAML response with a signed assertion is also possible. Remember to check for the presence of the certificate and signature, as well as the use of at least the SHA 256 algorithm.

 

Terms and Conditions:

Verify that the temporal conditions (element) of the SAML assertion are satisfied. This includes validity timestamps, to ensure that the assertion is issued and used during the appropriate period (elements and ). There may also be other conditions if they are specified; in our case, there is a condition on the audience (discussed earlier in the document).

 

Authentication Method:

L’élément <AuthnContext> spécifie la méthode d’authentification utilisée. Dans le cadre d’Olfeo Saas sa valeur doit être : Password.

 

Encoding:

Verify that the SAML assertion is correctly encoded (e.g., base64) for transport.