0 Replies Latest reply on Sep 10, 2018 3:51 AM by Rajas Shah

    Facing endless loop between SP and IDP while using PicketLink for SSO

    Rajas Shah Newbie

      I have an application configured for SSO using PicketLink 2.5.5 with WildFly10. I am using PingFederate as CAS.

      When I try to access application, then I get login screen of CAS. It gets authenticated and when SAML response comes back to SP, then it goes into endless loop between SP and IDP.

      I am not able to figure out what I am missing here.

       

      here is SAML request :

      <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns="urn:oasis:names:tc:SAML:2.0:assertion" AssertionConsumerServiceURL="http://rshah2l1:8080/InService/delivery/" Destination="https://rshah2l1:9031/idp/SSO.saml2" ForceAuthn="false" ID="ID_b77f5ec3-1b2c-4eed-9c11-92bfea83a79a" IsPassive="false" IssueInstant="2018-09-06T08:38:36.065Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">

      <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://rshah2l1:8080/InService/delivery/</saml:Issuer>

      <samlp:NameIDPolicy AllowCreate="true" Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>

      </samlp:AuthnRequest>

       

      Below is SAML response:

      <samlp:Response Version="2.0" ID="aQSD71sQgy7IlTuHu6cWAUGx73i" IssueInstant="2018-09-06T08:41:15.115Z" InResponseTo="ID_b77f5ec3-1b2c-4eed-9c11-92bfea83a79a" Destination="http://rshah2l1:8080/InService/delivery/" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">

      <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">rajas-pingfed</saml:Issuer>

      <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">

      <ds:SignedInfo>

      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

      <ds:Reference URI="#aQSD71sQgy7IlTuHu6cWAUGx73i">

      <ds:Transforms>

      <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>

      <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>

      </ds:Transforms>

      <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>

      <ds:DigestValue>INMcEnnhE4rWaFwj0X9mVWIOA/etfLFnqGUdXCbghlc=</ds:DigestValue>

      </ds:Reference>

      </ds:SignedInfo>

      <ds:SignatureValue>

      fK3hL3rF62Ow315SB3zoMSto2YuDHyJsb7qjaptIXtBVJvev2pQDxed4TRPUt5vB8+f8isXfEKRg

      nN1RB7Yc+6HL7TMNVw2nHBiu+HKo74k8RkzXdLmNKCvgm1YVMmgkS1NMn3Wk3B8rnR18f1zfcdf+

      Y1ZWnxTe7hMpBNnQl+M1atksVvUXbK/TidxEVTvyss22uvl8nTb6EpjERfOeEPEsc9RdgLKaK1LD

      4m9HG/MqGnUBNhfpZJ0ekudmVz+OhwLszELs/vuCZB3qCkDJ0aG+JBY670MpuPoKa8A9yU8U2/Vk

      E3/4kD0lSn7X2mYU268JLAdI5yQirdGUZfLaCQ==

      </ds:SignatureValue>

      </ds:Signature>

      <samlp:Status>

      <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>

      </samlp:Status>

      <saml:Assertion ID="etQuz6b5RmctBrnBU8ubu8SDyun" IssueInstant="2018-09-06T08:41:15.120Z" Version="2.0" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">

      <saml:Issuer>rajas-pingfed</saml:Issuer>

      <saml:Subject>

      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">test</saml:NameID>

      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">

      <saml:SubjectConfirmationData Recipient="http://rshah2l1:8080/InService/delivery/" NotOnOrAfter="2018-09-06T16:41:15.120Z" InResponseTo="ID_b77f5ec3-1b2c-4eed-9c11-92bfea83a79a"/>

      </saml:SubjectConfirmation>

      </saml:Subject>

      <saml:Conditions NotBefore="2018-09-06T07:41:15.120Z" NotOnOrAfter="2018-09-06T16:41:15.120Z">

      <saml:AudienceRestriction>

      <saml:Audience>http://rshah2l1:8080/InService/delivery/</saml:Audience>

      </saml:AudienceRestriction>

      </saml:Conditions>

      <saml:AuthnStatement SessionIndex="etQuz6b5RmctBrnBU8ubu8SDyun" AuthnInstant="2018-09-06T08:41:15.118Z">

      <saml:AuthnContext>

      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>

      </saml:AuthnContext>

      </saml:AuthnStatement>

      <saml:AttributeStatement>

      <saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified">

      <saml:AttributeValue xsi:type="xs:string" xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">test</saml:AttributeValue>

      </saml:Attribute>

      </saml:AttributeStatement>

      </saml:Assertion>

      </samlp:Response>

      Please help me out.