Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-5120

SAML2 SP in a sub-realm not fully functional after OPENAM-474

    Details

    • Sprint:
      Sprint 76 - Sustaining
    • Support Ticket IDs:

      Description

      When having a SP in a subrealm with 11.0.2, some functionality is lost. Through testing I confirmed that auto-federation is an issue as well as creating a user account locally.

      To reproduce:

      Create a SP in a sub-realm
      Enable Auto-Federation

      (I used NameID Format transient and Dynamic profile, but there are issues in other configurations too)

      The issue is caused by the fix for OPENAM-474, more specifically in FMSessionProvider.java:

         ac.login(AuthContext.IndexType.MODULE_INSTANCE, "Federation", null, null, request, response);
      

      At some point during the SAML process, the realm coming from the authentication context is compared (and must match) the realm coming from the query string. However the piece of code above means that the organization parameter for the query string returns null; instead, the code will then use DNS Alias to determine the realm, which ends up being the top realm; as it does not match, authentication fails.

      Workaround:

      The following workaround worked for me:

      Make sure alias.example.com can be accessed from outside
      Access as usual: http://sp.example.com:8080/openam/saml2/jsp/spSSOInit.jsp?idpEntityID=idp&metaAlias=/test/sp

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                peter.major Peter Major [X] (Inactive)
                Reporter:
                nathalie.hoet Nathalie Hoet
              • Votes:
                1 Vote for this issue
                Watchers:
                8 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - Not Specified
                  Not Specified
                  Logged:
                  Time Spent - 5h
                  5h