Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-9719

session upgrade fails in combination with SAML-based SSO

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved
    • Critical
    • Resolution: Fixed
    • 13.0.0, 13.5.0
    • 13.5.1, 14.0.0
    • authentication, XUI
    • AM Sustaining Sprint 28

    Description

      1) Create an AuthChain 'datastoreService' with 'datastore' as required module
      2) Create and AuthChain 'twofactor' with 'datastore' and 'HOTP' as required modules
      3) Adopt AuthContexts of the IdP to map 'PasswordProtectedTransport' AuthContextClassRef to service 'datastoreService' and level '1'.
      4) Adopt AuthContexts of the IdP to map 'TimeSyncToken' to service 'twofactor' and level '2'.
      5) Authenticate at OpenAM with default auth chain of the realm where the CoT was created
      6) Run SP-initiated SSO with AuthContextClassRef 'TimeSyncToken' on the Fedlet sample app

      After submitting the OTP for the 2nd auth-module of the two factor chain, XUI responds with error Required callback not found in JSON response

      Performing the same session upgrade without the SAML flow works fine.
      i.e.
      1) Authenticate at OpenAM with default auth chain
      2) Authenticate with params &authIndexType=service&authIntexType=twofactor

      Comparing the HTTP POST requests for the 'HOTP2' stage between does not show a significant difference, see attached excerpts from network capture.

      Attachments

        Issue Links

          Activity

            People

              peter.major Peter Major [X] (Inactive)
              bthalmayr Bernhard Thalmayr
              Nemanja Lukic Nemanja Lukic
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 0h
                  0h
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 4h
                  4h