Complete the SAML2 implementation

[richvdh]

This PR builds heavily on #5316, to fix #5130 by providing the 'client' part of the SAML flow by redirecting to the SAML identity provider.

[ineiti]

Can you give an example on how to activate sso in the configuration file?

[ara4n]

(ftr i'm aware of at least 4 parties who are anxious for this to merge :)

[galexrt]

@ineiti I'm currently writing up a blog post about how I got it to work with Keycloak at least. I'll keep you updated in this comment.

[ineiti]

@galexrt - I did my own SSO integration with CAS - I had to write the server-side anyway. It works fine with the web-interface.

Unfortunately the apps don't work, as our service provides a passwordless login, and it depends on the storageDB that is in the browser. And the apps use an own instance of the browser that doesn't have access to the storageDB :( I looked quickly into it, but it seemed more than half a day's work.

[galexrt]

Unfortunately the apps don't work [...]

@ineiti Are you talking about the Riot Web, Android and so on Apps?
The login through SSO worked fine for me with my original PR (haven't tried with this one yet, but it has the "same" changes in it), see #2257 (comment) for how it looks. It looked the same on my Android phone using the Riot Android app.

From the Matrix API spec it seems the apps need to implement the m.login.sso and then use the returned token for the m.login.token login, which is fine I guess:

If the homeserver advertises m.login.sso as a viable flow, and the client supports it, the client should redirect the user to the /redirect endpoint for Single Sign-On. After authentication is complete, the client will need to submit a /login request matching m.login.token.

• From https://matrix.org/docs/spec/client_server/latest

[ineiti]

@galexrt

@ineiti Are you talking about the Riot Web, Android and so on Apps?

The Riot web app works fine! But the android and desktop app do not.

Most often, SSO services ask the user about a login-name and a password. This works fine with the current android and desktop app.

However, our SSO solution doesn't ask for a login-name and a password, but depends on a private key that is stored in the storageDB of the browser. And this is a problem, because the android and desktop app don't use the same browser as the user, and so the SSO page they show doesn't have access to the private key that is stored in the storageDB of the browser.

So the android and desktop app would have to call the default browser of the user, and then be redirected from there back to the app. Probably not impossible, but if somebody gives me some pointers, I'd be more than happy to give it a try.

Unfortunately matrix-react-sdk doesn't allow me to open an issue, but I guess that I would have to change the method here:

https://github.com/matrix-org/matrix-react-sdk/blob/3836a3e2e293e29b3d9635fcb9c530e21fcc79b2/src/components/structures/auth/Login.js#L544

[jryans]

Unfortunately matrix-react-sdk doesn't allow me to open an issue, but I guess that I would have to change the method here:

https://github.com/matrix-org/matrix-react-sdk/blob/3836a3e2e293e29b3d9635fcb9c530e21fcc79b2/src/components/structures/auth/Login.js#L544

React SDK issues are currently tracked in the Riot Web repo.

[csett86]

@richvdh

Can I do anything to move this forward? Testing anything special?

[richvdh]

a time machine would help :/

[csett86]

Test results: This pull request worked fine with phpsimplesaml 1.17.2 and current riot-web and riot-ios.

Only problem I had: Initially synapse always complained that the authn response was unsolicited, although it had the correct InResponseTo ID set. So I had to allow unsolicited responses in the sp_config:

  service:
      sp:
          allow_unsolicited: True

[kyrisu]

Could anyone post a valid SAML response? I'm particularly interested in AttributeStatement section.
I have:

<saml:Attribute Name="uid" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
    <saml:AttributeValue xsi:type="xs:string">some_unique_user_id_from_my_system</saml:AttributeValue>
</saml:Attribute>

but synapse is still complaining about uid not in SAML2 response.

Update:
Made it work by setting

sp_config:
    allow_unknown_attributes: true

but I'm open for a better solution.

[galexrt]

@kyrias You need to use the attribute_map_dir param and create a attribute map to map the uid attribute to actually be the uid attribute.
Example:

MAP = {
    "identifier": "urn:oasis:names:tc:SAML:2.0:attrname-format:uri",
    "fro": {
        'uid': 'uid',
    },
    "to": {
        'uid': 'uid',
    }
}

I'll have the blog post with such details hopefully after the upcoming weekend.

[csett86]

@kyrisu

What works for me is the following, the oid format:

     <saml:AttributeStatement>
       <saml:Attribute Name="urn:oid:0.9.2342.19200300.100.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml:AttributeValue xsi:type="xs:string">eva</saml:AttributeValue>
       </saml:Attribute>
       <saml:Attribute Name="urn:oid:1.2.840.113549.1.9.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml:AttributeValue xsi:type="xs:string">eva@example.org</saml:AttributeValue>
       </saml:Attribute>
       <saml:Attribute Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml:AttributeValue xsi:type="xs:string">Eva</saml:AttributeValue>
       </saml:Attribute>
       <saml:Attribute Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
         <saml:AttributeValue xsi:type="xs:string">admin</saml:AttributeValue>
         <saml:AttributeValue xsi:type="xs:string">examle</saml:AttributeValue>
       </saml:Attribute>
     </saml:AttributeStatement>

[codecov]

Codecov Report

Merging #5422 into develop will decrease coverage by 1.14%.
The diff coverage is 31.7%.

@@             Coverage Diff             @@
##           develop    #5422      +/-   ##
===========================================
- Coverage    63.19%   62.05%   -1.15%     
===========================================
  Files          328      326       -2     
  Lines        35925    35699     -226     
  Branches      5908     5856      -52     
===========================================
- Hits         22703    22153     -550     
- Misses       11596    11968     +372     
+ Partials      1626     1578      -48

[codecov]

Codecov Report

Merging #5422 into develop will increase coverage by 0.02%.
The diff coverage is 34.28%.

@@             Coverage Diff             @@
##           develop    #5422      +/-   ##
===========================================
+ Coverage    63.15%   63.17%   +0.02%     
===========================================
  Files          328      328              
  Lines        35901    35929      +28     
  Branches      5914     5916       +2     
===========================================
+ Hits         22672    22697      +25     
- Misses       11604    11607       +3     
  Partials      1625     1625

[csett86]

Retested with phpsimplesaml 1.17.2 and current riot-web 1.2.2, session handling works as expected. Thank you, @richvdh!

[menturion]

@csett86

It would be great if you could provide a blog post or a Gist of how to set up Matrix Synapse SAML with phpsimplesaml 1.17.2.

I think that this would be very helpful for many people.

[galexrt]

For people using Keycloak, I have published this blog post as a rough writeup of the steps: https://edenmal.moe/post/2019/Matrix-Synapse-SAML2-Login/

[erikjohnston]

Looks good apart from some of the exceptions.

[erikjohnston]

Logging a stack trace as a warning seems a bit odd, since it won't go to sentry.

[richvdh]

worth noting that this stuff has just moved from https://github.com/matrix-org/synapse/pull/5422/files/79b9d9076dc37c259fe1682878ef5ebd8a73f1d4#diff-bc86f7c8dc0a9a987830eda22318b9f3L57, though I don't disagree...

[erikjohnston]

Why CodeMessageException and not SynapseError? It looks like CodeMessageException will still log a stack trace for json requests?

[richvdh]

no idea. some crank wrote this back in 2018. (#4267)

oldsmobile

[menturion]

How can one update to a Release Candidate (e.g. Synapse 1.1.0rc1 -> SAML support) through pip?
"pip install -U matrix-synapse" prompts "Requirement already satisfied, skipping upgrade".
Is it possible to select a certain channel?

[richvdh]

@menturion: pip install --pre -U matrix-synapse, I believe. Beware that there are a couple of regressions in rc1 though. I suggest waiting for rc2.

[menturion]

@richvdh

Many thanks(!), this worked.

[volvicoasis]

For people using Keycloak, I have published this blog post as a rough writeup of the steps: https://edenmal.moe/post/2019/Matrix-Synapse-SAML2-Login/

Hey thanks for your dev on synapse, just finish implementing it with your blog, but still facing on this :
saml2.client_base - 720 - ERROR - POST-180 - XML parse error: Failed to verify signature

or with riot :
Unable to parse SAML2 response: Failed to verify signature

Just a question, how do you extract pem from your keycloak ?

[galexrt]

@volvicoasis Please use the comment section of the blog post instead of the PR for such questions. Thanks!

---

I have gone ahead and updated the post with instructions on how to extract the key and cert from the Keycloak Client, and fixed some issues around the Encrypt Assertions option configuration.

[volvicoasis]

@galexrt Thank you for your update, just to provide my research to synapse community, you must use alpine3.9 when you build synapse in a container.
=> my test below :
I use debug mode on sp_config, extract saml response and check it with xmlsec1 binary and it's a failed...
Here you can see this bug on alpine https://bugs.alpinelinux.org/issues/9110

``bash-4.4# xmlsec1 --verify --id-attr:ID "urn:oasis:names:tc:SAML:2.0:protocol:Response" test.xml
func=xmlSecCryptoDLLibraryCreate:file=dl.c:line=130:obj=unknown:subj=lt_dlopenext:error=7:io function failed:name="libxmlsec1-openssl"; errno=2
func=xmlSecCryptoDLGetLibraryFunctions:file=dl.c:line=436:obj=unknown:subj=xmlSecCryptoDLLibraryCreate:error=1:xmlsec library function failed:crypto=openssl
func=xmlSecCryptoDLLoadLibrary:file=dl.c:line=393:obj=unknown:subj=xmlSecCryptoDLGetLibraryFunctions:error=1:xmlsec library function failed:
Error: unable to load xmlsec-openssl library. Make sure that you have
this it installed, check shared libraries path (LD_LIBRARY_PATH)
envornment variable or use "--crypto" option to specify different
crypto engine.
Error: initialization failed
Usage: xmlsec [] []

xmlsec is a command line tool for signing, verifying, encrypting and
decrypting XML documents. The allowed values are:
--help display this help information and exit
--help-all display help information for all commands/options and exit
--help- display help information for command and exit
--version print version information and exit
--keys keys XML file manipulation
--sign sign data and output XML document
--verify verify signed document
--sign-tmpl create and sign dynamicaly generated signature template
--encrypt encrypt data and output XML document
--decrypt decrypt data from XML document

Report bugs to http://www.aleksey.com/xmlsec/bugs.html

Written by Aleksey Sanin aleksey@aleksey.com.

Copyright (C) 2002-2016 Aleksey Sanin aleksey@aleksey.com. All Rights Reserved..
This is free software: see the source for copying information.

func=xmlSecCryptoShutdown:file=app.c:line=65:obj=unknown:subj=unknown:error=9:feature is not implemented:details=cryptoShutdown
Error: xmlSecCryptoShutdown failed
Error: xmlsec crypto shutdown failed.
``

Voila, again thank you.

[menturion]

Is there a documentation of how to configure it inline?
I am getting a bunch of errors on homeserver startup when trying to configure a remote SP URL inline.

[eorlovsky]

For people using Keycloak, I have published this blog post as a rough writeup of the steps: https://edenmal.moe/post/2019/Matrix-Synapse-SAML2-Login/

@galexrt Hi Alex, the link below is down. Could you please republish it. Thanks

[galexrt]

@eorlovsky Fixed. It is back online again.

[vsatmydynipnet]

Is there any simplesamlphp config samlple?
my idp is simplesamlphp 1.17.6 using Wodpress Database. phpBB is already added as SP
I setup a new synpase server and want to get this going. users should be able to login, but if idp does not allow to login they should fail till account is reenabled.