SAML is only half implemented #5130

Activity

1. localguru commented on May 2, 2019

   

   localguru

   on May 2, 2019

   Contributor

   More actions

   What exactly means "only works with a custom proxy to prepare the saml query". Any further documentation on that?
2. ptman commented on May 6, 2019

   

   ptman

   on May 6, 2019

   ContributorAuthor

   More actions

   Which clients can be used for SAML auth? element-hq/element-web#3544
3. richvdh commented on May 6, 2019

   

   richvdh

   on May 6, 2019

   Member

   More actions

   once saml support in synapse is completed, any client that supports the m.login.sso flow, or fallback auth will support saml.

   The part that is missing is step 2 of https://matrix.org/docs/spec/client_server/unstable.html#sso-client-login: Synapse needs to handle the /login/sso/redirect endpoint and 302 to the SAML interface.
4. neilisfragile

   added

   z-auth(Deprecated Label)(Deprecated Label)

   z-p2(Deprecated Label)(Deprecated Label)

   on May 7, 2019
5. menturion commented on Jun 14, 2019

   

   menturion

   on Jun 14, 2019

   More actions

   Is there already a date on which SAML will probably be fully implemented?

   👍React with 👍1Reacted by thefiddler
6. richvdh commented on Jul 16, 2019

   

   richvdh

   on Jul 16, 2019

   Member

   More actions

   This was fixed by #5422
7. richvdh

   closed this as completedon Jul 16, 2019
8. slipeer commented on Jul 25, 2019

   

   slipeer

   on Jul 25, 2019

   Contributor

   More actions

   Some SAML2 related stuff still unimplemented. Such as:

   • SAML logout
   • UPDATE user's displayname from SAML IdP (on_successfil_auth update it only at registration phase)
   • Documenting how make it work. For example only displayname attribute used from SAML Authn Responce and it isn't referenced in documentation. To make it work with Ad FS, I needed to set up additional AD FS rules - it wasn't trivial to deal with this.
9. ara4n commented on Jul 25, 2019

   

   ara4n

   on Jul 25, 2019

   Member

   More actions

   @slipeer do you have doc for how you got it to work with AD?
10. ara4n commented on Jul 25, 2019

    

    ara4n

    on Jul 25, 2019

    Member

    More actions

    i've split this out into new issues (updating an closed bug with new scope typically gets lost)
11. slipeer commented on Jul 25, 2019

    

    slipeer

    on Jul 25, 2019

    Contributor

    More actions

    @ara4n not complete docs today, only AD FS Issuance Transform Rules that work for me:
    Rule 1
    to match NameID format (without it error MSIS7070 present in AD FS event log)

    c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
     => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient");
    

    Rule 2
    to add uid and displayname attributes

     c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
     => issue(store = "Active Directory", types = ("uid", "displaname"), query = ";sAMAccountName,displayName;{0}", param = c.Value);
    

    Another problem: AD FS 2.0 (Windows Server 2012R2 may be still in use) does not know about TLS1.3.
    I had to allow TLS1.0 for it on Synapse's side reverse-proxy.

    It's the key thing. It's been the longest thing I've dealt with.

    Otherwise, the @galexrt 's instruction works. With only one note: he described additional attributes there, which synapse does not look at in reality.
12. dvoijen commented on Mar 18, 2020

    

    dvoijen

    on Mar 18, 2020

    More actions

    @ara4n not complete docs today, only AD FS Issuance Transform Rules that work for me:
    Rule 1
    to match NameID format (without it error MSIS7070 present in AD FS event log)

    c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
     => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient");
    

    Rule 2
    to add uid and displayname attributes

     c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
     => issue(store = "Active Directory", types = ("uid", "displaname"), query = ";sAMAccountName,displayName;{0}", param = c.Value);
    

    Another problem: AD FS 2.0 (Windows Server 2012R2 may be still in use) does not know about TLS1.3.
    I had to allow TLS1.0 for it on Synapse's side reverse-proxy.

    It's the key thing. It's been the longest thing I've dealt with.

    Otherwise, the @galexrt 's instruction works. With only one note: he described additional attributes there, which synapse does not look at in reality.

    How did you setup ADFS?
    Do you have some kind of manual for it?