Config sample

[j-ramirez-bi4group]

Could you provide a config YAML file to see how a SP should be defined? something like

serviceProviders:
 - EntityId: https://1c61bc0a.ngrok.io
   Certificate: hack/tls-setup/certs/service_provider_cert.pem
   AssertionConsumerServices:
    - Index: 0
      IsDefault: true
      Binding: Artifact
      Location: https://1c61bc0a.ngrok.io/saml/artifact_resolution

Thanks in advance

[amdonov]

Does your service provider implementation provide a metadata endpoint? If it does the easiest way to properly configure it is to run

lite-idp add service-provider "metadata file or url"

That will add the appropriate settings into your configuration file. If your SP doesn't generate metadata let me know, and I'll send you an example this evening.

[j-ramirez-bi4group]

Thank you so much, it worked, but now i'm getting the error
unsupported signature algorithm,
with this AuthnRequest

<?xml version="1.0" encoding="UTF-8"?>
<AuthnRequest xmlns="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Version="2.0" ID="_880b99d6c7edf8c5e48b77123f48a1c2e0d852287a" IssueInstant="2019-07-10T15:45:43.751Z" Destination="https://localhost:9443/SAML2/Redirect/SSO" AssertionConsumerServiceURL="https://1c61bc0a.ngrok.io/saml/digid/artifact_resolution" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" ForceAuthn="false">
   <saml:Issuer>https://1c61bc0a.ngrok.io</saml:Issuer>
   <NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" AllowCreate="true" />
   <RequestedAuthnContext Comparison="minimum">
      <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract</saml:AuthnContextClassRef>
   </RequestedAuthnContext>
   <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
      <SignedInfo>
         <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
         <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
         <Reference URI="#_880b99d6c7edf8c5e48b77123f48a1c2e0d852287a">
            <Transforms>
               <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
               <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
            </Transforms>
            <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
            <DigestValue>kkrEJOJi1UnbC7azHgcqTwnmyOU=</DigestValue>
         </Reference>
      </SignedInfo>
      <SignatureValue>Uw19xvBFnn5tuwytWXV01K1M23+mJBvWHqiCN0teUQjz7j5c+Kp/E7yKmf3SCoThV3dF3OpSNj8Z7hFEUrDpMtBEbKKMmjRT8BX2cz3gTYzF33Wgp1KGXStLFMRaTKP77gVnYYE71G4y9/ckP4tNHU1hhmcZCMDiMlwdI7CByoAiGQMxvHv+1BT8SmaPZ3e/M/1bbK8aVPZjYJ9Wjo6kNrS+a64xZEStHH309IjyZgwGDS7qt5bOxcxvcrf6gFGU5Sb+HbVWzBmRLX/DjBrPCyZCSYD9fc1vlh9ujP1PqLNEvEHAxC0qjKuINrK/lWWYss7wBB1OhTFYiLzGoJVIrukA6dRIV3pr4t9x6yi/yNzOKD40f5LI68TJMuTR75WTfVceBOHbdlRKcRojdOv4LF9tn6zckS1glGFB93gmI8uvCCS/E4m2pAkWtMxNaqB4wRKX9KAnMJacNXKCp7ARj+0px4Z4/kU16Ll6+QwiX+0lm0kCNEIpHNfMNMTaA1KxlJOO1xeTP91bzksYhFyx5PYssgllk5JjYxah0Z0ZqxfbCC9Q7TjdzQrNEQFpRmINZ/RMAXfg+PrWjA6ILxJSANzh4KKcTqWkGrHR0hrc7l1g+tvHW8ZImYG/EGcfvkC1Q8BfuKZzWeAErBi6rbZBQ57+cgARKMGIGV7Vc/GCXDY=</SignatureValue>
   </Signature>
</AuthnRequest>

But the signature Algorithm is there, so i don't get it...

[amdonov]

You should be probably using the redirect binding to submit your authnrequest. In that case, the signature and the algorithm are request parameters. Is that what you're doing?

[j-ramirez-bi4group]

Yes, i'm doing that, because the POST binding is not implemented, is it?

[amdonov]

Not at this time.

[amdonov]

Can you post the URL string that you're sending to the redirect binding endpoint?

[j-ramirez-bi4group]

Sure this is my code in Node

const samlRequestEncoded = encodeURIComponent(Buffer.from(zlib.deflateRawSync(result.samlAuthRequest.xml)).toString('base64'));
res.redirect(302, environment.SAML_IDENTITY_PROVIDER_SSO_URL + '?SAMLRequest=' + samlRequestEncoded);

where result.samlAuthRequest.xml is the XML i just post above

[amdonov]

I'm afraid there is a good bit more to it than that. You're probably going to what to use a library to create the request if you're not familiar with the SAML spec. If you'd like to write your own and are comfortable reading golang, you can checkout out https://github.com/amdonov/lite-idp/blob/master/sp/redirect.go to see how I construct a valid request.

[j-ramirez-bi4group]

Ok, I will take a look at it, thank you, i will let you know if I make some progress