Blog on Woolnough

HTTP-Redirect disallowed for transport of SSO response

Mon, 26 Oct 2015 00:00:00 +0000

This one is probably obvious to the initiated, but had me scratching my head for a little while, so I thought it worth posting.

PingFederate when asked to perform an SP Initiated SSO Redirect-Redirect, fails with the following error in the logs.

2015-10-23 16:38:20,404 tid:rBZwfgxQg49EnZYKgLARHbPCQak ERROR [org.sourceid.saml20.profiles.idp.HandleAuthnRequest] Exception occurred during request processing
org.sourceid.saml20.profiles.StatusResponseException: ProtocolBinding: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect disallowed for transport of SSO response.

This functionality has been intentionally excluded from the product according to the very helpful support engineer I spoke with at Ping. The reasoning behind this is that the SAML response is typically quite long and whilst the HTTP/1.1 RFC states there is no limit to the length of a query string, there are practical limits implemented in browsers. Testing all browsers for their limits is simply not practical. Switching my app over to using SP Initiated SSO Redirect-POST resolved my issue.

There’s some info on the query string limitations on this (dated) stackoverflow answer

The supported list of supported profiles that PingFederate supports (which I obviously didn’t check) is listed here

At the time of writing, this is the list:

SP-Initiated SSO–POST-POST
SP-Initiated SSO–Redirect-POST
SP-Initiated SSO–Artifact-POST
SP-Initiated SSO–POST-Artifact
SP-Initiated SSO–Redirect-Artifact
SP-Initiated SSO–Artifact-Artifact
IdP-Initiated SSO–POST
IdP-Initiated SSO–Artifact

PingFederate 8 and the JCE

Sat, 10 Oct 2015 00:00:00 +0000

TL;DR It’s a good idea to install JCE.

Installing the Java Cryptography Extension JCE is highly recommended if your countries laws permit it’s importation and use, for two reasons: adherence with standards & interoperability. There’s some pretty cool stuff being developed by those who don’t care too much for interoperability, but for those of us in the Enterprise Identity Management space, it’s essential.

Java 8 gives you basic crypto, but includes limits on Maximum Keysizes. The following table provides a quick summary.

Algorithm	Maximum Keysize
DES	64
DESede (AKA TripleDES)	*
RC2	128
RC4	128
RC5	128
RSA	*
All others (inc. AES)	128

What does this mean for us?

TLS

Fewer Crypto options. I don’t see this is a huge issue. When we deploy a PingFederate cluster, it’s typically behind a TLS Terminating Load Balancer anyway, which means that our TLS Sessions only exist in the data centre and we’re generally pretty happy with AES128 for TLS.

SAML/WS-*

No TripleDES or AES256 XML block encryption option

Not compliant with the W3C XML Encryption Recommendation (yes, only a recommendation) which is used by SAML & WS-* Protocols. This states that AES256 & TripleDES are ‘required’.
Assertions in the responses are in the clear on the above mentioned Load Balancer (and many other similar scenarios) without this. This may be an issue if the assertions contain sensitive information.
We can’t be an Relying Party (RP) to an ADFS 2.x (and newer) Identity Provider (IP) without disabling the encryption of claims. set-ADFSRelyingPartyTrust –TargetName "Ping RP" –EncryptClaims $False. It does not appear to be possible to downgrade ADFS to use AES128.

OpenID Connect

The upcoming Javascript Object Signing and Encryption (JOSE) standard include a specification on JWE key management and JWE content encryption. The table below shows the encryption and key management options with and without the JCE installed. Many of the additional options enabled by installing the JCE are either optional or recommended in the listed specifications.

Config	JWE content encryption algorithms	JWE key management algorithms
Without JCE	A128CBC-HS256, A128GCM	RSA1_5, RSA-OAEP, RSA-OAEP-256, dir, A128KW, ECDH-ES, ECDH-ES+A128KW, PBES2-HS256+A128KW, A128GCMKW
With JCE	A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM	RSA1_5, RSA-OAEP, RSA-OAEP-256, dir, A128KW, A192KW, A256KW, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW, PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW, A128GCMKW, A192GCMKW, A256GCMKW

Installation

Ensure your JAVA_HOME is directed at your JRE, not the JDK.
Download the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8
Extract the files to JAVA_HOME\lib\security
If you’re on a Windows OS, right click each policy file individually and unblock.
Edit the following file and enable the ciphers you wish to use. <installDir>\pingfederate\server\default\data\config-store\com.pingidentity.crypto.SunJCEManager.xml
Note: If you want to be super cautious, disable TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 and TLS_DHE_RSA_WITH_AES_256_CBC_SHA as these are potentially susceptible to Logjam vulnerability. The Logjam test site reports that an uncommon 1024 bit group is used so it should be ok, but why risk it!?
Restart the service

If everything went successfully you should see messages in server.log resembling:

org.jose4j.jwe.AesKeyWrapManagementAlgorithm$Aes256@7244d076 registered for alg algorithm A256KW

instead of:

A256KW is unavailable so will not be registered for alg algorithms.

If you happen to notice the messages in the logs at startup stating that PS256, PS384 & PS512 are unavailable, it’s safe to ignore these. They are unavoidable at the time of writing, as they require bouncy castle which is not supported by PingFederate.

Full log samples here:

PingFederate Logs without JCE

PingFederate Logs with JCE

Creating a new publish settings file from azure portal

Thu, 08 Oct 2015 00:00:00 +0000

With the introduction of Azure Resource Manager (ARM), it’s necessary to use Add-AzureAccount in many scenarios to get access to Azure using PowerShell. Sometimes you just need to quickly grab the publishsettings file however. I find it easiest to type the following into the browser: https://manage.windowsazure.com/publishsettings.

You will need to log into your Azure tenancy in the browser, if you are not already, but typically you’re already logged in and the publish settings file immediately downloads. This is especially helpful when you have multiple tenancies open in different browsers, like in the this previous code post. Remember to be cautious with these publishsettings files, as they’re the keys to your kingdom whilst they’re active!

PingFederate and Active Directory Kerberos Tokens

Thu, 10 Sep 2015 00:00:00 +0000

An old AD issue that pops up from time to time is Kerberos Token Bloat. In a nutshell, the AD groups you’re a member of, the bigger your Kerberos Token. Eventually your token gets too big and stuff breaks.

In the most common use case, when you attempt to access a web site, the Kerberos token is encoded and placed in the Authorization header of the Internet Explorer HTTP request.

Servers receiving the HTTP request have a MaxTokenSize configured. Historically the MaxTokenSize was 12k. With Server 2012, this was bumped up to 48k - the maximum possible - constrained by HTTP Protocol. Some older documentation refers to a 65535 bytes, but this advice didn’t take into account that the kerberos token is Base64 encoded, which adds to the length of the token.

PingFederate is configured to have a header size 8K. When integrating with a Kerberos Forest, We’re typically upping this to 48K, in line with Windows 2012+ .

Ping offers some guidance on changing the size for the different versions here, but essentially for version 8, we want to make the following change in <installdir>\pingfederate\bin\start.ini, to give it the same max size as server 2012.

#jetty.request.header.size=8192
jetty.request.header.size=49152

If you’re curious about your own token size: * On the desktop, use tokensz

C:\temp>tokensz.exe /compute_tokensize

Name: Kerberos Comment: Microsoft Kerberos V1.0
Current PackageInfo->MaxToken: 48000

Using user to user
QueryKeyInfo:
Signature algorithm = HMAC-SHA1-96
Encrypt algorithm = Kerberos AES256-CTS-HMAC-SHA1-96
KeySize = 256
Flags = 2083e
Signature Algorithm = 16
Encrypt Algorithm = 18
   Start:9/22/2015 3:33:05
  Expiry:9/22/2015 12:31:44
Current Time: 9/22/2015 3:33:05
MaxToken (complete context)  6410

C:\temp>

On the wire, use fiddler by adding a custom rule.

public  static  BindUIColumn("Req-Header-Length")
function  CalcMethodCol2(oS:  Session){
    if (null != oS.oRequest)
        return oS.oRequest.headers.ByteCount().ToString();
    else
        return String.Empty;
}

public  static  BindUIColumn("Resp-Header-Length")
function  CalcMethodCol3(oS:  Session){
    if (null != oS.oResponse)
        return oS.oResponse.headers.ByteCount().ToString();
    else
        return String.Empty;
}

CasperJS testing PingFederate HTML form adapter

Wed, 19 Nov 2014 14:50:04 +1000

During a deployment of Ping Identity’s PingFederate product, we had a need to automate logging into the HTML Form Adapter. Whilst there are many ways to automate this, I really liked this one, and thought it worth sharing.

The solution has 2 components:

PhantomJS

PhantomJS is a headless browser this uses the WebKit browser by default, but can also use the Gecko engine courtesy of SlimerJS.

CasperJS

CasperJS started life as a bunch of scripts which drove PhantomJS & has since evolved into a full framework. This code utilizes version 1.1 of CasperJS, which despite being a development version is quite stable and is in fact the version the maintainers of CasperJS recommend.

Installation

Windows

Download phantomjs: http://phantomjs.org/download.html Unzip it to C:\phantomjs

Download the latest zip from this page: http://docs.casperjs.org/en/latest/installation.html and unzip to a safe & sensible location like C:\casperjs

Modify the PATH variable to make the binary accessible

setx PATH "%PATH%;C:\phantomjs\;C:\casperjs\bin"

Linux

$ wget https://phantomjs.googlecode.com/files/phantomjs-1.9.8-linux-x86_64.tar.bz2
$ tar xvjf phantomjs-1.9.8-linux-x86_64.tar.bz2
$ cd phantomjs-1.9.8-linux-x86_64
$ sudo ln -sf "$(pwd)"/bin/phantomjs /usr/local/bin/phantomjs
$ cd ..
$ git clone git://github.com/n1k0/casperjs.git
$ cd casperjs
$ sudo ln -sf "$(pwd)"/bin/casperjs /usr/local/bin/casperjs

Mac

brew update && brew install phantomjs
brew install casperjs --devel

Configuration

The configuration required is minimal.

PhantomJS by default utilizes SSLv3, so if you encounter the following warning and the script continually fails to complete:

[warning] [phantom] Loading resource failed with status=fail: https://fed.companyb.com/idp/prp.wsf?wa=wsignin1.0&wtrealm=https://applicationa.companyb.com/&wfresh=15&wctx=rm=0&id=passive&ru=%2fCIS%2f&wct=2014-11-19T05:34:06Z

The solution is to enable TLS using one of the following methods:

1) Specify the protocol to use each time you execute casperjs:

casperjs --ssl-protocol=tlsv1

2) Or, edit the file C:\casperjs\bin\casperjs and add the above switch to the ENGINE_ARGS

ENGINE_ARGS = ['ssl-protocol=tlsv1']

Solution code

"use strict";
 
var  url = 'https://applicationa.companyb.com/',
username = 'mattheww',
password = 'password',
   debug = true,
logLevel = null;
  
if (debug) {
  logLevel = 'debug';
} else {
  logLevel = 'info';
}
 
var casper = require('casper').create({
  pageSettings: {
    loadImages:  false,   // The WebPage instance used by Casper will
    loadPlugins: false,   // use these settings
    userAgent: 'Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.2 Safari/537.36'
  },
    logLevel: logLevel,   // debug; info; warning; error
    verbose: true,        // log messages will be printed out to the console
    options: {
      waitTimeout: 25000, // Timeout of 25 sec
    }
});

casper.start(url, function () {
  this.log('Attempting login to ' + url, 'info');
  this.fill('form', {
    'pf.username': username,
    'pf.pass': password
  }, true);
});

casper.then(function() {
  var currentURL = this.getCurrentUrl();
  if (currentURL === url) {
    console.log("SUCCESS!: We're in " + currentURL);
  } else if (/prp.ping$/i.test(currentURL)) {
    console.log("FAIL!: We're stuck on prp.ping");
      if (debug) {
        // Dump whole page for visual inspection
        var page = this.evaluate(function() {
                       return document;
        });
        this.echo(page.all[0].outerHTML);
      } else {
        if (this.exists('div.ping-body form div div')) {
          var msg = this.fetchText('div.ping-body form div div');
          var msgArray = msg.split('\t');
          this.echo(msgArray[0]);
        } else if (this.exists('div.ping-body')) {
          var pingBody = this.fetchText('div.ping-body');
          if (pingBody.indexOf('Access denied (403)') >= 0 ) {
            this.echo(pingBody);
          }
        }
      }
  }
});
 
casper.run();

When successful,the output should resemble below

C:\casperjs\bin>casperjs.exe ..\mw\run.js
[info] [phantom] Starting...
[info] [phantom] Running suite: 3 steps
[info] [phantom] Step anonymous 2/3 https://fed.companyb.com/idp/ZVlk9/resume/idp/prp.ping (HTTP 200)
[info] [phantom] Attempting login to https://applicationa.companyb.com/
[info] [remote] attempting to fetch form element from selector: 'form'
[info] [remote] submitting form to /idp/ZVlk9/resume/idp/prp.ping, HTTP POST
[info] [phantom] Step anonymous 2/3: done in 154ms.
[info] [phantom] Step anonymous 3/3 https://applicationa.companyb.com/ (HTTP 200)
SUCCESS!: We're in https://applicationa.companyb.com/
[info] [phantom] Step anonymous 3/3: done in 730ms.
[info] [phantom] Done 3 steps in 749ms

A failure will resemble the following:

C:\casperjs\bin>casperjs ..\mw\run.js 
[info] [phantom] Starting...
[info] [phantom] Running suite: 3 steps
[info] [phantom] Step anonymous 2/3 https://fed.companyb.com/idp/82l2u/resume/idp/prp.ping (HTTP 200)
[info] [phantom] Attempting login to https://applicationa.companyb.com/
[info] [remote] attempting to fetch form element from selector: 'form'
[info] [remote] submitting form to /idp/82l2u/resume/idp/prp.ping, HTTP POST
[info] [phantom] Step anonymous 2/3: done in 163ms.
[info] [phantom] Step anonymous 3/3 https://fed.companyb.com/idp/82l2u/resume/idp/prp.ping (HTTP 200)
FAIL!: We're stuck on prp.ping
Authentication failed. You have used an invalid username and/or password.
[info] [phantom] Step anonymous 3/3: done in 469ms.
[info] [phantom] Done 3 steps in 485ms
 
C:\casperjs\bin>