You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@guacamole.apache.org by michael böhm <ks...@gmx.net> on 2021/04/15 07:54:07 UTC
SAML SP Metadata
Hi everyone
I'm in the process of connecting our Guacamole instance to the company's IDP
using SAML.
IDP team provided the following dummy example for the ServiceProvider's
Metadata XML:
#######################################################################################################
<?xml version="1.0" encoding="UTF-8"?>
-<md:EntityDescriptor entityID="https://PointOfContactServer/sps/DummySP/saml20" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
-<md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
-<md:KeyDescriptor use="signing">
-<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
-<X509Data>
<X509Certificate>MIIH...</X509Certificate>
</X509Data>
</KeyInfo>
</md:KeyDescriptor>
-<md:KeyDescriptor use="encryption">
-<KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
-<X509Data>
<X509Certificate>MIIH...</X509Certificate>
</X509Data>
</KeyInfo>
<md:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5"/>
</md:KeyDescriptor>
<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-
format:unspecified</md:NameIDFormat>
<md:AssertionConsumerService isDefault="true" index="0"
Location="https://PointOfContactServer/sps/DummySP/saml20/login"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
</md:SPSSODescriptor>
</md:EntityDescriptor>
#######################################################################################################
My questions:
\- As you can see, they expect the SAML requests to be signed and encrypted
using client certificates specified in the KeyDescriptor blocks. Is this
supported by Guacamole's SAML module? I could not find anything related in the
documentation.
\- What subpath does Guacamole expect as "AssertionConsumerService Location".
My Guacamole-instance is reachable via https://portal.company.org/guacamole.
Can I use this here or is anything else like .../login/... necessary.
Thanks and best wishes
Michael
\--------------------------------------------------------------------- To
unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org For additional
commands, e-mail: user-help@guacamole.apache.org
Aw: Re: SAML SP Metadata
Posted by michael böhm <ks...@gmx.net>.
Thanks Simon, that helped me. So there is no way to configure signed requests in Guacamole to the IDP?
> Gesendet: Freitag, 16. April 2021 um 15:35 Uhr
> Von: "Simon Müller" <si...@bechtle.com>
> An: user@guacamole.apache.org
> Betreff: Re: SAML SP Metadata
>
> You do not necessarily provide SP Metadata to your IdP, it's optional. If you
> really have to implement this you need to create the metadata.xml and make
> it (publicly) available to your IdP.
> The important part is that you can reach your IdP's metadata.xml and this
> URL has to be entered as value for the "saml-idp-metadata-url" key.
>
> The parameter to only accept signed SamlResponses is "saml-strict: true" in
> your guacamole.properties file, it's up to the SP to decide if it accepts
> signed or unsigned responses from the IdP.
>
> As ACS URL you can tell your IdP to use the FQDN of Guacamole like a user
> accessing your guacamole instance would type it.
>
>
> Regards,
> Simon Müller
>
>
>
> --
> Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
> For additional commands, e-mail: user-help@guacamole.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org
Re: SAML SP Metadata
Posted by Simon Müller <si...@bechtle.com>.
You do not necessarily provide SP Metadata to your IdP, it's optional. If you
really have to implement this you need to create the metadata.xml and make
it (publicly) available to your IdP.
The important part is that you can reach your IdP's metadata.xml and this
URL has to be entered as value for the "saml-idp-metadata-url" key.
The parameter to only accept signed SamlResponses is "saml-strict: true" in
your guacamole.properties file, it's up to the SP to decide if it accepts
signed or unsigned responses from the IdP.
As ACS URL you can tell your IdP to use the FQDN of Guacamole like a user
accessing your guacamole instance would type it.
Regards,
Simon Müller
--
Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@guacamole.apache.org
For additional commands, e-mail: user-help@guacamole.apache.org