CFML SSO demo app for consumption of SAML response

dev
1

Just wanted to let people know about a CFML SSO demo app I put together for consumption of SAML response from identity providers. Currently, I have it working against okta. You can either run the app or use the code in the /saml folder to run in your own app.

Would be great if people can give it a spin and let me know if any issues. And if you want to contribute additional identity provider configurations, that would be even better!

The code is located at: GitHub - psarin/cfml-sso-demo-app: Demo app for cfml - sso integration, using the Okta identity provider as an example . Hopefully, the README.md file gives enough information to get you started!

Thanks to Giancarlo Gomez and his OneLogin code, on which this new demo app is based. Major changes include: no need to set up datasource (use JSON config files) and made more generic to allow for expansion to other identity providers.

1 Like
2

I may be testing this in April (2022). Thanks for sharing and I’ll let you know how it goes.

3

anyone have try it using onelogin, because i have error in samlAssertionSignatureBlock.setIdAttributeNS(“”, “ID”, true);

4

I’m also getting errors in signature.cfc > buildSignature() on line
samlAssertionSignatureBlock.setIdAttributeNS(“”, “ID”, true);

Error is:
Java.Lang.Illegalaccessexception Error: Class Lucee.Runtime.Text.Xml.Struct.Xmlelementstruct Cannot Access Class Com.Sun.Org.Apache.Xerces.Internal.Dom.Elementimpl (In Module Java.Xml) Because Module Java.Xml Does Not Export Com.Sun.Org.Apache.Xerces.Internal.Dom To Unnamed Module @5Fcfca62 (Onerror Onrequest)

5

Can you provide some more detail, eg which version of lucee and java you are using? And or a test case?

Was it working before and now it doesn’t? Could it be related to Allow toggling XML External Entity support for XmlParse, isXml - #3 by Zackster

6

Sure thing!
It looks like our team’s running command box lucee-light@5.3.10.97 in docker image ortussolutions/commandbox:jre11-3.7.6

I’m using a development Okta account and their walkthrough for a base beginning test case. I have a working punch out and return back with valid information from Okta; only the signature verification part upon return is the issue at the moment. If I comment that out, I can get a clean return from buildPacket() just without any verification data.

Would you like me to submit this as an issue in the github repo for easier tracking?

7

Yes, that would be great. If you have a simple test case scenario that demonstrates the error, that would be helpful as well. It may be a OneLogin specific thing as I just tried with Okta and it seems to be working.

8

Has this ever been addressed or corrected? I’m making some headway in implementing your SAML library, and I have the index.cfm showing the “Login with Okta” button, which hits post.cfm, redirects to our Okta SAML. I log in, and when it redirects back, the consume.cfm that I have throws the following error:

lucee.runtime.exp.NativeException: class lucee.runtime.text.xml.struct.XMLElementStruct cannot access class com.sun.org.apache.xerces.internal.dom.ElementImpl (in module java.xml) because module java.xml does not export com.sun.org.apache.xerces.internal.dom to unnamed module @152623fa

in:

/WebProjects/SATTS/saml/signature.cfc: line 11
9: var samlAssertionBlock = objUtils.getSingleValue(samlResponse, “//*[local-name()=‘Assertion’ and namespace-uri()=‘urn:oasis:names:tc:SAML:2.0:assertion’]”)
10: // Need to set the ID attribute to use as reference as per java - SOAP XML WS-Security signature verification - Stack Overflow
11: samlAssertionBlock.setIdAttributeNS(“”, “ID”, true);

Thanks,
Harry

9

I imagine you’re using Java21? If so, you’ll need to add the following to your JVM args:

--add-exports=java.xml/com.sun.org.apache.xerces.internal.dom=ALL-UNNAMED

See Migrating From JDK 8 to Later JDK Releases

10

Where do I add that? In /etc/init.d/lucee_ctl where I specify JRE_HOME and JAVA_HOME?

Thanks,
Harry

11

Depends on how you’re starting Lucee (e.g., are you using CommandBox). But that sounds about right - it’s an arg that is supplied along with JRE_HOME and JAVA_HOME

12

I found out that I had to add that to the JDK options in /opt/lucee/tomcat/bin/catalina.sh. I did that and restarted. Now when I sign in, I get the following error from Lucee:
Attribute [SIGNATURE] not found
on line 16 of signature.cfc:

var samlAssertionSignatureBlock = samlAssertionBlock.Signature[1];

Thanks,
Harry

13

Add a dump(samlAssertionBlock); before that line or add some debugging after the Okta response is decoded and see what Okta is returning to you.

14

I believe I have this fixed now. I found out that our Okta team was not sending the assertion signed, causing that error. I have SAML working now and I have a few users testing it. I did have to make some other CFM code updates to our code, but I was able to figure that part out pretty quick.

I appreciate all of your help!

Thanks,
Harry