Aanmelden

Een voorbeeld voor het aanmelden via SAML 2.0: een AuthnRequest en een Response

SAML Authnrequest

Hierbij een voorbeeld van een SAML AuthRequest dat door de Service Provider wordt opgesteld: in dit geval via de HTTP-Redirect binding.

GET
SAMLRequest: xxx
RelayState: ss:mem:26fbcd126d419f2ad70fc2cb283b65cd03edc56a414599cdc08e4a763af57b12
SigAlg: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
Signature: sTaOABC42z9sV+2WFiF1B/04U9WZ/pIE/RYU/Dm30z/efd0Pc/uWppuGpbv96EMfGeMT9F+lZqSxRbChxCGuQfqJNqpnnQhUng57W56QHHIqb+AmFtqTbIPLJqRKja1P07oivjjjh2n7xirLMOW08GpM8I2IBrX6uJltzPePprACb6cMf6cat05pK7fXqUhZw1TDR6H78Hg+MWO4aEF5fmUPoRw8o2n+l0e9asJouJBBPpZe0ipolreSMTd8V+KyuZzyk1SAfbSmFtijj75hQgwzD45e/T1LvXUXd29xJsNtcEqw6x8RY3GBfWgNw++V4zRp0hwVyYP/cw73Ze8zeD==

De GET-parameter “SAMLRequest” bevat volgend XML-bericht:

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                    ID="_2bcac04ca0ca433e6ebe9adbb9f3f5b9cdf7ce650c"
                    Version="2.0"
                    IssueInstant="2020-06-16T09:44:39Z"
                    Destination="https://authenticatie.vlaanderen.be/sps/vidp/saml20/login"
                    AssertionConsumerServiceURL="https://mijntoepassing.vlaanderen.be/SAML2/POST"
                    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                    >
    <saml:Issuer>https://mijntoepassing.vlaanderen.be</saml:Issuer>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" AllowCreate="true"/>
</samlp:AuthnRequest>

Hierbij merken we op:

SAML Response

Hierbij een voorbeeld van een SAML Reponse komende van de ACM IDP: voor de leesbaarheid hebben we geen encryptie geactiveerd.

POST
RelayState: ss:mem:26fbcd126d419f2ad70fc2cb283b65cd03edc56a414599cdc08e4a763af57b12
SAMLResponse: xxx

De POST-parameter “SAMLResponse” bevat volgend XML-bericht:

<samlp:Response xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
                xmlns:xs="http://www.w3.org/2001/XMLSchema"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                Destination="https://mijntoepassing.vlaanderen.be"
                ID="FIMRSP_bb1528d5-0172-1cb6-b4e4-ac22fe076240"
                InResponseTo="_2bcac04ca0ca433e6ebe9adbb9f3f5b9cdf7ce650c"
                IssueInstant="2020-06-16T09:45:45Z"
                Version="2.0"
                >
    <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://authenticatie.vlaanderen.be/sps/vidp/saml20</saml:Issuer>
    <samlp:Status>
        <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
    </samlp:Status>
    <saml:Assertion ID="Assertion-uuidbb15287b-0172-1acc-9f37-ac22fe076240"
                    IssueInstant="2020-06-16T09:45:45Z"
                    Version="2.0"
                    >
        <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://authenticatie.vlaanderen.be/sps/vidp/saml20</saml:Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
                      Id="uuidbb15287c-0172-102c-9b2a-ac22fe076240"
                      >
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
                <ds:Reference URI="#Assertion-uuidbb15287b-0172-1acc-9f37-ac22fe076240">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#">
                            <xc14n:InclusiveNamespaces xmlns:xc14n="http://www.w3.org/2001/10/xml-exc-c14n#"
                                                       PrefixList="saml xs xsi"
                                                       />
                        </ds:Transform>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
                    <ds:DigestValue>digfsIF79WvqLeGCfR6jAjySVaMeVZJox3VfCGiTb/8=</ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>yowklJqLKBuTohjpaNgLKI9PczuHPrAxhWYR5f9Wmhl8qW31ovXVNWU5+AYvpgruwR93kPwhCt4L+SgO0fkI5muxCY9GOxjospQ+Tz4nnrVa1suFwelxtCF1i10BRRGizln+Mdjav5RmPYiSey8pqtFGfWCw0h7L1vSn18pARnWnkLX2skUfSwDqZTIiEHbTmo7FA4yhYY5WHL1uPu8DrLh1c0Hs6tRFx70b/MC8RB063w8WQlkuet0y5Tzo9l7HkXMDhzAM+VeS1D4HeW+g4rI9JN9qf3LlitwsPo0UgVprDnBOU2dNH9dCQJrA2qbsGKdP6W8LEF9E1VVhslsC/rivegcVuEX9G1FyBykF3gqksaIs865lvp5Wr6i+Q42Nf6iOdkOj4CJ1TkmcmJ/iI33AVsQSPvkzkDEgSOZIdbIaDugGoMc17rS7QWrC85jAE3Z9PHJmayRhDu53IdW51qRmDEtoigY1EaI6TZA22CCP1WI467YmV2L+9Srrq1mRGLkg94dGrAJ5ARwUq2Rp+R8YwF/TXtxkOyjdZehWyxcwUWqYMQIloXsJtscnvjJ82QYprmJf7SNyZqAxd7Yjhqq4CbvUjuRuvycM5KAKY+BCAc+yFtEF4RnrUd9Mj9rPbsyThESGTcovBxZ9oAM7W3fQK3K2OEZ4v5W7YSGKM+U=</ds:SignatureValue>
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>MIIGkTCCBXmgAwIBAgIKNIYkdAAAAAANXTANBgkqhkiG9w0BAQsFADBOMQswCQYDVQQGEwJCRTEXMBUGA1UEChMOZS1JQiAoREFCIElDVCkxJjAkBgNVBAMTHVZsYWFtc2Ugb3ZlcmhlaWQgSXNzdWluZyBDQSAyMB4XDTE3MDcxMjEzMjQzNloXDTIyMDgxNTEzMjQzNlowgaoxCzAJBgNVBAYTAkJFMRAwDgYDVQQIEwdCcnVzc2VsMRAwDgYDVQQHEwdCcnVzc2VsMRcwFQYDVQQKEw5CRUxWMDMxNjM4MDg0MTEVMBMGA1UECxMMQUNNLXBsYXRmb3JtMSkwJwYDVQQDEyBhdXRoZW50aWNhdGllLXNpZ24udmxhYW5kZXJlbi5iZTEcMBoGCSqGSIb3DQEJARYNYWNtQGhicGx1cy5iZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM+VrrTUjLE+hXOsbW8TwNXJPohNlOMb7+gmC/Sh3RMTekZqH6aXA7Y84juf/HXA68k4pDaCjKiNYm/wBgcP+dp9fTqUtRHnQEFDQIl6z0hQGkF+DNB4dx0QFgIqShPKu1tweW+4AV6o64fkyMkA0uEbn3QrgBYtiH+N4SzQ6SWJeW3lj0+dba2tkuEq0dXIuS2GSGt3715+vhCpBerxwjYdR5LXZPhZXS0Rg8dDml7lOt2BIiueQjsUT8PXgy8gWKAbdzvYNAs6B+v41zelhbhaqCSR7hwSWzWG/dp6Ve7rpRCLrCo120PoZSE2uV/91iaIGqs3DhsqNm1f8kTnlcRmjDPn7WjB9danQrf4Pvd/lEvkjrPsWx5dw8DN+//HU7sZkSf+qtr3GioCoG7P9V9CHVh4JLmNnvvXn8M3ifgguGcFKlnLIPAHZnRSGqWk+yKzHiOEgzMHf/h8D2HEfRLMmdA9YOlvE5Hl1nGPN8XR6Gtd6s7KtGaSLtRg68CH985IGBQWP87Zc9WERB+hg6slYJ722b2e9dBBYC7KBnX2/KDFo0Bt8YUG7Tak89gqGP+SvMWb05b2Mb++8knmbIPp1lb5KG1BVRetVC5gMG7/jz2nGbubE0wIvOPbKtzMTbv3SXFYQepVxtfzus9JHsBGk5bwH2vgq7lTwoWFXnFRAgMBAAGjggISMIICDjAdBgNVHQ4EFgQUdS7woduxXrovWqzaB7hoP1Yge24wHwYDVR0jBBgwFoAUbPgLLjPvhiZSYNUgAt0AOOk/dJYwPAYDVR0fBDUwMzAxoC+gLYYraHR0cDovL2NybC5wa2kudmxhYW5kZXJlbi5iZS9WT0lDQTIyMDEzLmNybDB6BggrBgEFBQcBAQRuMGwwPgYIKwYBBQUHMAKGMmh0dHA6Ly9kb2N1bWVudGVuLnBraS52bGFhbmRlcmVuLmJlL1ZPSUNBMjIwMTMuY3J0MCoGCCsGAQUFBzABhh5odHRwOi8vb2NzcC5wa2kudmxhYW5kZXJlbi5iZS8wDgYDVR0PAQH/BAQDAgWgMD0GCSsGAQQBgjcVBwQwMC4GJisGAQQBgjcVCIbZ+QKEiPdfh/WVFYbevHmClaxjCoOxuBeG6o4BAgFkAgEGMDMGA1UdJQQsMCoGCCsGAQUFBwMCBggrBgEFBQcDAwYKKwYBBAGCNwoDDAYIKwYBBQUHAwQwSwYDVR0gBEQwQjBABgsrBgEEAYG9QgQCBDAxMC8GCCsGAQUFBwIBFiNodHRwOi8vZG9jdW1lbnRlbi5wa2kudmxhYW5kZXJlbi5iZTBBBgkrBgEEAYI3FQoENDAyMAoGCCsGAQUFBwMCMAoGCCsGAQUFBwMDMAwGCisGAQQBgjcKAwwwCgYIKwYBBQUHAwQwDQYJKoZIhvcNAQELBQADggEBAIHr8MOLWdHAW5iBNyDFrNmndLhFijh6APJbjE9aQtJYD8zeo0BdXWXyEw2Ca5vJ/shulcsiMPcSV3x3/yopiFo5dlFI76zP+ipU9G3j5sVgdHTPiRnudDFd4iDOj7nAqTFOBKrmNWzRksvv3SLvSrVf+Gi3tOrPZZLy3uSsX4iKc4ewAm0kzxMW5ix9KI2Pm/y9PtvBH6PpdEGu/mE3oOf55TtuBfNfwP8FA2LvK5fLArMgHw5TSQPP6c7Yx6mVLrWFhY9VOXcDsAQOvmogQ3IHj2PlYuRQqUYjCeGJx7w7EJF1Wv59RvxFxuUxs+YyHShQzgHVsvnhVSFPWtd0P/Q=</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </ds:Signature>
        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
                         NameQualifier="https://authenticatie.vlaanderen.be/sps/vidp/saml20"
                         SPNameQualifier="https://mijntoepassing.vlaanderen.be"
                         >uuidbb24381b-0172-13a2-ade4-ac22fe076360</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData InResponseTo="_2bcac04ca0ca433e6ebe9adbb9f3f5b9cdf7ce650c"
                                              NotOnOrAfter="2020-06-16T09:46:45Z"
                                              Recipient="https://mijntoepassing.vlaanderen.be"
                                              />
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore="2020-06-16T09:44:45Z"
                         NotOnOrAfter="2020-06-16T09:46:45Z"
                         >
            <saml:AudienceRestriction>
                <saml:Audience>https://mijntoepassing.vlaanderen.be</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement AuthnInstant="2020-06-16T09:45:45Z"
                             SessionIndex="uuidbaef8f60-0172-13d1-af62-ac22fe076240"
                             >
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:be:vlaanderen:authmech:csamtotp</saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>
        <saml:AttributeStatement>
            <saml:Attribute Name="urn:be:vlaanderen:acm:persoonid"
                            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                            >
                <saml:AttributeValue xsi:type="xs:string">abcdefghijklmnopqrsstuvwxyz12345678901234</saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute Name="urn:be:vlaanderen:acm:voornaam"
                            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                            >
                <saml:AttributeValue xsi:type="xs:string">John</saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute Name="urn:be:vlaanderen:acm:naam"
                            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                            >
                <saml:AttributeValue xsi:type="xs:string">Doe</saml:AttributeValue>
            </saml:Attribute>
            <saml:Attribute Name="urn:be:vlaanderen:acm:mijntoepassing:3drol"
                            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                            >
                <saml:AttributeValue xsi:type="xs:string">MijnToepassing-RAADPLEGER:OVO000001</saml:AttributeValue>
            </saml:Attribute>
        </saml:AttributeStatement>
    </saml:Assertion>
</samlp:Response>

Hierbij merken we op:

  • de issuer: https://authenticatie.vlaanderen.be/sps/vidp/saml20
  • het NameID formaat is transient met als NameID: uuidbb24381b-0172-13a2-ade4-ac22fe076360 (dus een willekeurige UUID bij iedere authenticatie)
  • de ProviderID van de bestemmeling: https://mijntoepassing.vlaanderen.be
  • de assertion werd gesigned door de ACM IDP
  • de SAML Response is enkel geldig indien de lokale tijd op de Service Provider ligt tussen “NotBefore” en “NotOnOrAfter” (clock skew)
  • de RelayState die als POST-parameter wordt meegestuurd is exact dezelfde als bij het SAML AuthnRequest
  • er worden SAML attributen meegestuurd: urn:be:vlaanderen:acm:persoonid, urn:be:vlaanderen:acm:voornaam, urn:be:vlaanderen:acm:naam en urn:be:vlaanderen:acm:mijntoepassing:3drol