The SAML response contains duplicate sections of "ds:Reference" #11604
Description
Describe the bug
The SAML response contains duplicate sections of "ds:Reference"
According to a java SAML implementation this referency should be unique and therefore the SAML response is rejected.
To Reproduce
- configure SAML provider.
- Select "Sign assertions" and "Sign responses"
- go to site that will use it.
- capture saml response with chrome.
- decode the base64
- see the duplicate reference
Expected behavior
ds:Reference should be unique according to my information.
Version and Deployment (please complete the following information):
- authentik version: 2024.8.3
- Deployment: docker-compose
Additional context
Here is one of the faulty saml responses. I removed all information specific to our deployment.
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
Version="2.0" IssueInstant="2024-10-03T07:06:39Z"
Destination="https://acs.url" ID="_bfde1dda2d9e41cfac017ecb9d160987"
InResponseTo="__a6ac044d-f788-440a-bb4d-a9976d892a0e">
<saml:Issuer>https://saml-test.com/</saml:Issuer>
<samlp:Status>
<samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" />
</samlp:Status>
<saml:Assertion Version="2.0" ID="_c84d363337664cec85c06916625cbae9"
IssueInstant="2024-10-03T07:06:39Z">
<saml:Issuer>https://saml-test.com/</saml:Issuer>
<ds:Signature>
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
<ds:Reference URI="#_c84d363337664cec85c06916625cbae9">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>CpFJ+gnTmFxT9EYBq+uTfYo2Rt5YJbS7ut40jh/jh/c=</ds:DigestValue>
</ds:Reference>
<ds:Reference URI="#_c84d363337664cec85c06916625cbae9">
<ds:Transforms>
<ds:Transform
Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
<ds:DigestValue>CpFJ+gnTmFxT9EYBq+uTfYo2Rt5YJbS7ut40jh/jh/c=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>---removed---</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>---removed---
</ds:X509Certificate>
</ds:X509Data>
<ds:X509Data>
<ds:X509Certificate>---removed---
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<saml:Subject>
<saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">
test-user</saml:NameID>
<saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
<saml:SubjectConfirmationData InResponseTo="__a6ac044d-f788-440a-bb4d-a9976d892a0e"
NotOnOrAfter="2024-10-03T07:11:39Z"
Recipient="https://acs.url" />
</saml:SubjectConfirmation>
</saml:Subject>
<saml:Conditions NotBefore="2024-10-03T07:01:39Z" NotOnOrAfter="2024-10-03T07:11:39Z">
<saml:AudienceRestriction>
<saml:Audience>
https://dummy.local</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2024-10-03T07:01:39Z"
SessionIndex="_c84d363337664cec85c06916625cbae9"
SessionNotOnOrAfter="2024-12-02T07:06:39Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
</saml:AuthnContext>
</saml:AuthnStatement>
<saml:AttributeStatement>
<saml:Attribute Name="http://schemas.goauthentik.io/2021/02/saml/username">
<saml:AttributeValue>test-user</saml:AttributeValue>
</saml:Attribute>
<saml:Attribute Name="http://schemas.xmlsoap.org/claims/Group">
<saml:AttributeValue>authentik Admins</saml:AttributeValue>
<saml:AttributeValue>SAML-Test</saml:AttributeValue>
</saml:Attribute>
</saml:AttributeStatement>
</saml:Assertion>
</samlp:Response>
Thanks and best regards,
Tobias