Hej!
Enligt dokumentation här
https://wiki.geant.org/pages/viewpage.action?spaceKey=TCSNT&title=TCS+2025+…
så kräver Harica följande attribut:
givenName (oid:2.5.4.42)
surname (oid:2.5.4.4)
mail (oid:0.9.2342.19200300.100.1.3)
edupersonTargetedID (oid:1.3.6.1.4.1.5923.1.1.1.10)
Men jag har problem att få iväg attributet edupersonTargetedID till Harica.
I attribute-filter har jag följande:
<AttributeFilterPolicy id="Harica">
<PolicyRequirementRule xsi:type="Requester"
value="https://www.harica.gr/simplesamlphp/module.php/saml/sp/metadata.php/pki-grn…"
/>
<AttributeRule attributeID="givenName">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="surname">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="mail">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="edupersonTargetedID">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="tcsPersonalEntitlement">
<PermitValueRule xsi:type="ANY" />
</AttributeRule>
<AttributeRule attributeID="eduPersonPrincipalName">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="schacHomeOrganization">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
<AttributeRule attributeID="eduPersonPrimaryAffiliation">
<PermitValueRule xsi:type="ANY"/>
</AttributeRule>
</AttributeFilterPolicy>
I attribute-resolver:
<AttributeDefinition xsi:type="SAML2NameID"
xmlns="urn:mace:shibboleth:2.0:resolver" id="edupersonTargetedID"
nameIdFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">
<InputDataConnector ref="StoredId" attributeNames="persistentId"/>
<AttributeEncoder xsi:type="SAML1XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" />
<AttributeEncoder xsi:type="SAML2XMLObject"
name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10"
friendlyName="edupersonTargetedID" />
</AttributeDefinition>
När jag loggar in så skickas attributet edupersonTargetedID enligt
bilaga, men det ser ut som Harica vägrar att ta emot detta då jag får
felmeddelande:
Cannot create your account
Your Identity Provider (IdP) does not provide HARICA with the
appropriate info (attributes) for your account.
Please contact your IdP, to fix this issue.
Testade även med https://cm.harica.gr/loginsaml/test.php och då får jag
att dessa attibut kommer fram (trots att attributen skickas enligt
bilaga alltså):
eduPersonPrincipalName: matsl(a)irf.se
schacHomeOrganization: irf.se
sn: Luspa
eduPersonEntitlement: urn:mace:terena.org:tcs:personal-user
eduPersonPrimaryAffiliation: The Swedish Institute of Space Physics
givenName: Mats
mail: mats.luspa(a)irf.se
groups: realm-irf.se, users, members
Är det någon i denna lista som fått SSO login till Harica att fungera
med idp shibboleth (ver. 5.1.4)?
/MVH Mats
--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik Fax: +46 (0)980 79 050
Swedish Institute of Space Physics email: matsl(a)irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: https://www.irf.se/pgp/matsl
Digital vcard: https://www.irf.se/vcard/mats.luspa
Shibboleth projekt vill gärna få feedback och förslag till förbättringar av IDP dokumentationen.
Se mail nedan.
-------- Forwarded Message --------
From: Steven Premeau via users <users(a)shibboleth.net<mailto:users@shibboleth.net>>
Reply-To: Shib Users <users(a)shibboleth.net<mailto:users@shibboleth.net>>
To: users(a)shibboleth.net<mailto:users@shibboleth.net>
Cc: Steven Premeau <shibboleth(a)premeauenterprises.com<mailto:shibboleth@premeauenterprises.com>>
Subject: IDP Documentation Survey
Date: 11/04/25 17:04:34
Some of you may recognize me from my former roles in the University of Maine and University of Wisconsin systems.
I am working with the Shibboleth Consortium to identify and prioritize options for improving the IDP (and IDP related) documentation -- one of the items on the
Shibboleth Project Roadmap 2025-2026<https://shibboleth.atlassian.net/wiki/x/AQDS0#Enhanced-Product-Documentatio…>.
If you are running the Shibboleth Identity Provider in production OR have utilized the existing documentation site(s), you are invited to participate in this effort by completing a survey sharing your experiences.
The survey can be found at: https://forms.gle/1BD4uLkvWDrkEuEV9
The survey can be completed anonymously. Optionally, an email address can be provided -- it will only be used if there are any follow-up questions.
The survey will close on Wednesday, April 30th.
Thank you in advance,
Steve.
När du skickar e-post till Karlstads universitet behandlar vi dina personuppgifter<https://www.kau.se/gdpr>.
When you send an e-mail to Karlstad University, we will process your personal data<https://www.kau.se/en/gdpr>.
Hej!
Omstart av release-check.swamid.se <http://release-check.swamid.se/> kommer se under förmiddagen vilket kommer skapa ett kort avbrott i tjänsten.
--
jocar
SWAMID Operations
Hej!
Tänkte höra mig för vilka MFA-metoder som används eller funderar på att användas som uppfyller de krav som AL2 och AL3 ställer?
Dvs, tekniker som uppfyller kraven och möjligen fungerar efter 2025/2027?
Vad är det för produkter som används?
Hur "brett" använder ni dessa?
Är det någon som använder samma MFA-lösning i andra system utöver er IDP?
Tror frågorna räcker.
Anledningen är att vi tittar på att uppdatera AL2 (eller AL3) där vi försöker få tips på vilka tekniker som finns och som går/kommer gå att använda inom Swamid idag och i framtiden.
Roger Mårtensson
System specialist / Systemspecialist
MID SWEDEN UNIVERSITY
Avdelningen för infrastruktur / Division of infrastructure
E-mail: roger.martensson(a)miun.se<mailto:roger.martensson@miun.se>
Information about processing of personal data at Mid Sweden University: www.miun.se/en/personaldata<https://www.miun.se/en/personaldata>
Hej,
För kännedom till er som kör.
Tänk dock på att mjukvara TOTP inte är tillåtet i SWAMID efter 2025.
// Björn M
> Begin forwarded message:
>
> From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
> Subject: Shibboleth IdP TOTP plugin V2.3.0 available
> Date: 1 April 2025 at 16:01:34 GMT+1
> To: "announce(a)shibboleth.net" <announce(a)shibboleth.net>
> Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
> Reply-To: users(a)shibboleth.net
>
> [You don't often get email from announce(a)shibboleth.net. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> A new version of the TOTP plugin for the IdP is now available, V2.3.0.
>
> The only additional feature is adding success/failure audit logging along the lines of the other authentication flows.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net
Hej
Jag stötte på ett litet problem när jag försökte uppgradera OSet på vår IDP-server (Ubuntu). Det är två paket som inte kan autouppdateras och verkar behöva skötas manuellt - mysql-server och mysql-client. Två frågor, vad exakt används dessa till på IDP-servern (den server kör endast IDP) och vad är smidigaste sättet att uppdatera dessa på (om det nu behövs)?
Bifogar texten från /var/log/unattended-upgrades/unattended-upgrades.log
2025-04-01 12:39:26,031 INFO Starting unattended upgrades script
2025-04-01 12:39:26,032 INFO Allowed origins are: o=Ubuntu,a=focal, o=Ubuntu,a=focal-security, o=UbuntuESMApps,a=focal-apps-security, o=UbuntuESM,a=focal-infra-security
2025-04-01 12:39:26,032 INFO Initial blacklist:
2025-04-01 12:39:26,032 INFO Initial whitelist (not strict):
2025-04-01 12:39:26,734 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:39:27,052 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:39:27,383 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:39:27,702 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:39:28,092 INFO No packages found that can be upgraded unattended and no pending auto-removals
2025-04-01 12:39:28,221 INFO Package mysql-client is kept back because a related package is kept back or due to local apt_preferences(5).
2025-04-01 12:39:28,222 INFO Package mysql-server is kept back because a related package is kept back or due to local apt_preferences(5).
2025-04-01 12:46:47,746 INFO Starting unattended upgrades script
2025-04-01 12:46:47,746 INFO Allowed origins are: o=Ubuntu,a=focal, o=Ubuntu,a=focal-security, o=UbuntuESMApps,a=focal-apps-security, o=UbuntuESM,a=focal-infra-security
2025-04-01 12:46:47,746 INFO Initial blacklist:
2025-04-01 12:46:47,747 INFO Initial whitelist (not strict):
2025-04-01 12:46:48,604 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:46:48,929 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:46:49,366 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-01 12:46:49,677 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-02 06:34:52,497 INFO Starting unattended upgrades script
2025-04-02 06:34:52,497 INFO Allowed origins are: o=Ubuntu,a=focal, o=Ubuntu,a=focal-security, o=UbuntuESMApps,a=focal-apps-security, o=UbuntuESM,a=focal-infra-security
2025-04-02 06:34:52,498 INFO Initial blacklist:
2025-04-02 06:34:52,498 INFO Initial whitelist (not strict):
2025-04-02 06:34:53,450 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-02 06:34:53,783 WARNING package mysql-client upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-02 06:34:54,249 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-02 06:34:54,584 WARNING package mysql-server upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
2025-04-02 06:34:55,611 INFO Packages that will be upgraded: linux-generic linux-headers-generic linux-image-generic
2025-04-02 06:34:55,611 INFO Writing dpkg log to /var/log/unattended-upgrades/unattended-upgrades-dpkg.log
2025-04-02 06:35:40,243 INFO All upgrades installed
2025-04-02 06:35:52,104 INFO Packages that were successfully auto-removed: linux-headers-5.4.0-208 linux-headers-5.4.0-208-generic linux-image-5.4.0-208-generic linux-modules-5.4.0-208-generic linux-modules-extra-5.4.0-208-generic
2025-04-02 06:35:52,104 INFO Packages that are kept back:
2025-04-02 06:35:52,347 INFO Package mysql-client is kept back because a related package is kept back or due to local apt_preferences(5).
2025-04-02 06:35:52,348 INFO Package mysql-server is kept back because a related package is kept back or due to local apt_preferences(5).
Mvh Vyacheslav Lytvynenko
IT-avdelningen
Högskolan i Skövde
Hej,
För kännedom.
Är samma säkerhetshål som för Shibboleth SP som vi skickar om förra veckan. Men nu är det IdP:n som har fått en fix.
Inte lika akut som SP:n men ni bör nog uppgradera ändå.
Infon skickad till saml-admins + admin, teknik och säkerhetskontakt i metadatat för de Shibboleth IdP jag hittat i SWAMID
// Björn M
> Begin forwarded message:
>
> From: "Cantor, Scott via announce" <announce(a)shibboleth.net>
> Subject: Shibboleth Identity Provider Security Advisory [26 March 2025]
> Date: 27 March 2025 at 15:04:56 CET
> To: "announce(a)shibboleth.net" <announce(a)shibboleth.net>
> Cc: "Cantor, Scott" <cantor.2(a)osu.edu>
> Reply-To: users(a)shibboleth.net
>
> Shibboleth Identity Provider Security Advisory [26 March 2025]
>
> An updated version of the OpenSAML Java library is available
> which corrects a parameter manipulation vulnerability when
> using SAML bindings that rely on non-XML signatures.
>
> The Shibboleth Identity Provider is impacted by this issue, and
> it manifests as a low to moderate security issue in that context,
> depending on its configuration.
>
> A separate advisory may be issued discussing the broader
> implications for those using the OpenSAML library directly.
>
> Parameter manipulation allows the forging of signed SAML messages
> =================================================================
> Vulnerabilities in the OpenSAML library used by the Shibboleth
> Identity Provider allowed for creative manipulation of parameters
> combined with reuse of the contents of older requests to fool the
> library's signature verification of non-XML based signed messages.
>
> The uses of that feature involve very low or low impact use cases
> without significant security implications, and allow an attacker
> to forge signed messages used to request authentication or logout,
> neither of which presents a major concern.
>
> The IdP's support for inbound SAML assertions (proxying SAML
> authentication) did partially support the POST-SimpleSign binding
> but is not believed vulnerable to an attack. This support was
> not documented and has been removed in this patch out of caution.
>
> A moderate issue resulting in potential information disclosure (but
> not forged logins) exists when the "skipEndpointValidationWhenSigned"
> profile configuration option is used [1]. This option does not
> implement standardized SAML behavior, and allows an IdP to be
> manipulated into sending responses to any URL contained in a
> request, provided the request is signed.
>
> This vulnerability allows an attacker to manipulate the IdP into
> responding to a URL of the attacker's choice, but in doing so the
> response can only be used compliantly by a Service Provider
> operating under the expected entityID and at that exact location.
> Furthermore, in most cases the enclosed data would be encrypted
> under a key known only to the legitimate SP. It would be an
> unusual and deliberate decision to implement this feature with
> an SP *not* also having an encryption key to use, and moreover
> to do so while relying on the known-vulnerable AES-CBC encryption
> algorithm.
>
> Thus, a combination of a number of deliberate, and to some extent
> poor, configuration choices create an information disclosure
> concern.
>
> Recommendations
> ===============
> Update to V5.1.4 (or later) of the Identity Provider software.
>
> In the meantime, avoiding use of the "skipEndpointValidationWhenSigned"
> profile option in conjunction with an SP without an encryption key
> or which does not support the modern AES-GCM data encryption algorithm
> is advisable as a mitigation.
>
> Credits
> =======
> Thanks to Alexander Tan of SecureSAML for discovering and reporting
> this vulnerability.
>
>
> [1] https://shibboleth.atlassian.net/wiki/x/yKC0vg
> [2] https://shibboleth.atlassian.net/wiki/x/koO0vg
>
> URL for this Security Advisory:
> https://shibboleth.net/community/advisories/secadv_20250326.txt
Hallihallå!
Onsdag 26 mars med start klockan 09.00 kommer vi göra underhåll på metadata.swamid.se. Borde gå snabbt och smärtfritt, meddelar via denna kanal när allting är klart och verktyget redo att användas igen.
--
jocar
Hej
Det kom in ett mail gällande sårbarheten i OpenSAML tidigare (https://wiki.sunet.se/pages/viewpage.action?pageId=241119211) dock står det väldigt lite kring hur man går tillväga med en uppdatering. Finns det någon lite mer detaljerad beskrivning eller tutorial för detta? Alt om någon har gjort det redan och kan hjälpa med instruktioner för Ubuntu.
Är det fler delar som påverkas och behöver uppdateras när man uppdaterar OpenSAML?
Mvh Vyacheslav Lytvynenko
IT-avdelningen
Högskolan i Skövde
