saml2 | SimpleSAMLphp low-level SAML2 PHP library | Authentication library

Yes, the identity provider (IdP) should expose a SAML 2.0 metadata endpoint, the URL is added in the IdPMetadata.

The TestIdPCore sample is for testing the samples and to show how to implement a SAML 2.0 based IdP.

Your application (relaying party RP) needs a certificate, which is e.g., added as a file in SigningCertificateFile.

Maybe you are missing the part of adding claims to the token and creating the token?

The issue is that the ACS url is set to localhost. The ACS (Assertion Consumer Service) URL is where the IdP sends the SAML Assertion.

You're telling AWS SSO to send the SAML assertion to itself, which isn't going to work. Your application needs a public-routable IP. AWS SSO needs to send the SAML assertion over the internet.

There may be other issues (I didn't really check anything once I ran into the ACS issue). But the ACS URL is your current issue.

v2 doesn't use System.IdentityModel, but instead the more modern Microsoft.IdentityModel nuget packages. The corresponding settings are now found in SpOptions.TokenValidationParametersTemplate.

Some parameters,like the audience restriction is set after the template is copied, but you can alter the values in the Unsafe.TokenValidationParametersCreated notification. The reason it is under "Unsafe" is because setting the wrong values in the TokenValidationParameters could remove important security checks.

Please have a look at the documentation of Composer scripts. It explains pretty obvious:

post-install-cmd: occurs after the install command has been executed with a lock file present.

If you are using composer install with a lock file not present (as indicated from the console output), this event is not fired.

The following answer applies if you are running the API Manager and Identity Server with separated User Stores configured. Apply the following configurations on top of the instructions mentioned in the Docs and try out the scenario.

1. Add two roles in the Identity Server named publisher and creator without any permissions and assign both to the User that you are using to log in. You can skip this part if you already have roles assigned to the User in the Identity Server to do a Role Mapping in the API Manager server.

2. Open the Service Provider you have created in the Identity Server and go to Inbound Authentication Configuration > SAML2 Web SSO Configuration and click on Edit. Tick the Enable Attribute Profile and Include Attributes in the Response Always and Update

3. Expand the Claim Configuration of the Service Provider that is created in the Identity Server and select the Use Local Claim Dialect option. Then, click on Add Claim URI and in the appeared drop-down select http://wso2.org/claims/role and tick the Mandatory Claim. Once done, update the configurations.

4. Open the Identity Provider that is created under the API Manager server and expand the Role Configuration section.

   • Click on Add Role Mapping and enter the following
     • Identity Provider Role: publisher (use the correct role name that you have assigned in the Identity Server)
     • Local Role: Internal/publisher
   • Click on Add Role Mapping and enter the following
     • Identity Provider Role: creator (use the correct role name that you have assigned in the Identity Server)
     • Local Role: Internal/creator

   Update the configurations.

Once the configurations are saved, now try logging into the Publisher Portal of the API Manager with the specific user.

You should be sending a SAML response containing a SAML assertion to the SP rather than just a SAML assertion. You also need to ensure this is encoded correctly as per the SAML v2.0 Bindings specification.

You really need the SP to assist with the debugging. Hopefully their logs will provides details as to why they're rejecting your HTTP Post.

It is probably ok to deactivate the certificate change validation. The validation only checke if the certificate has a chain known for the relying party. Meaning that the root certificate has to be known on the relying party service / server.

You can do that by exposing a bean of type RelyingPartyRegistrationRepository: