{"action":"created","issue":{"url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/1","labels_url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/1/comments","events_url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/1/events","html_url":"https://github.com/SAMLRaider/SAMLRaider/issues/1","id":99471132,"number":1,"title":"SAMLRaider invalidating seemingly valid SAML responses","user":{"login":"exploresecurity","id":8652841,"avatar_url":"https://avatars.githubusercontent.com/u/8652841?v=3","gravatar_id":"","url":"https://api.github.com/users/exploresecurity","html_url":"https://github.com/exploresecurity","followers_url":"https://api.github.com/users/exploresecurity/followers","following_url":"https://api.github.com/users/exploresecurity/following{/other_user}","gists_url":"https://api.github.com/users/exploresecurity/gists{/gist_id}","starred_url":"https://api.github.com/users/exploresecurity/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/exploresecurity/subscriptions","organizations_url":"https://api.github.com/users/exploresecurity/orgs","repos_url":"https://api.github.com/users/exploresecurity/repos","events_url":"https://api.github.com/users/exploresecurity/events{/privacy}","received_events_url":"https://api.github.com/users/exploresecurity/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-08-06T16:12:39Z","updated_at":"2015-09-16T08:42:34Z","closed_at":"2015-09-16T08:42:34Z","body":"Hi\r\n\r\nI was really keen to explore SAMLRaider but I got a bit nervy about using it because it appeared to be making changes beyond what I would have expected. I would intercept the HTTP request carrying the SAML response, delete a character, replace it and then send it on its way – thus I've made no overall change - but it would be rejected. When looking at the edited response the plugin had:\r\n\r\n-\tstripped all the newlines out completely. As far as I understand it, canonicalization retains CRLFs (but ensures they are always 0x0a) so I assume therefore that any 0a byte is part of the input that’s digested.\r\n-\ttaken out the attribute xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" from all elements that contained it (saml:Issuer, saml:Subject, saml:Condition, saml:AuthnStatement and saml:AttributeStatement). This presumably would change the digest of the assertion, assuming canonicalization retains the namespace attribute.\r\n\r\nSo in both cases the digest was being changed, thus invalidating the signature, hence the response . was rejected. Grateful for any comments.\r\n\r\nJerome"},"comment":{"url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/comments/140673522","html_url":"https://github.com/SAMLRaider/SAMLRaider/issues/1#issuecomment-140673522","issue_url":"https://api.github.com/repos/SAMLRaider/SAMLRaider/issues/1","id":140673522,"user":{"login":"RouLee","id":12732212,"avatar_url":"https://avatars.githubusercontent.com/u/12732212?v=3","gravatar_id":"","url":"https://api.github.com/users/RouLee","html_url":"https://github.com/RouLee","followers_url":"https://api.github.com/users/RouLee/followers","following_url":"https://api.github.com/users/RouLee/following{/other_user}","gists_url":"https://api.github.com/users/RouLee/gists{/gist_id}","starred_url":"https://api.github.com/users/RouLee/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RouLee/subscriptions","organizations_url":"https://api.github.com/users/RouLee/orgs","repos_url":"https://api.github.com/users/RouLee/repos","events_url":"https://api.github.com/users/RouLee/events{/privacy}","received_events_url":"https://api.github.com/users/RouLee/received_events","type":"User","site_admin":false},"created_at":"2015-09-16T08:42:34Z","updated_at":"2015-09-16T08:42:34Z","body":"Hi Jerome\r\n\r\nSorry for the big delay in fixing your issue. The namespaces are now no longer deleted and the line breaks are retained.\r\nUnfortunately I do not have a Salesforce IdP for real life testing :)\r\nI could only test it with an example assertion from the Salesforce website and validate it manually.\r\nI would be glad if you could test the extension the next time you have to deal with such an IdP and send me your feedback.\r\n\r\nThanks again for the bug report.\r\nCheers\r\nRoland"}}