Question
Extending SAML v2 Metadata in Pega 7.4
Hi All,
Pega 7.4 has introduced a faster way to set up authentication service with a "no-code" approach.
We're looking at extending generated SAML v2 Message with additional xml tags such as ExtensionType with new attributes and elements.
We've tried extending existing Data-SAMLMetadata-ExtensionsType class with additional properties which were added to the XML Stream rule. It's not working so far.
Tracing the session doesn't help as no specific OOTB activity seems to be executed. Looks like all in java.
Any idea to achieve this extension will be helpful. Which rule to update to add the extension ?
Thanks,
Kind Regards,
Djibril Ndoye
Hi Lukasz,
Thank you for your response.We are not facing any particular error in the logs.
But we are not able to extend SAML 2.0 auto-generated token from the Authentication Service rule form. No way to find which code is executed even with Tracer.
Extensions Type is a SAML 2.0 data type as per OASIS specification but it seems that there's no much documentation on how to extend generated token with tags in 7.4.
Let me know if you may have an idea.
Kind Regards,
Hi
Data-SAMLMetadata-ExtensionsType class is available for extending SAML SP Metadata generated from the rule form.
But we are not able to extend SAML 2.0 auto-generated token from the Authentication Service rule form. No way to find which code is executed even with Tracer.
we are not generating any token from pega end.
Could you please elaborate the use case.
Use case is pretty simple, we want to add an Extensions to SAML 2 token but we can't find where the code.
We’ve tried exploring change on class Data-SAMLMetadata-ExtensionsType without success.
Accepted Solution
Adding extensions to SAML2 is not supported OOTB in 7.4 using authentication service.
Only way to achieve this requirement was to change the java code in the OOTB pySAMLWebSSOAuthenticationActivity in Step 13.
You need to use OpenSAML api to add the extension in the authrequest.
for POST binding signature is embedded inside authentication request.
Adding extensions the authrequest bean object may fail as signature is computed in createAuthenticationRequest method itself.
samlutils.createAuthenticationRequest(myStepPage)
But for Redirect binding it works as signature is computed in generateRedirectURL method.
We can get the authrequest bean object returned from createAuthenticationRequest method and add extensions after that calling generateRedirectURL method should help.
String redirectURL = samlutils.generateRedirectURL(endPointURL,samlutils.createAuthenticationRequest(myStepPage),myStepPage,relaystateID);
Below sample code used to achieve this requirement by updating step 13 of the activity pySAMLWebSSOAuthenticationActivity (Pega 7.4):
//SPECIFIC CODE : Define Extensions xml tag
org.opensaml.saml2.common.Extensions extensions = new org.opensaml.saml2.common.impl.ExtensionsBuilder().buildObject("urn:oasis:names:tc:SAML:2.0:protocol", "Extensions", "samlp");
org.opensaml.xml.schema.XSAny securityLevel = new org.opensaml.xml.schema.impl.XSAnyBuilder().buildObject(new javax.xml.namespace.QName("http://mynamespaceurl", "SecurityLevel","dacs"));
extensions.getUnknownXMLObjects().add(securityLevel);
securityLevel.setTextContent("0");
org.opensaml.saml2.core.AuthnRequest authnRequest = samlutils.createAuthenticationRequest(myStepPage);
authnRequest.setExtensions(extensions);
requestMessage = samlutils.getSAMLObjectASString( authnRequest);
if(oLog.isDebugEnabled())
oLog.debug("Generated authentication request : " + requestMessage);
}
} catch(Exception e) {
errorMessage = e.getMessage();
tools.putParamValue("ErrorMessage", errorMessage);
nextBlock = "ERR";
}
Hi,
Please take a look at the below documents, are describing the configuration for SSO SAML2 authentication:
And if you have properly configured SAML feature. Could you please send to us the error msg, logs which allow us to understand the issue that you have.
Thanks,
Lukasz