SAML - 'InResponseToField doesn't correspond to sent message' error and SAMLContextProviderLB

[mskyttner]

Using a proxy chain in front of the shinyproxy server with an "outer proxy" as entrypoint (and leading to the SAML-authenticated shinyproxy server, which uses a different hostname, and which is also exposed externally), users will see SSO login attemps fail when attempted via the "outer proxy" but not when going "directly" to the shinyproxy server.

The shinyproxy log at that point complains with:

o.s.security.saml.log.SAMLDefaultLogger : AuthNResponse;FAILURE;****;https://app_identifier;https://saml_idp_server/idp/shibboleth;{cryptic_string_goes_here};;org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message a4eed0g849d0b7030e89bfh89g0j7d

Wishing for a feature be added to shinyproxy so that the checking of the InResponseToField be disabled in shinyproxy when using SAML auth. Or (if this is already possible) for documentation to describe how to activate such behaviour.

The spring-security-saml docs suggests this could be done by re-configuring the context provider: https://docs.spring.io/spring-security-saml/docs/current/reference/html/chapter-troubleshooting.html#d5e1935

And these docs indicate that this use case (accessing shinyproxy via a proxy chain through an external load balancer) might be possible to support w spring-security-saml?

https://docs.spring.io/spring-security-saml/docs/current/reference/html/configuration-advanced.html#configuration-load-balancing

[johannestang]

I'm not sure if it addresses your issue, but I've made a pull request that adds support for SAMLContextProviderLB. You can find a build of the ShinyProxy jar with these changes here.

[LEDfan]

Hi @mskyttner

In ShinyProxy 2.5.0, we included the contribution by @johannestang. Please check our documentation on how to configure it.

I'm looking forward whether this solves your issue.

[mskyttner]

Hi @LEDfan I will test the release and ping back here with results.

Looking at the documentation I think it looks like two links may need repointing:

• https://shinyproxy.io/documentation/securirty (should be https://shinyproxy.io/documentation/security)
• https://shinyproxy.io/faq/#invalid-redirect_uri-when-using-openid-connect-or-keycloak (should be https://shinyproxy.io/documentation/faq/#invalid-redirect_uri-when-using-openid-connect-or-keycloak)

[LEDfan]

Thanks for reminding me about the broken links, they are all fixed now.

[LEDfan]

As I believe that your question is answered, I'm closing this issue. Feel free to re-open it if you need more help.

[mskyttner]

Sorry, late response, this seems to have solved the issue, thanks!