philduba.com

SAML and ColdFusion Part 6 : Validating an Assertion

Posted On May 10, 2007 7:32 AM By Phil in SAML,ColdFusion

Welcome to what I believe will be the last entry in my SAML and ColdFusion series. This entry concentrates on validating a SAML assertion which includes checking for conditions, validating the signature, and extracting the assertion attributes. This post builds off of all the previous posts, so if you are just coming to this series at this point in time, I would suggest reading each of the previous posts in this series to see the background information. In the last post, we created a way to sign a document and create a keystore with a self-signed certificate. In this entry, we'll validate the assertion that was created, creating both a ColdFusion template for validation and a Java class file for verification.

[More]

Comments (11) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 11020 Views

SAML and ColdFusion Part 5 : Signing a Document

Posted On May 1, 2007 5:44 PM By Phil in SAML,ColdFusion

In this entry of the SAML series, I'll build a ColdFusion template as well as a Java class to sign an XML document. I'll also cover creating a keystore and self-signed certificate that will be used for the signature generation and verification. The logic created in this entry is heavily influenced by an article by Robert Sayre located here. So now, let's get on to the code!

[More]

Comments (10) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 7087 Views

SAML and ColdFusion Part 4 : Setting Up the Library

Posted On April 26, 2007 7:00 AM By Phil in SAML,ColdFusion

So far in this series, I have talked about what SAML is, what makes up and Assertion and what XML Digital Signatures are. Now, it is time to actually get into an implementation using ColdFusion. Unfortunately, a pure ColdFusion solution is unattainable due to the limitations of XML manipulation and the lack of native XML Signature components in its supported JRE (1.4.whatever). As a result, I did a lot of research on the various libraries and products out there. I wanted something simple to implement and preferably open source and, obviously, it had to be compatible with ColdFusion. After about a few days, I decided on the Apache XML Security library. No sense beating around the bush, here are the steps I used to implement this library, pay special attention to the versions of the library used as the latest isn't the right one for this version of ColdFusion (note: I used ColdFusion MX 7.0.2):

[More]

Comments (0) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 3767 Views

SAML and ColdFusion Part 3 : XML Digital Signatures

Posted On April 16, 2007 6:23 PM By Phil in SAML,ColdFusion

In parts one and two, I talked about the basics of SAML as well as the structure of a SAML assertion. In this entry, I am going to briefly cover a part of the assertion I skipped over last time, the Digital Signature. XML Digital Signatures are a common part of SAML artificats as they help to provide:

• Flexibility in signing documents
• Uses existing cryptographic and security technologies such as X509 and SHA1
• The integrity of the document and data transfered
• Creation and Verification of portable signatures

[More]

Comments (4) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 6309 Views

SAML and ColdFusion - Part 2

Posted On February 9, 2007 7:42 AM By Phil in SAML,ColdFusion

Ok, I know it has been a while, but I'm ready for part 2 of the SAML and ColdFusion series. In this post, I will talk about the main carrier of information between an Identity Provider and a Service Provider, the Assertion. If you recall from my previous post, a form variable called SAMLResponse containing a Base64 string is submitted. This variable is what contains the Assertion document. The Assertion helps to convey the following information:

• Header information which usually identifies the identity provider submitting the assertion and any conditional information used to validate the request
• Information relating to the Subject of the Assertion or the user for which the SSO action is being performed
• A series of Authentication or Attribute Statements
• Digital Signature

[More]

Comments (2) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 9532 Views

SAML and ColdFusion - Part 1

Posted On December 29, 2006 4:52 PM By Phil in SAML,ColdFusion

Over the summer, I began to work on a project that wnated to utilize SAML(all information in this post and follow on ones are retrieved from the OASIS site), or Security Assertion Markup Language. At the time, I wasn't given much information about SAML, except for the link to the site and asked: "Can we implement this?". Well, luckily, that customer decided to go in a different direction as if one looks through the SAML documentation, there are numerous Use Cases and Implementations. Although the project was dead, I thought about how to implement something like this within our company's suite of applications which are ColdFusion based. Now for some background on SAML. For those that may be unaware, SAML is an XML-based way of doing federated authentication, providing a level of single sign-on previously done through either adding a filter or executable to one's web server or custom-built exchange mechanisms/URL parameters . SAML's documentation talks to a number of ways to utilize what it calls Authentication Assertions, but, within a web-based environment, there are essentially 3 parties involved: Browser, Identity Provider or Source Site and a Service Provider or Destination Site. Essentially, the typical Use Case for web-based applications is as follows:

• User browses to the Source Site
• User attempts to access protected content on the Source Site
• User is prompted for authentication credentials within the Source Site
• Source Site validates authentication of the User's credentials
• User continues to utilize Source Site resources
• At some point, the User is redirected to a Third-party/Partner site due to their credentials, status or permissions

[More]

Comments (29) | Print | Send | del.icio.us | Digg It! | Linking Blogs | 7141 Views